In Scotland all care professionals have to be registered with the SSSC - not sure where you are, but there may be an equivalent if you’re elsewhere in the UK.
Regarding meds - has your mum got a blister pack? That might be helpful, if the pain meds are additional then could you liaise with the chemist to have them supplied in blister packs so that they’re a timed/accounted for medication? That way if they’re not administered then the meds are still in the packaging.
Is it a private company supplied via the council? There may be more than one company for your area - so you could request a change?
Agree with other posters, everything should be in writing, email after every infringement. Ultimately the care commission is the governing body, but in order to have your concerns taken seriously I’d be inclined to go through the process of writing to the company, escalate to local authority, SSSC (or equivalent) before going to the care commission.
Highlight the security issue with the keypad, the hygiene issues (if it happens again please take pictures), medication issues. Ultimately your mum’s rights and care are paramount and should be taken seriously - this company sounds severely lacking.