Writing a Key Control Policy for Your Business

Why a written policy matters

Many small businesses run on trust and memory. The owner hands a key to a new hire, a manager makes a spare for a cleaner, a contractor borrows the back door key for a week. Nothing is written down, and months later nobody can say how many keys exist or where they are. That works until a theft, a dispute or an employee departure forces the question, and then it is too late to reconstruct.

A written policy replaces memory with a shared rule. It states who can approve keys, how they are recorded, what employees promise when they take one and what the business does if one is lost. It also protects staff, because they know exactly what is expected and cannot be blamed for rules nobody explained. The policy does not need to be long. One or two pages that people can read in a few minutes are better than a thick document no one opens.

Treat the policy as part of the security of the building, alongside the locks themselves. A strong lock with an unaccounted key is no better than a weak one. If your business is just starting to think about this, our guide on master key planning for small businesses shows how the structure of the system supports good control.

Start by finding out what you have

Before writing rules, take an inventory. Count every key to every door, gate, cabinet and drawer. Record the number stamped on each key if there is one, the lock it opens, who holds it and where spares are stored. Include keys held by landlords, security companies, cleaners and past staff. The first inventory is often a surprise, with more copies in more hands than anyone expected.

As you go, note the keys you cannot account for. A missing key is not necessarily a disaster, but it is information. If the key opens an exterior door or a high value area, consider rekeying as a clean start. Our page on lock rekeying explains how existing locks can be reset so old keys stop working, which is often more practical than replacing hardware.

Record the result in a single place. A spreadsheet with columns for key number, door, level of access, holder, date issued, date returned and notes is enough for most small businesses. Keep it somewhere secure, limit who can edit it and back it up. The inventory becomes the starting point of your log, and from then on the log is the source of truth.

• Count every key, including spares, and match them to locks.
• Record key numbers, holders and storage locations.
• List unaccounted keys and decide if affected locks need rekeying.
• Identify outside parties who hold keys, such as landlords or cleaners.

The key log: what to record

A key log is simple but must be consistent. For each key, record a unique key number, the doors it opens, the access level, the person who holds it, the date it was issued, who approved it and the date it was returned or reported lost. When a key moves between people, record both changes. If a key is copied, record the copy as a new entry, since it is a new key that needs tracking.

Pair the log with a short acknowledgment that the holder signs. It can be one paragraph stating that the person received the key, will keep it safe, will not copy it or lend it, and will report a loss immediately. A signature turns a casual handoff into a clear responsibility. Store signed acknowledgments with the log, and give the holder a copy if they ask.

Review the log regularly. Once a quarter is common for small businesses. Walk through each entry, confirm the person still works for you and still needs the key, and ask them to show it. This takes minutes and often reveals keys that have quietly moved. Replace the habit of assuming everything is fine with a habit of checking.

Restricted keys and copy protection

Anyone can copy an ordinary key at many shops. The words do not duplicate stamped on a key are a request, not a barrier, and a copy kiosk may ignore them. If you need real copy control, look at restricted keyway systems. These use blanks that are not sold openly and require authorization from the system owner to cut. Orders can be limited to named people, and the manufacturer or distributor may keep records.

Restricted keys cost more to set up and to copy, and they take more planning, but they reduce the chance of an untracked duplicate. They are best for the doors that matter most, such as cash rooms, server rooms, pharmacies or storerooms with valuable stock. For ordinary interior doors, standard keys with good logging may be enough. Our page on high security locks explains the main options.

Remember that restricted keys only help if the policy backs them up. Decide who is authorized to order copies, how a request is made and how a new key is logged. If anyone can phone the supplier and ask for a copy, the restriction means little. Put the authorization rule in the policy in a sentence or two and make sure the supplier has the same list.

Issuing and returning keys

The issue process should be quick but deliberate. A manager approves the need, the key is taken from controlled stock or cut, the log entry is made and the holder signs. No key should leave the building without this chain. Give people the least access that lets them do the job, which usually means a change key or a sub-master rather than a master.

The return process matters just as much. Make returning a key part of the normal end of employment, shift or contract. Collect the key in person where possible, and check it against the log. If a worker gives back a key that is a copy, or that does not match the number, treat that as a discrepancy and look into it. A casual drop in a desk drawer is not a return.

Temporary access needs a clear plan. Contractors, delivery companies and seasonal staff often need keys for a limited time. Log them with an end date, retrieve them on schedule and consider using a keypad or a lockbox with changeable entry numbers instead of a physical key. If you are a landlord or manage shared spaces, see property manager lock service for similar practices.

1. Manager approves the request and states what doors the person needs.
2. Key is issued from controlled stock and entered in the log.
3. Holder signs the acknowledgment and receives instructions.
4. Regular reviews confirm the key is still needed and still held.
5. Key is returned in person and the log entry is closed.

What to do when an employee leaves

Turnover is where key control usually fails. Build departure into your checklist alongside returning equipment and closing accounts. On or before the last day, collect all keys and check them against the log. If the person held a key that cannot be recovered, decide whether it justifies rekeying. A part time worker with a single interior key is different from a manager who held a master.

If someone leaves on difficult terms, act promptly. Collect keys, change entry numbers on any keypads and consider rekeying exterior doors and sensitive rooms. It is usually less expensive and less stressful to rekey than to deal with a later problem. You do not need to assume bad intent, only to protect the business. Timing matters, since a delay gives an unreturned key more time to be copied.

Remember digital access as well. Remove the person from any electronic access system, alarm panel or app. Change alarm and gate numbers they knew. If your building has a landlord or management office that issued keys, tell them too. Our page on digital lock code best practices helps with the electronic side of the same discipline.

Lost, stolen or suspected copied keys

The policy should say what happens the moment a key is missing. The holder reports it right away to a named person, with no blame for reporting promptly. The manager notes what the key opens, when and where it was last seen, and whether anything else was lost with it, such as a wallet with an address. That information determines how urgent the response is.

Then decide on the action. For a change key to an interior door with low value contents, you may simply note it and watch. For an exterior door or a master key, rekeying the affected locks is usually the right response. A locksmith can often rekey on site, in less time than replacing locks. Quotes are given by phone, and more complicated jobs may need an on site visit with a service call charge explained before dispatch.

After the incident, update the log, issue new keys and consider what you can learn. Was the key on a ring with identifying tags? Was it left in a vehicle? Small changes in habit, such as removing address tags and storing keys in a locked drawer overnight, reduce repeat events. For a burglary or break-in situation, see lock change after a break-in.

Storing spare and unissued keys

Spare and unissued keys deserve as much care as keys in daily use, because nobody notices when they go missing. Keep them in a locked cabinet or a small key safe, in a room that is not open to the public. Limit who can open that cabinet, and record each time a key leaves it. A cabinet with numbered hooks makes gaps obvious at a glance.

Do not store spares in the same place as the doors they open, and never inside an unlocked desk near the front counter. If you use a lockbox on site, change its entry number when someone with access leaves. Keep blank keys, if you hold any, under the same control as cut keys, since a blank in the wrong hands can be turned into a working key.

Count the stock on a schedule. A monthly check against the log takes only a few minutes and keeps the record honest. If the count is off, find out why before the next shift. Small habits like this build a culture where keys are treated as valuable, and that attitude spreads to the people who carry them every day.

Putting the policy to work in a Florida business

Many Central Florida businesses have seasonal staff, tourist driven schedules and shared buildings. A restaurant or retail shop may hire a larger crew for peak months, then shrink. A property with a landlord, a security contractor and a cleaning company has more key holders than the owner realizes. The policy should name these groups and explain how keys are handled for each.

Weather planning also belongs in the policy. Before hurricane season, check that you know who holds keys and who can reach the building if the owner cannot. Decide where a backup key is stored and who may access it in an emergency. After a storm, a damaged door or lock may need quick attention, and a clear list of key holders makes it easier to secure the property.

Keep the policy short, put it where people can read it and review it once a year. When you are ready to improve your own key control, or if you want help rekeying after a change in staff, call and describe your situation. A technician can suggest what to do first, and explain the process and the quote over the phone.

Questions people ask

Related pages

Written by Claude (AI) (AI) for 24/7 Locksmith Orlando.