What is a key control policy?

Neighbors Ask

The plain meaning of the term

It sounds like something from a large corporation, but the idea is simple. A key control policy answers four questions in writing. Who is allowed to have a key? How do they get it? How do we know who has what? And what happens when someone leaves or a key goes missing? Any business, building or household that has more than a couple of keys can benefit from answering these.

Without a policy, keys tend to spread. One is handed to a friend, another is copied at a store, a third stays in a drawer after an employee leaves. Nobody intended anything wrong, but over a few years no one can say how many working copies exist. A policy does not stop all of that, but it makes the spread visible and gives you a way to act.

A good policy is short. If it runs to twenty pages, nobody will read it. A single page that a new employee, a property manager or a family member can understand in one sitting is better than a thick binder that sits on a shelf. In this column we will describe what belongs in it and how to fit it to your situation.

Who needs one

Property managers, landlords, small shops, offices, workshops, churches, clubs, farms and families who run a rental all have reasons to write one down. The more people who can enter a place, the more a policy helps. A sole owner with a single key might not need much, but the moment a second person is involved, a few lines of agreement are worth having.

Even a household can use the idea. If you have teenagers, a house sitter, a cleaner and a relative who checks in, you already have a crowd of people with access. A small version of the policy, perhaps a note on the fridge saying who holds which key and what to do when one is lost, brings order to something that otherwise happens by habit.

Larger organizations may have formal rules about who approves key requests, who cuts keys, and who records them. We will describe those too, but the basic structure is the same whether you are a family of four or a company with several buildings. Scale the policy to the risk and the size of the group. A policy also helps with outside visitors such as contractors, delivery staff and inspectors. Decide whether they ever receive a key, who escorts them, and how access is tracked. For most places the answer is that outsiders do not hold keys and are admitted by a staff member, with a clear record when an exception is made. Writing this down protects both the business and the visitor from misunderstandings.

What goes in a basic policy

Those five points make a workable policy. Each can be written in a sentence or two. For example, the rule about copying could simply say that keys marked do not duplicate must not be copied, and that anyone needing an extra key must ask a named person. The aim is clarity, not legal language.

You may also want to name the person responsible. In a small business this might be the owner or the office manager. In a family it might be the person who keeps the master list. Having a name matters, because a policy with no owner is likely to be forgotten. That person keeps the records, answers questions and makes decisions about exceptions.

Add a short section on what to do in an emergency. Who can open the building after hours, who has the emergency spare, and who calls the locksmith. If someone has to make these decisions at midnight, they should not have to guess. Put the numbers on the same page as the rest of the policy. Think about the seasons and the setting too. In a mountain town with heavy snow, a shed or gate may be reached only part of the year, so its key might be issued seasonally and collected again in spring. In the valley, a farm or a lot with seasonal workers may need keys issued and returned on a schedule. Matching the policy to the rhythm of the place keeps it realistic.

• A statement of who may hold keys and what level of access they receive.
• A record of every key, its marking, the door it opens and the person who holds it.
• A rule that keys are not copied or lent without approval.
• A process for reporting a lost or stolen key straight away.
• A return procedure for when someone leaves or a role changes.

The key record, the heart of the matter

If you do only one thing, keep a record. A key record lists each key by a number or a code, shows which locks it opens, names the holder and gives the date it was issued. It can be a paper table or a simple spreadsheet. What matters is that it is current and that someone looks after it.

Numbering keys helps. A stamped number on the bow of the key lets you identify it without reference to the lock. Avoid stamping the address or the name of the business on a key, since a lost key with an address on it is an invitation. Use a code that only the record can translate.

Check the record regularly. At least twice a year, ask everyone to show their keys and compare them with the list. This is not about distrust, but about catching drift before it becomes a problem. People are usually happy to help, and some are relieved to hand back keys they had forgotten they held.

Issuing keys: the principle of least access

A central idea in key control is that each person should hold only the access they need for their work. A cleaner needs the doors to the areas they clean, not the owner's office. A part time clerk needs the front door on their shift, not the stockroom at all times. Giving more than that is convenient but widens the risk.

This is where a master key system can help. A well planned system lets some keys open many doors, others open a few, and a few open only one. It also lets you issue a limited key that cannot open sensitive areas. Our guide on master key systems explains how they are laid out.

When someone requests a key, the policy should say who approves and how. A short form or an email is enough. The approver checks that the request is reasonable, the issuer records it, and the recipient acknowledges receipt. Writing it down feels formal at first, but it is an excellent protection for everyone, including the person receiving the key.

Keeping keys from multiplying

Copying is the main route by which keys spread. A key cut at a general store can be done in moments by anyone. Some keys carry a mark that asks for no duplication, but this is a request rather than a lock, and not every shop pays attention. For tighter control, many organizations use a restricted keyway, where blanks are available only through approved sources.

A restricted system is more of an investment, and it is not needed by everyone. For a small shop, a clear rule and a habit of counting keys may be enough. For a building with many tenants or sensitive areas, restricted keys can be worth the effort. A technician can explain what is available and what would suit you. See what a key blank is for background.

Electronic systems offer another path. A keypad or card can be issued, logged and cancelled without any physical copying. The trade off is that you depend on electronics and a management routine, and someone must keep the system up to date. Many places use a mix, with electronic access for common doors and keys for the rest.

When a key goes missing

Every policy needs a lost key plan, because it will happen. The first rule is to report it right away, without blame. People hide losses when they fear punishment, and a hidden loss is worse than a reported one. Make it clear that reporting is expected and that nobody will be shamed for it.

Next, assess the risk. A key lost inside a locked building is a small concern. A key lost in a public place, or by someone who has left, is serious. If the key could be used to enter without your knowledge, the safest response is to rekey the locks it opens. Rekeying changes the pins inside the cylinder so that old keys no longer work. Read about business lock service for how we handle it.

Record what happened, including the date, the key and the steps taken. If the key opened many doors, a rekey of the whole set may be needed, which is why limited access matters. A policy that gives each person only what they need makes losses small and responses simple.

When people leave or roles change

The moment someone leaves is the most predictable risk in key control. The policy should say that keys are returned on or before the last day, that the record is updated, and that any key not returned leads to a decision about rekeying. This should be a routine, not a negotiation. Our page on what an office does when an employee leaves gives a step by step approach.

A change of role matters too. A person who moves from one job to another may no longer need certain keys. Collect them, update the record and issue what the new role requires. It is easy to leave old access in place out of habit, and over time such leftovers accumulate.

In a household or rental, the same principles apply when a tenant moves out, a roommate leaves or a helper ends their work. See how keys are handled at a tenant move out. A short routine, done every time, keeps the number of unknown keys at zero.

A picture of it in a small shop

Imagine a small shop with an owner, two part time clerks and a weekend helper. The owner holds every key. Each clerk has a key to the front door and a code for the alarm. The helper has no key and is let in by whoever opens. A one page policy states this, names the owner as keeper and lists what to do if a key is lost.

Now imagine that one clerk moves away. On the last shift, the owner collects the front door key, crosses it off the list and changes the alarm code. The whole routine takes a few minutes, and nobody has to wonder later whether a former employee can still walk in. That is what the policy buys: calm, predictable handling of ordinary events.

Contrast that with the shop that has no list. Five keys were cut years ago, two were given to relatives, one was lost on a trip and nobody remembers which clerk had which. When a problem arises, the owner has to rekey everything and still cannot be sure the risk is gone. The cost of having no policy is paid in worry as well as money.

Starting small and improving over time

You do not need to build the perfect system on day one. Start with a list. Write down every key you know about, who holds it and what it opens. Mark the keys you cannot account for. That alone will tell you how much work is needed, and it often reveals surprises, such as a door that no one has a key for or a key that opens nothing.

Then write a one page policy based on the points above. Share it with everyone who holds a key and ask them to confirm. Training does not need to be elaborate. When a new person joins, spend a few minutes walking them through the policy, show them where the key record lives and explain why it exists. People follow rules they understand. If they know that a lost key is simply reported and handled, they are far more likely to speak up than if they fear a scolding. Treat the policy as a safety habit, like locking up at night. Look it over again after six months and adjust. If you find that the policy is too strict and people are working around it, change it. A policy that people ignore is worse than a modest one that they follow.

If you want help, a technician can inspect your locks, tell you what keyways and systems you have, and suggest improvements that suit your size and budget. You can describe your situation on the request form. We serve businesses and homes across the region, including Redding and Mount Shasta, and the idea scales to any place with more than one key. Finally, keep the policy itself somewhere safe. The record of who holds which key is sensitive, because it tells a reader exactly where the weak points are. Store it in a locked drawer or a protected file, and share the full list only with the person who keeps it. Everyone else needs to see only the rules and their own line.

Good to know

Common questions