What key control actually means
Key control is the answer to a simple question: at this moment, who can open each door in your business? If you can answer it with confidence, you have key control. If the honest answer involves the words probably, I think, or somebody might still have one from before, you do not.
A small business in Newark or Dover might have a front door, a rear delivery door, an office, a stock room, a server closet and a cash office. It might have a dozen staff over a year, a cleaning company, an alarm technician, a landlord, a property manager and an IT contractor. Every one of those relationships can create keys. Without a policy, each key is issued informally and forgotten about just as informally.
The consequences show up at awkward times. An employee leaves on bad terms and you realize you never got a key back. Stock goes missing from a room that was supposedly locked, and you cannot say who could have entered. A manager loses a ring with every key on it, and the only safe response is to rekey the whole building. Each of these costs more than the time it would have taken to write a simple policy.
A key control policy is not about distrust. It protects employees as much as the business, because when something goes wrong, a clear record of who had access removes suspicion from everyone who did not.
The policy
Seven sections, one page.
Write it in plain language so that everyone who holds a key can read it in two minutes.
1. Ownership. Every key remains the property of the business. It is issued for work use and must be returned on request or when the holder leaves.
2. Authority. Name one person who approves key issues. In a small business this is usually the owner or office manager. Nobody else issues keys, and nobody gets a key without that approval.
3. Need. Keys are issued according to role, not seniority or convenience. A staff member who never opens up does not need a front door key. A new manager may need the office but not the cash room.
4. Record. Every issue is logged with the key number, the holder, the date and a signature. Every return is logged the same way.
5. Duplication. Keys may not be copied by anyone except through the business. Where restricted keys are used, the policy says so and explains why.
6. Loss. A lost or stolen key must be reported immediately, not at the end of the week. The policy explains what happens next, which is usually a rekey of the affected locks.
7. Return. Keys are returned on the last day of employment or contract, as part of the exit process, before final paperwork is completed.
That is the whole policy. It fits on a page. What makes it work is that someone actually follows it, which is why the record and the exit step matter so much.
The key register
What to record, and how.
| Field | Example | Why |
|---|---|---|
| Key number | A unique number stamped on each key | Lets you tell identical looking keys apart and trace each one. |
| Which locks it opens | Front, rear, office | So a lost key tells you exactly what needs rekeying. |
| Holder | Name and role | Accountability, and a way to confirm roles still match access. |
| Date issued and signature | Signed acknowledgment of the policy | Shows the holder knew the rules. |
| Date returned | Checked by the approver | Closes the loop at exit. |
| Notes | Reported lost, replaced, locks rekeyed | History you will need later. |
A spreadsheet is enough
You do not need special software. A spreadsheet or a bound logbook kept in a locked drawer works fine for most small businesses. What matters is that there is one register, one person responsible for it, and a habit of updating it at the moment a key changes hands.
Store the register securely. It is effectively a map of who can open what.
Stopping copies
Restricted keys and why they matter.
A policy that forbids copying is only as strong as the key itself. A standard key can be copied at almost any hardware counter in minutes, and stamping it with a warning does not stop anyone who wants a copy. If your policy depends on nobody duplicating keys, the key needs to be one that cannot be duplicated casually.
A restricted keyway system uses key blanks that are not sold to the public. Blanks are controlled by the manufacturer and supplied only to authorized dealers, and copies are cut only when an authorized person at the business requests them, often with a signature or identification card on file. The result is that the only keys in existence are the ones the business ordered.
There are levels of restriction. Some systems protect the keyway by design and by distribution agreements. Others add patented features that make unauthorized blanks harder to produce. The right level depends on what you are protecting. A small office may need only the basic level. A pharmacy, a firearms business, a clinic with controlled substances or a business storing client records may want a higher level.
Restricted keys cost more to set up and to copy, and that is part of the point. They work best together with a key register, since the manufacturer's records and yours can be checked against each other. The restricted keyway systems page explains the options in more detail.
Planning access
Levels of access, not one key for everyone.
The easiest way to reduce the damage from any one lost key is to make sure no key opens more than it needs to. A master key system lets you design this. Each door has its own key. Groups of doors share a submaster that certain roles hold. The owner holds a grand master that opens everything.
A simple example for a shop: sales staff hold a key that opens the front door and the break room. The stock manager holds a key that opens those plus the stock room and delivery door. The owner holds a master for everything, including the office and cash room. When a sales associate leaves without returning a key, you rekey the front door and break room. The stock room, office and cash room are untouched.
Master systems need careful planning. Poorly designed systems can create unintended keys that open more than they should, and adding to a badly planned system later is harder than starting right. If you are fitting new hardware or moving into a new space, that is the time to plan it. See our master key systems page for how we approach the design.
Electronic access control is the next step for some businesses. Cards or fobs can be disabled the moment someone leaves, and the system records every entry. It suits businesses with frequent staff changes or a need for audit trails. Many small businesses combine access control on the main entrance with keyed locks on interior doors. The access control page covers the options.
Common holders
Who usually has keys, and how to handle each.
| Holder | Recommended approach |
|---|---|
| Owner and senior managers | Master or submaster keys, logged like everyone else. Losses here are the most expensive, so treat them with the most care. |
| Opening and closing staff | Entrance keys only. Review when shifts change and people stop opening. |
| General staff | Often no exterior key at all. If they need one, limit it to what the role requires. |
| Cleaning company | A specific key or code logged to the company, with a named contact responsible. Review when the contract changes or cleaning staff turn over. |
| Alarm, IT and maintenance contractors | Temporary keys signed out and returned the same day where possible. Avoid giving permanent keys to contractors. |
| Landlord or property manager | Agree in writing which doors they can access and how. Many leases address this. |
| Emergency access | Some businesses keep a key in a lockbox for fire service access. Follow the guidance of your local fire authority. |
When someone leaves
The exit step that closes the loop.
The most common failure in business key control is not at issue but at exit. An employee gives notice, the last week is busy, and nobody remembers to ask for the key. Or the key is handed to a colleague who puts it in a drawer, and nobody updates the record.
- Put keys on the exit checklist. Next to equipment return, final pay and account shutdowns. Make it a line someone signs off.
- Check the key number against the register. Collect the specific key that was issued, not just a key that looks similar.
- Disable codes and cards on the same day. Alarm codes, keypad codes and access cards should end with the last shift.
- Decide on unreturned keys immediately. If a key does not come back, rekey the affected doors. Do not wait to see whether it turns up.
- Treat difficult departures more strictly. If someone leaves on bad terms, consider rekeying even if the key was returned, since copies may exist on a standard keyway.
- Update the register. The record is only useful if the return is logged.
The when to rekey a business guide covers the decision in more detail, including the situations where a rekey is the only sensible response.
Audits: the part everyone skips
Once a year, or whenever you have reason to be concerned, walk the register. For each key on record, confirm that the holder still works for you, still needs that level of access, and can actually produce the key. You will usually find at least one surprise: a key recorded against someone who left, a contractor key never returned, a spare that nobody can locate.
An audit is also a chance to look at the locks. Doors propped open with a wedge because the closer is slow. A rear door that has been left unlocked because the key sticks. A cash room lock that has not been rekeyed since the business opened. These are practical problems that undo the best policy.
Keep the audit simple. Print the register, go through it with each key holder, and mark each line confirmed, missing or no longer needed. Collect keys that are no longer needed. Rekey for missing ones. Update the register. Many businesses in Wilmington and around Christiana find that an audit done once reveals how much the informal approach was costing them.
If you are just starting, the audit is where to begin. Count the keys you know about, identify the locks they open, and decide whether the current state is acceptable. If it is not, a rekey gives you a clean starting point, and the policy keeps it clean. The commercial rekey page covers how we handle rekeys across multiple doors with minimal disruption to your hours.
Introducing the policy to your staff
A new policy lands badly if it arrives as a surprise demand to hand in keys. It lands well when it is explained as what it is: a way to protect the business and everyone who works there. Before you roll it out, decide what the current state is. Collect the keys you can, list the ones you cannot account for, and decide whether you will rekey to start clean. Then introduce the policy at a staff meeting or in a short note, explaining the reasons in plain terms.
Ask every current key holder to sign the register for the key they hold, with its number. If keys are not numbered, this is a good moment to have them numbered, or to rekey and issue new numbered keys at the same time. Staff who genuinely need a key keep one. Staff who have been holding a key out of habit or convenience return it, and nobody should read that as a judgment on them.
Make the policy part of onboarding. New staff should see it on their first day, sign for any key they receive, and understand that the key comes back on their last day. Building it into the routine means it no longer depends on anyone remembering.
Finally, make reporting a lost key easy and blame-free. A staff member who is afraid of consequences will delay reporting a lost key, hoping it turns up. Every day of delay is a day the business is exposed. It is much better to thank someone for reporting promptly and deal with the rekey than to discover a loss weeks later.
Delaware businesses
What we see in local premises.
Downtown Wilmington offices and older commercial buildings often have a building entrance controlled by the landlord and individual suites controlled by tenants. Businesses here need to be clear about which keys the landlord holds and whether their own locks are on a building master system.
Retail along the main corridors in Newark, Bear and Christiana tends to have high staff turnover, and the rear delivery door is frequently the weakest point. Restricted keys and a strict opening and closing roster help a great deal.
Clinics, dental offices and professional practices around Dover and Middletown hold records and sometimes medications. Interior doors to those rooms deserve their own keys and a smaller list of holders.
Warehouses and light industrial units near New Castle and Smyrna often have many exterior doors, roll-up doors and gates, and a mix of staff, drivers and contractors. Access control on the main entry and a well designed master system on the rest works well.
Related
Tools that support the policy.
Most requestedRestricted Keyways
Keys that cannot be copied without your authorization.
PlanningMaster Key Systems
Access by role, so one lost key does not open everything.
ResetCommercial Rekey
A clean start when the register cannot be trusted.
ElectronicAccess Control
Cards and fobs you can disable the moment someone leaves.
UpgradeHigh Security Locks
For cash rooms, records and controlled stock.
All business workCommercial Locksmith
Everything we do for businesses in both counties.
Where we do this
Business key systems across both counties.
Questions
About business key control.
Does a small business really need a written key policy?
Yes, even a very small one. It does not need to be long. One page covering who approves keys, how they are logged, and what happens at loss and exit prevents most of the problems that lead to expensive rekeys and uncomfortable questions later.
Does stamping keys with a warning stop copies?
Not reliably. Many places will copy a stamped key anyway. If preventing copies matters, use a restricted keyway, where the blanks are not sold to the public and copies are only cut on your authorization.
What should I do if an employee does not return a key?
Rekey the locks that key opens, promptly. Waiting to see if it turns up leaves the business exposed. With a master key system, only the affected doors need changing, which keeps the cost down.
How often should we audit keys?
At least once a year, and any time you have a concern such as missing stock, a difficult departure or a lost key ring. The audit is simple: confirm each recorded key is still held by the right person and still needed.
Is access control better than keys?
For main entrances with many users or frequent staff changes, often yes, because a card can be disabled immediately and entries are logged. Many small businesses use access control on the front door and keyed locks on interior doors. It depends on your size, budget and needs.
Should the cleaning company have a key?
If they clean after hours, they usually need access. Log the key or code to the company with a named contact, limit it to the doors they need, and review it when the contract or cleaning staff change.
Can you set up a master key system in an existing building?
Usually, yes. Existing cylinders can often be rekeyed into a planned system, sometimes with a few replacements where hardware is incompatible. We will survey the doors and plan the system before any work starts.
Where should spare keys be kept?
In a locked key cabinet or safe, with one person responsible for it and every removal logged. Spare keys in an unlocked desk drawer undo the rest of the policy.