How to Control Office Keys: A Practical Guide
Keys and access cards are the physical layer of your office security, and they’re the layer most offices manage worst. Spare keys in desk drawers, cards never deactivated when people leave, nobody sure who has the store room key, it drifts until the day you need to know and can’t. A key handling SOP gives you one register, one issue process, one return process, and a plan for the day a key goes missing. It’s unglamorous, and it’s one of the most important documents an office can have.
When to Use This
Use this SOP in any office with physical keys or access cards, which is nearly every office. It’s urgent if keys have ever been issued informally (“just take the spare”), if leavers’ keys aren’t reliably collected, or if nobody could produce a complete list of key holders today. The test is simple: can you name every person holding a key to your main entrance right now? If not, start with the register and work backwards.
The SOP covers both traditional keys and electronic access cards. Cards feel more secure, but a card that’s never deactivated is just a key you can’t see, the return and audit discipline applies equally.
How to Fill It Out
The header box. Who prepared it, who owns it, the version, the date issued, and the review date. The owner is usually the facilities manager or office manager, someone with the authority to approve issues and order re-keying.
Fields to complete before use. Replace every bracketed field: the facilities manager’s name and the key cabinet location. Then delete the example rows. The key cabinet itself should be locked, with access limited to the facilities manager and one backup, write down who those two people are.
Key register. One row per key or access card: key number, door or area it opens, holder’s name, date issued, date returned. The key number is the identifier, never record a key by description alone, because “the small silver one” is not an identifier. Start by registering every key you can find, including the ones in the cabinet: an honest register that shows gaps is more useful than a tidy one that pretends there are none. Mark unaccounted keys clearly and investigate them as losses until proven otherwise.
Issuing keys and cards. Four rules: issue only with the facilities manager’s written approval, naming the holder and the doors required; the holder signs the register on receipt; tell the holder explicitly that keys must not be copied or lent to anyone else; program access cards for the holder’s areas only, and deactivate them the day the holder leaves the role. Written approval sounds bureaucratic for a key, but it’s what stops the casual “can I get a key for the store room” that bypasses every control.
Return procedure. Collect keys and cards on the holder’s last day in the role, or the day access is no longer needed, whichever is earlier. Check the key number against the register, sign the return, and store the key in the key cabinet. Chase unreturned keys within two working days and report them to the facilities manager. Tie collection into your leaver process: the exit checklist should include key return as a signed step, because “I’ll bring it back next week” is how keys disappear permanently.
Lost key procedure. Three steps, in order: report the loss to the facilities manager immediately, stating the key number and the doors it opens; re-key external doors and server rooms always, the facilities manager assesses other locks the same day; record the loss, the decision, and the cost in an incident note attached to the register. The always-re-key rule for external doors is the non-negotiable core of this SOP: a lost key to the main entrance is a compromised building until the lock changes. People resist re-keying because of the cost; the SOP should state the rule before the incident, when the cost is theoretical, rather than during it.
Periodic audits. Once a quarter, count every key in the cabinet against the register and confirm each issued key with its holder. Chase holders who can’t produce their key within five working days and treat unaccounted keys as lost. File the signed audit sheet with the register and report the result to the office manager. The audit is what keeps the register honest, without it, the register slowly diverges from reality and becomes fiction.
Completion checklist. The routine confirmation: register up to date, issues approved and signed, returns collected and checked, losses handled per procedure, quarterly audit done and filed.
Common Mistakes
1. No register, or a register nobody maintains. A key log updated “when someone remembers” is not a control. The register is the foundation, every other rule in the SOP depends on knowing who has what.
2. Leavers keeping keys. The most common key security failure in small offices. Tie key return to the exit process with a signed step, chase within two working days, and deactivate cards the same day, not “when IT gets around to it.”
3. Treating lost keys as a minor embarrassment. People delay reporting a lost key because it feels careless. The SOP should make immediate reporting the expected behaviour and re-keying the automatic response for external doors, no blame, no discretion, just the procedure.
4. Skipping the quarterly audit. The audit is the only thing that catches the slow drift: the key lent to a contractor and never returned, the card issued for a project that ended months ago. It’s dull work, and it’s the whole point.
Who Needs to Sign Off
The facilities manager or office manager prepares and owns this SOP; a senior manager approves it, since it governs building security and authorises re-keying expenditure. Everyone issued a key or card reads the issue and return rules and signs the register, the signature is their acknowledgment of the no-copying, no-lending rule. If your building is managed externally or your insurer has key-control requirements, check the SOP against them.
How Often to Review and Update
Review every six months, and run the quarterly audit on schedule, the audit is the review mechanism for the register itself. Update the SOP immediately when locks change, when the key cabinet moves, when the facilities manager changes, or when you switch key or card systems. After any lost-key incident, review the procedure as part of the debrief: was the loss reported promptly, was re-keying done, did the register have the right information? Fix whatever slowed the response.
Download the free Office Key Handling SOP template.