Business key control is not just about knowing where the spare keys are. It is the process of deciding who should have access, recording which keys have been issued, limiting unnecessary duplication and responding properly when staff, contractors or tenants change.
A clear system reduces confusion, helps protect higher-risk areas and makes lost-key incidents easier to assess. It can be simple enough for a small office or structured enough for a multi-site organisation.
What is business key control?
Business key control is the administration of physical keys and the access they provide. It covers which doors each key opens, who is authorised to hold it, how keys are issued and returned, who may approve copies and what happens when access changes.
Why informal key management causes problems
Many businesses begin with a handful of keys and no formal process. Over time, copies are handed to staff, cleaners, contractors and managers. Eventually, nobody knows exactly how many keys exist or which doors they open.
- No record of who holds each key
- Former staff not returning keys
- Managers carrying large, confusing key rings
- Uncontrolled key copying
- Locks added without updating the access plan
What is a key register?
A key register is a record of issued keys and their access. It may be a spreadsheet, secure database or managed paper form, depending on the size and risk profile of the business.
- Key number or identifier
- Doors or areas the key opens
- Name and role of the holder
- Date issued and returned
- Authorising manager
- Status such as active, returned, lost or cancelled
Keyed alike, master keyed or restricted?
| Arrangement | Best suited to |
|---|---|
| Keyed alike | Several locks where every authorised user needs the same access |
| Master keyed | Sites where different users require different access levels |
| Restricted | Businesses that need controlled duplication and formal authorisation |
These arrangements can be combined. A restricted master key system provides both access hierarchy and controlled duplication. Read our guides to how master key systems work and how restricted keys control duplication, then review the corresponding master key service and restricted key service.
How to issue a business key properly
- Confirm the person’s role and required access.
- Select the least-privileged key that meets that need.
- Record the key identifier and access in the register.
- Record the issue date and authorising person.
- Have the holder acknowledge the return and reporting requirements.
- Review the key when the role changes.
What should happen when an employee leaves?
Key return should be part of the offboarding checklist. Confirm which keys were issued, collect them where possible and update the register immediately. A returned ordinary key does not prove that no duplicate exists. For a detailed risk assessment, see When Should a Business Rekey Its Locks?
What should happen when a business key is lost?
Assess which doors the key opens, whether it is a change key or master-level key, whether it can be linked to the property, whether it was lost or stolen and whether affected cylinders should be rekeyed.
How often should the key register be reviewed?
Review it whenever staff change, contractors finish, premises are altered or keys are reported missing. A scheduled review every six or twelve months can also expose old records, missing returns and unnecessary master-level access.
When digital locks may help
Digital locks can make it easier to add or remove codes, cards or credentials without rekeying a mechanical cylinder. They do not remove the need for administration. See our digital and smart lock guidance.
Commercial door hardware matters too
Key control only works when the doors themselves are reliable. Worn locks, poor alignment, failing closers or unsuitable hardware can undermine an otherwise well-planned system. See commercial door hardware services and our door hardware guide.
A practical business key-control checklist
- List every door, lock and access point.
- Assign each key a unique identifier.
- Record which doors each key opens.
- Document every issued key and holder.
- Limit master-level access.
- Nominate who may authorise new keys.
- Secure spare and unissued keys.
- Include key return in staff and contractor offboarding.
- Review the register regularly.
- Rekey when lost or unreturned keys create unacceptable risk.
Frequently asked questions
Should every manager have a master key?
No. Master-level access should be limited to roles that genuinely require it.
Is a spreadsheet enough for a key register?
It can be for a small business, provided it is accurate, secure and consistently maintained.
Does a restricted key system replace a key register?
No. Restricted duplication and good administration work together.
Should locks be changed when an employee leaves?
Not automatically. Consider the key’s access, whether it was returned, whether copies may exist and the sensitivity of the areas involved.
Need help reviewing business access?
Abetta can inspect existing locks, map access levels and recommend a practical keyed-alike, master-keyed or restricted system for Sunshine Coast businesses and managed properties.
Start with our commercial locksmith service, check where we work, or verify Abetta’s credentials.