Keys Out, Keys Back: A Quarterly Reconciliation of Building Access

Most UK workplaces can produce a staff list within minutes. Far fewer can produce a credible list of who physically holds a key to the building. The gap between those two documents is where access risk accumulates — quietly, over years, one unreturned fob at a time. This is not a failing of diligence so much as a failing of ownership: access credentials are issued by people who then move on, and nobody is routinely asked to reconcile what was handed out against who is still entitled to hold it.

The purpose of the exercise below is not to build a security department. It is to establish a repeatable half-hour review that answers a simple question honestly: could we say, today, who can open which door?

Why physical credentials escape review

Digital access controls leave logs. A key does not. A door code written on the back of a supplier's delivery note leaves no trace at all. Because physical access generates no automatic evidence, it tends to be reviewed only after an incident, a complaint or an insurance query — precisely the moments when an unprepared answer is most costly.

There is a commercial dimension as well. Insurers increasingly ask about key control as part of premises risk assessment, and a register that can be produced on request supports the argument that reasonable steps were taken. Where personal data is stored on site — HR files, client records, payroll — access to the rooms containing it is a data protection matter, and the ability to show restricted issue of keys is relevant evidence of appropriate technical and organisational measures.

Step one: gather, do not yet judge

Book thirty minutes and three sources of information: the key cabinet or issue log, the current staff and contractor list, and the alarm or door-code schedule. Lay them side by side. Resist the instinct to correct records during this pass. The first sweep is about producing a single working list of every credential that exists, including the ones nobody remembers issuing.

Expect to find the familiar artefacts: a master key that has been copied, a fob issued to a contractor in a previous financial year, a code shared with a cleaner who has since been replaced, and a spare kept in a drawer "just in case". None of these are unusual. The point of the exercise is to make them visible, not to assign blame.

Step two: classify by holder, not by key

Sort the working list by the person or party holding the credential. For each, record four fields only: holder name, credential type, doors or areas covered, and date issued. A fifth field — expected return date — is optional but valuable for contractors and temporary staff.

This structure forces the useful question. For each holder, ask whether the access still matches the role. A facilities coordinator who moved to a different floor six months ago may still hold a plant room key out of habit. A contractor engaged for a single project may still hold a fob because no one closed the loop at practical completion. The register exposes these mismatches without requiring anyone to remember them.

Step three: hunt the shared credentials

The most common finding in any access review is the shared code or the communal key. These exist for understandable reasons: shift handovers, out-of-hours cleaning, agency cover. They are also the weakest link in the chain, because their use cannot be attributed to an individual and they are rarely changed when someone leaves.

Three practical responses are worth considering:

• Replace shared codes with individually issued codes where the door hardware supports it. Modern digital locks make this inexpensive and it converts an unattributable risk into an attributable one.
• Where sharing is genuinely unavoidable, document the reason, the group of people permitted to use it, and a scheduled rotation date. Rotate at least annually, and immediately on any departure from that group.
• Retire codes entirely from any area holding personal data, cash or controlled stock. If a shared code is the only barrier, the barrier is nominal.

Step four: close the leaver loop

Most access failures happen at the point of departure, not at the point of issue. The return of a key or fob belongs on the same single-sheet offboarding record as the return of a laptop and the closure of an email account. Where it sits in a separate process owned by a different team, it will be missed.

A workable sequence: the line manager confirms the last working day; the facilities or office lead is notified at least five working days in advance; the credential is collected on the final day and the register updated the same day; and any code to which the leaver had access is changed or rotated within the same week. Where a credential is not returned, record that fact and the action taken rather than leaving the field blank. An unreturned fob with a note is an auditable position; an unreturned fob with no note is a gap.

Step five: keep the register to one page

The register works only if it stays short enough to be read in a meeting. Aim for one page per site, or two at most. If the list is longer than that, the issue is usually over-issue rather than over-population — too many people holding too many credentials.

Review the register quarterly, at a fixed point in the calendar so that it does not drift. Fifteen minutes is enough for a routine quarter; the half-hour version is for the first pass or after a significant change in staffing, a move between floors, or a new contractor engagement. Record the review date and the reviewer's name at the foot of the page. That single line is often all an auditor or insurer needs to see.

What good looks like

At the end of a competent review, a manager should be able to state, without checking: how many master keys exist and who holds them, which contractors hold current credentials and when those expire, how many door codes are in circulation and when each was last changed, and what happened to the credentials of the last three leavers. That is a modest standard, and it is achievable in a single half-hour session followed by a short quarterly habit.

The wider benefit is cultural. When access is visibly tracked, teams tend to stop treating keys as personal property and start treating them as organisational assets. The register is not the point. The habit of asking who still holds the keys is.