Know which physical key copies exist, who holds each one and which losses still need a security decision. Copy the linked registers below to track custody without treating a replacement as a return.
A key can be replaced while the original is still missing. If the log simply changes the holder or marks the old entry “closed,” the team loses sight of the copy that may still open a door.
This key control log template is for facilities and operations coordinators managing ordinary physical business keys. It includes a copy register, an issue-and-return record, a discrepancy case and a reconciliation check. Everything is available inline: copy the headers into a restricted spreadsheet or reproduce the fields in your existing record system. No download is required.
The design does not replace your site’s access policy or specialist security assessment. Keep electronic credentials, emergency access and safety interlock keys under their dedicated procedures.
Set the ownership rules before issuing keys
Name a key coordinator, a backup, an access approver and a security decision owner. One person may hold several roles in a small site, but record which responsibility they are performing. Only the coordinator or backup changes the authoritative custody record; the holder acknowledges receipt.
Real institutional policies distinguish authorization from custody. SIUE’s Key and Lock Policy identifies approving authorities, recipient responsibilities, loss reporting and return duties. Those are SIUE’s rules, not universal requirements for every business. The operating rules below are recommendations to adapt with your site owner.
- Assign a unique ID to each physical copy, not just each door or key type. Two copies opening the same lock must have different copy IDs.
- Use a separate, restricted access-group reference to describe what a key opens. Do not place door addresses, alarm codes, key-cut details or the full access map in a widely shared log.
- Require approved access before issue. If authorization is unclear, use an access request record first; a signature for a key is not access approval.
- Choose a due date-time for temporary issue and a review date for continuing custody. Define the site time zone and who reviews overdue items.
- Route transfers and authorized additional copies through the coordinator. Do not silently change the holder name or reuse an old copy ID.
Template 1: the physical-copy register
Keep one row per known physical copy, including spares and known missing copies. Start with a controlled count of the cabinet and holder confirmations. Record unknowns as discrepancies rather than guessing who has a key.
Copy ID,Access-group reference,Key class,Site reference,Disposition,Custody,Holder or storage reference,Active transaction ID,Last verified at,Verified by,Evidence reference,Open case ID,Review due| Field | Allowed value or rule |
|---|---|
| Copy ID | Unique permanent code, such as KC-041-B. Never assign the same ID to a replacement. |
| Access-group / site reference | Reference to the restricted map and relevant site. Do not include secrets in this sheet. |
| Key class | Local class, such as ordinary or restricted/master; determines the required approval route. |
| Disposition | Active or Retired. Retired requires documented destruction or another authorized permanent disposition, with evidence. Missing alone is not retirement. |
| Custody | Secured storage, Issued, Quarantined or Missing/unverified. Exactly one value for each Active copy. |
| Holder or storage reference | Named holder when Issued; controlled cabinet location when stored; quarantine reference when isolated; last known holder/location when missing. |
| Active transaction ID | Required when Issued. At most one open issue transaction per copy. A loss case links the previous transaction even after its loss disposition is recorded. |
| Verification and evidence | Date-time, verifier and receipt/count/case reference. A planned return is not verification. |
| Open case / review due | Case reference for every unresolved discrepancy; next review date for continuing custody or unresolved follow-up. |
Quarantined means the copy is physically controlled but must not be issued—for example, it is damaged or was found after a reported loss. Keep its location and release decision visible. A closed security case does not automatically make a copy available.
Template 2: one issue-and-return record per handover cycle
Create a new transaction when a copy leaves controlled storage. Preserve completed transactions rather than overwriting yesterday’s holder. For other borrowed property, use the broader equipment checkout form; this resource adds key-copy and exposure reconciliation.
Transaction ID,Copy ID,Holder,Work contact,Sponsor,Purpose reference,Approval reference,Issued at,Issued by,Receipt acknowledgement,Due back or review at,Actual received at,Received by,Return evidence,Transaction state,Extension or case referenceUse these transaction states: Open, Returned, Lost-referred, Cancelled-before-issue. Never use “Returned” without the actual receipt time, receiving person and verified copy ID. Lost-referred records the custody exception and links a case; it does not mean the missing copy has been recovered.
Copy-ready issue acknowledgement
Transaction: [ID] Physical copy: [ID]
Holder: [name / work contact] Sponsor: [name]
Approved purpose and scope reference: [reference]
Approval: [approver / decision / timestamp / evidence]
Issued: [date-time / zone] by [coordinator]
Return due: [date-time / zone], OR continuing-custody review: [date]
Return point and staffed hours: [details]
Local conditions: [approved use / no unauthorized copying or transfer]
Loss or damage reporting contact: [site contact and urgent route]
Holder acknowledgement: [actor / timestamp / signature or record reference]
Actual receipt: [copy ID checked / time / receiver / evidence]
Next disposition: [storage / quarantine / linked case]Make purpose, approval, identity, issue time and acknowledgement mandatory before handover. Use work contact details sufficient for follow-up; do not collect unnecessary personal identifiers. An extension requires an explicit decision, new due date and retained history of the old deadline. Do not erase an overdue period by backdating the extension.
When key requests arrive without a clear approver, define the intake and decision handoff before adding more rows. Book a Workhint demo to discuss the request-and-approval flow.
Template 3: keep the loss or discrepancy case separate
A missing key is both a custody question and a possible access-exposure question. Finding a replacement addresses neither by itself. SIUE’s lost-key procedure, for example, requires prompt reporting and assigns a review of whether affected locks need recoring. Whether a lock change is appropriate at your site belongs to the authorized security owner, not a spreadsheet formula.
Case ID: [unique reference]
Reported by / at / zone: [values]
Affected copy IDs and access-group references: [values]
Last verified custody / linked transactions: [references]
Issue: [missing / overdue-unconfirmed / unexplained copy / damaged / mismatch]
Immediate notification: [security contact / time / acknowledgement]
Containment decision: [authorized owner / action / deadline / evidence]
Recovery action: [owner / next contact or search step / due time]
Replacement, if approved: [new copy ID / authorization / issue transaction]
Lock or access assessment: [decision / owner / date / evidence / actions]
Outstanding actions: [each action / owner / due / status]
Next review: [date-time / owner]
Case state: [Open / Awaiting action / Verified closed]
Closure: [custody disposition AND exposure disposition / verifier / evidence]Use your urgent site-security route when a key is reported lost or stolen; do not wait for the next scheduled reconciliation. Keep sensitive circumstances and access details in the restricted case, not a shared overdue list.
Close the case only when every affected copy has an explicit custody disposition and the security owner has verified completion of the exposure decision and required actions. A copy may remain Missing/unverified after the security response is complete; preserve that historical fact. Do not change it to Returned or Retired merely to balance the cabinet.
Reconcile copies without hiding missing ones
Choose a documented review cadence with the site owner. A daily review of temporary issues and a periodic full count are practical starting points, not universal compliance intervals. Review also when a holder leaves, changes duties or reports a discrepancy.
- Coordinator: count the controlled cabinet and quarantine locations by copy ID; record evidence and time.
- Coordinator and holders: confirm continuing custody, due dates and approval validity. A nonresponse is not a confirmed return.
- Reviewer: reconcile every Active copy to exactly one custody category and check transactions against the register.
- Security owner: review open cases and overdue action deadlines; decide any required response.
Known Active copies = Secured-storage copies + Issued copies
+ Quarantined copies + Missing/unverified copies
Total known copies = Active copies + Retired copies
Issue permitted only if:
copy is Active AND physically verified in Secured storage
AND no open issue transaction exists AND approval is valid
AND no unresolved case restriction blocks issue.Count rows by unique copy ID and exact category; do not count transactions as physical copies. Retired copies stay in history but outside Active custody totals. Any unexplained physical copy gets a provisional unique ID, Quarantined custody and a case pending identification. Do not assume it is a spare just because it fits a known lock.
The equation detects inconsistent records, not undiscovered copies or unauthorized duplication. A balanced spreadsheet is not proof that every key is controlled. Keep the full register restricted to the coordinator, backup and authorized reviewers; give holders access only to the records they need. Set retention with the site’s records and security owners rather than inventing a universal retention period.
Worked example: a replacement does not clear the loss
Fictional example: Northline Studio has three known copies for restricted access group AG-7: KC-041-A in storage, KC-041-B issued to Alex under transaction T-209, and KC-041-C in storage. At 16:10 America/Chicago on November 18, 2026, Alex reports B missing.
| Event | Record action | What remains unresolved |
|---|---|---|
| Loss reported | Mark B Missing/unverified; T-209 becomes Lost-referred; open case L-12 and record security notification. | Recovery and access exposure for B. |
| Security permits a replacement | Create new copy D with its authorization; issue D under T-210. Preserve B and L-12. | Replacement does not close L-12. |
| B is later found and received | Record recovery receipt against L-12; mark B Quarantined and retain the loss history. | Security checks whether the existing response or release decision must change. |
| Security verifies the case disposition | Close L-12 with custody and exposure evidence. Release B to storage only if explicitly approved; otherwise retain quarantine or document retirement. | Any unfinished action keeps the case open. |
Immediately after D is issued, the register has four Active copies: two stored (A and C), one issued (D), zero quarantined and one missing (B). Thus 4 = 2 + 1 + 0 + 1. After recovery into quarantine, 4 = 2 + 1 + 1 + 0. Neither arithmetic result proves the lock exposure has been resolved.
Test the log before the first live issue
| Scenario | Expected result |
|---|---|
| Two copies open the same door | Different copy IDs; shared access-group reference; separate custody. |
| Second open issue for the same copy | Block issue and investigate; do not overwrite the first holder. |
| Holder says “left it at reception” | Do not mark Returned until the receiving owner verifies receipt and copy ID. |
| Due time passes without return evidence | Flag overdue, contact holder and escalate by site procedure; do not auto-renew. |
| Replacement arrives while original is missing | New copy ID; original remains missing; linked case stays open until verified disposition. |
| Found copy has an unresolved case restriction | Quarantine; no new issue until authorized release. |
| Damaged key is physically returned | Transaction Returned with receipt; copy Quarantined, not available. |
| Unlisted copy appears in the cabinet | Provisional ID, quarantine and discrepancy case; reconcile the increased known-copy total. |
Where Workhint fits in key-request coordination
The static registers work without Workhint. If approvals and follow-up are scattered across messages, the Workhint Workflow Engine describes required request information and approval routing to defined roles. Those capabilities can support who submits the request and who decides whether it may proceed.
The Workhint workflow automation solution describes configurable forms, stages, roles and approvals. That is relevant to administering request and exception handoffs; it is not evidence of a native key cabinet integration, copy-count reconciliation or automatic lock/access revocation. Keep the coordinator-controlled register authoritative until your specific implementation is demonstrated and tested.
Bring one normal key issue and one unresolved-loss case to the workflow review. Book a Workhint demo to map the owners, approval evidence and exception handoffs.
Frequently asked questions
Is a key register the same as a sign-out sheet?
No. The register describes each physical copy and its current disposition. The sign-out record describes a particular issue cycle. Both link by copy ID; a separate case tracks unresolved loss or discrepancies.
Can one row represent a ring of several keys?
List each constituent copy ID and link it to a ring reference. Record the issue against all included copies, then verify every copy on return. An intact ring label alone does not prove its contents are complete.
Should an overdue key be marked lost automatically?
No. Overdue means its return deadline passed. Verify the circumstances and follow the site escalation route. Preserve what is known and unknown instead of inventing a loss or return.
Does replacing the lock allow us to delete a missing-key entry?
Keep the missing-copy history and link the verified security disposition. A lock change may address the assessed exposure, but it does not establish physical recovery. Your security owner decides the response; the log records evidence rather than making that decision.
Start with a controlled count
Give every known copy an identity, establish who can approve and issue it, and test one issue, return and loss scenario with the backup coordinator. The useful outcome is not a tidy total at any cost: it is an honest record of custody, missing copies and the decisions still owed.
Leave a Reply