Short answer: A key audit should reconcile the authorised key sets, the people holding them and the doors or responsibilities that have changed. Finding a labelled bundle in a cabinet does not prove that the register is complete or that the keys still work.
Use an audit when locks change, a contractor’s work ends, a managing agent takes over or responsibilities move between teams. It complements the original handover by checking the arrangement that exists now.
Choose an owner and a controlled record
Identify who can authorise issue, return, testing and replacement. Ask that person to approve the audit scope and the secure place where results are kept. Do not send a detailed key-to-door schedule to everyone involved in the property.
The register should distinguish key-set identifiers, authorised holders, issue and return records, and any unresolved discrepancy. Record enough to manage custody without putting a full address and sensitive access information on a loose tag.
If responsibility is shared between a landlord, tenant and facilities contractor, establish whose keys are being reviewed. Otherwise each party may believe another has accounted for the same set.
Reconcile custody before testing access
Compare the register with the sets held in approved storage and the sets issued to authorised people. Follow up missing returns, temporary loans and unrecorded duplicates. A message saying “probably with maintenance” is an unresolved item, not an audit result.
- Is each recorded set accounted for?
- Does every holder still need that authority?
- Were temporary issues returned and recorded?
- Have lock changes made any sets obsolete?
- Who will decide what to do about discrepancies?
Do not assume a returned contractor bundle is complete. Check it against the agreed issue record. Where records are missing, describe the uncertainty and arrange the responsible manager’s assessment instead of declaring that all keys are secure.
Check changed locks through an authorised test
Arrange any access test with the property manager and relevant occupiers. Define which sets need checking, who may carry out the test and how problems are reported. A failed test may be a wrong label, an obsolete key or a defect needing the lock maintainer; it should not lead to improvised entry.
Keep testing within safe access arrangements. Do not interfere with emergency exits or assume that a person conducting a security check is competent to alter door hardware. Government workplace fire-safety guidance includes clear escape routes and emergency doors that open easily.
Treat an unaccounted-for key as a decision
Record what is known about a missing set and escalate to the person responsible for the premises. The need to replace a lock or take another measure depends on the circumstances and the access involved. Neither “change every lock” nor “wait until it turns up” is a universal answer.
Do not include the key’s detailed permissions or the building’s vulnerabilities in an open email chain. Keep the assessment, any approved action and completion evidence in the controlled record.
Update the keyholding arrangement
When a keyholding supplier is involved, confirm that the approved current set has been transferred, old sets have been returned or dealt with as instructed, and contact responsibilities remain correct. Update restricted instructions through the established channel.
Our keyholding handover checklist covers the initial setup. An audit asks whether that setup still matches the premises after change.
Close the audit with evidence
List resolved items, outstanding actions, their owners and a review point. A signature should confirm the work actually performed, not promise that no unknown duplicate exists. Keep the process proportionate to the property and access involved.
For a keyholding enquiry, see ZimCos Security’s services or send the location and scope. Do not send key codes or access instructions in the first message. This is a general management checklist, not a lock specification or security guarantee.
Featured image: an illustrative collection of tagged keys, not a client key set or recommended storage arrangement.