The office manager left in March. In June, a client's security questionnaire asked one line: who has keys to the room where customer data is stored? The honest answer was "we think four people, maybe five." Nobody knew. The keys came with the lease, they live in drawers and on lanyards, and the only time anyone counts them is the day one goes missing.
That day is exactly the wrong day to start a list. Here is the register we use instead — fifteen minutes to set up, fifteen minutes a quarter to keep honest.
One row per physical key, not per door. A numbered ID stamped on the key (K-014, not "front door"), what it opens and what sits behind it ("cabinet 3, server room — check stock"), the holder's name and role, date issued, date returned, signature on both ends. The value note matters twice: it turns "Sam lost his keys" into "Sam lost the front door, the supply closet, and cabinet 3 — and cabinet 3 holds check stock," and it becomes the exact work order if a rekey is needed.
Numbered copies, assigned forever. "We cut four copies" is a guess; "K-014 copies 1–4: Sam, Dana, front-desk lockbox, manager safe" is an inventory. Un-numbered keys are the ones that end up in a bowl and are never traced again.
Masters get their own religion: two copies, one custodian, one lockbox. A master key in an unlocked desk drawer is every door in the building on one unlogged ring. Lose a master, and the register tells you instantly that the exposure is every door — which is what settles the rekey bill without a debate.
Keys come back in the same pass as the laptop and the badge. Offboarding that collects the laptop and forgets the keys builds the exact gap the register exists to close. Contractors get keys like employees — with an end date on the row — and cleaning crews either get a door code or a logged, time-boxed copy. End of contract means end of access, the same reflex as vendor offboarding.
When a key doesn't come back, run the exposure test before spending money. The register converts a panic purchase into a scoped decision: rekey exactly the locks the lost ring opened. Most commercial hardware takes a replaceable cylinder — a ten-minute swap, not new locks. Three triggers skip the judgment call: a lost master, keys lost with identifying information attached, or a termination where keys were never collected.
Door codes are keys without metal. They belong in the register too, and they rotate on the same triggers — staff change, contractor exit, "we told too many people." If the lock supports per-person codes, that upgrade makes the whole problem trivial: disable one code instead of rekeying a cylinder.
Fifteen minutes a quarter, next to the badge log. Count metal against rows, both directions. Every orphan gets an outcome at the count — re-issued, returned to the lockbox, or the lock rekeyed and the row closed. After a break-in, the register is the fact witness: which locks were compromised, what was behind them, what changed the same day. That sentence is what the police report, the insurer, and your incident plan all need — and it is only writable from a list that was true before the night in question.
The full template — the register sheet, the master-key rules, the rekey decision tree, and the quarterly count — is free on our ops-notes site:
Key Inventory Register Template for Small Offices →
It pairs with two neighbors: the visitor log template (the paper twin for the people badges don't cover) and the badge & door access checklist. If you want the fill-in-the-blank versions with the quarterly count half-page, the Ops Starter Kit is $14, and the free one-page First 30 Minutes incident checklist is the place to start.
Top comments (0)