Cylinders, Custody and the Missing Link: Auditing Master-Key Control Without the Week of Digging

A single lost key is rarely the incident. The incident is the twenty minutes afterwards, when a duty manager asks who held it, when it was last signed back, and whether the door it opens shares a cylinder with the plant room, the comms cupboard and the roof access.

Most UK sites can answer none of those questions from memory, and rather too many cannot answer them from the file either. The register exists. The chain of custody does not.

What the register actually proves

Open the typical key register and you will find columns: key number, holder, department, date issued. Occasionally a signature. It is a list of people who were given something, not a record of what happened to it afterwards.

An auditor, an insurer or a tenant's solicitor will not ask whether you have a register. They will ask whether the register reconciles — to the doors, to the leavers, to the cylinders. Those are three different questions, and the spreadsheet usually answers only the first.

Start with the hierarchy, not the list

Master-key systems are sold as engineering and administered as stationery. Ask for the hierarchy drawing before you ask for the register. A properly documented system shows the grand master, the masters, the sub-masters and the individual door keys, with each level accounted for and each keyway identified by profile and patent protection.

Where cylinders are graded under BS EN 1303, or supplied with a restricted profile that cannot be copied without the owner's authorisation, that detail belongs in the file. It is the difference between a lost key that can be neutralised by refusing a duplicate, and a lost key that anybody can clone at a high-street cutter for a tenner.

The practical test is simple: pick any door in the building and ask which keys open it, and who currently holds each of those keys. If the answer takes an afternoon, the hierarchy is not documented — it is remembered.

Contractors, cleaners and the awkward middle ground

This is where custody usually breaks down. A contractor signs in at reception, but the key goes out with a supervisor who was not on site. A cleaning key sits on a fob passed between shifts. A key safe on the wall holds the answer to everything, and its combination has not changed since commissioning day.

Mechanical key safes have their place, but they produce no audit trail. If a safe is used, the file should show a combination-change record with dates and the name of the person who authorised each change. Electronic cabinets are more defensible because they log per-user access, but only if somebody exports the log. An unexported log is a database nobody reads.

For contractor keys, look for four elements on each line: name, employing company, date and time out, date and time back. Anything less is a courtesy, not a control. Where keys are issued outside office hours, the escalation route matters as much as the signature.

Lost keys: the decision trail is the evidence

Not every lost key requires a cylinder change. Every lost key requires a recorded decision.

The file should show what was lost, which doors it opened, what sat behind them, whether the profile was restricted, and what was decided — rekey, change cylinder, accept the residual risk, or some combination. It should name who took that decision and when. In multi-occupied buildings, the other tenants' insurers may have a view, and that correspondence is worth keeping.

Where a cylinder was changed, the record should tie the new cylinder to the door and to the key numbers now in circulation, with the old numbers formally retired. A cylinder change that leaves the register untouched has simply moved the problem.

The five-minute test

Set a stopwatch and ask the facilities team for the following. If it takes a week, the control is theoretical.

• The current hierarchy drawing, dated and signed off.
• The live register, reconciled against actual holders.
• Issue and return logs covering the past twelve months.
• Key safe combination-change records, or electronic cabinet logs.
• Every lost-key incident with its decision and outcome.
• Cylinder change records linked to the doors concerned.
• Evidence that keys are recovered before a leaver's final pay.

That last item is unglamorous and disproportionately revealing. In most organisations, the leaver process is run by HR, the key register by facilities, and the two have never met.

Making it routine rather than a project

A quarterly reconciliation of forty minutes does more for key control than an annual deep clean. Walk the register against the holders, retire the numbers that no longer exist, confirm the safes are still being logged and check whether any cylinders have been changed without the paperwork following.

Key control is not a document. It is a chain, and every link is somebody's signature and a date. Where the chain is intact, the audit is a formality. Where it is not, the register becomes the first thing an investigator asks for and the last thing it should have been.