How to audit physical keys

A key audit reconciles three things: the physical key sets, the people recorded as holding them, and the register. It covers:

• sets that should be in storage;
• sets recorded as checked out;
• missing or unexplained sets;
• unregistered sets, or tags carrying a duplicate ID;
• retired sets that are still physically present.

The worksheet documents your reconciliation. It doesn't certify compliance or independently verify who has a key.

The CSV has all 18 columns. The printed version splits them over two landscape sheets: a check sheet and a follow-up sheet.

Before you start

• Define the locations and key sets in scope, such as one office's cabinets.
• Record the audit date and time, the auditor, and the time of the register snapshot you're checking against.
• Prepare a current register export and a list of storage locations.
• Agree how checkouts and returns during the audit will be recorded, so a moving set isn't counted twice and a legitimate checkout isn't treated as a missing key.
• Keep the completed worksheet available only to people who need it.

There's no universal audit frequency. It depends on how many keys you hold, how often they move, your organisation's policy, and whether there has been an incident.

1. Reconcile physical sets with the register

Check in both directions: every register entry against the physical set or its recorded holder, and every physical set against the register. For each set, check the key-set ID, storage position and number of keys.

• Wrong hook: record found_elsewhere and where it was found. Correct the position afterwards, not during the count.
• Unidentified, unregistered or duplicate-labelled set: assign a unique temporary audit reference, such as UNREG-01 or DUP-01. Record any existing markings and where the set was found, and carry that reference across the check and follow-up sheets. Record any temporary relocation. Don't relabel permanently until someone authorised has identified the set.
• Fewer keys than expected: record expected and counted in the discrepancy field.

Don't try unidentified keys in doors to work out what they open unless someone authorised has approved it.

2. Confirm recorded holders

For every set recorded as checked out, record one of these outcomes:

• possession_reported — the holder says they have it.
• physically_checked — the auditor has seen the set.
• awaiting_reply — no answer yet. A lack of reply isn't proof that a key is missing.
• passed_onward — the holder says they gave it to someone else. Follow up with that named person.
• cannot_account_for — the holder doesn't know where it is. Treat as a discrepancy.

Record when and how each confirmation was made: in person, phone, message.

3. Handle discrepancies

• Overdue sets: confirm possession, then arrange the return or an authorised extension. Keep the original deadline and overdue history.
• Unexplained movements: find out what happened, then record a correction with the current time and an explanation. Don't erase earlier records or record more certainty than you have.
• Potentially missing keys: escalate promptly to the authorised property or security contact under your organisation's procedure. Decisions such as changing locks belong to them, not the auditor. Don't wait for the audit to finish if the circumstances suggest immediate concern.
• Retired sets still present: check why the set was retired and whether keeping it is authorised. Record the approved storage or disposal action. Moving it to another box doesn't resolve the issue by itself.

4. Close out the audit

Every discrepancy needs an owner, a next action and a follow-up date. The follow-up date is a review deadline, not permission to delay any escalation that's needed now. Mark an item closed only when its outcome and evidence are recorded. Unresolved items stay open and visible on the worksheet until they are.

Finish with a short summary:

• sets reviewed;
• sets reconciled;
• outstanding discrepancies;
• follow-up owners and dates.

In the fictional example above: 4 sets reviewed, 2 reconciled, 2 outstanding (KR-043 with Morgan Lee by 2026-09-26; KR-047 with Nina Brandt by 2026-09-30).

Questions

This process helps you find and fix gaps in your own records. It doesn't certify compliance with any standard, regulation or insurer requirement.