Key Control Policy: What to Include + Free Template

A key control policy sets out who can authorize, issue, hold, transfer and receive physical keys, and what happens when a key cannot be accounted for. For a property team, the useful test is simple: can a colleague follow the policy when the usual person is away?

A document that says “keep keys secure” leaves too much unanswered. Your team needs to know whether a contractor may collect a set, whether an agent can pass it to a colleague, who can extend a deadline, and whom to contact if a returned ring has a key missing.

This guide explains those decisions and includes an original policy template for property management, real estate, maintenance and cleaning teams. The procedures below are recommendations to adapt to your operation, not a claim that every organization must follow the same rules.

Download the free key control policy template

Download the editable Word policy template or the PDF reference copy. Both are free, with no signup required.

The template includes approval roles, issue and return procedures, two alternative handover rules, incident reporting, audits and recordkeeping. Replace every customization field, select one handover rule, and have the responsible manager approve it before use. The PDF shows the same draft wording; edit the Word version to create your own policy.

This is an operational starting point, not a legal agreement or certification. Check the finished policy against your client instructions, contracts and applicable requirements.

Policy and procedure are different from a key log

Your policy establishes the rules: who may authorize access, whether transfers are allowed and who decides what to do about missing keys. A procedure explains how someone follows a rule at the desk or in the field. A log records the particular event.

For example, the policy might require an approved recipient and a return deadline. The procedure tells the issuer to check the approval and count the keys. The log records which set went to whom, when it left and when it is due back.

Keep those documents connected. Use a key sign-out sheet for movements, and a key register for the inventory. Neither replaces the decision about who is allowed to receive a key.

What to include in a key control policy

1 Define the scope and the people responsible

State which sites, key sets and people the policy covers. Include temporary workers and contractors where relevant. If cards, lockbox codes or electronic credentials have separate procedures, identify those procedures instead of assuming a physical-key policy covers them.

Assign the work to named roles: a policy owner, someone authorized to approve issue, a custodian who maintains records, and a contact for incidents. One person may perform several roles in a small team, but provide a deputy and an out-of-hours route so decisions do not depend on one person answering their phone.

Distinguish custody from access permission. Being named in the register, having a software account or physically holding a key should not be treated as permission to enter any property at any time. The issuer still needs to check the relevant authorization and any site restrictions.

2 Set a clear authorization rule

Define what an issuer must check before releasing a set: the recipient’s identity, the approved task or access purpose, the relevant property authority and any time limits. Record where the approval can be found. For contractors, name the individual collecting the keys rather than recording only the company.

A published example illustrates how explicit this can be. CUNY Graduate Center assigns key control responsibilities to its Office of Security and Public Safety and prohibits people from authorizing their own key issuance. That is CUNY’s rule, not a universal requirement for other businesses. [1]

For your own team, decide who approves routine requests and who handles exceptions. Avoid a policy that says “manager approval” without identifying the manager or their deputy.

3 Define the inventory and storage rules

Give each tracked set a unique reference and record its expected contents and storage position. If several copies open the same door, make the copies or sets distinguishable in the records; otherwise “the front-door key is back” can leave another copy unaccounted for.

We recommend using an opaque reference on the tag, with the property mapping held in an access-controlled register. Avoid putting the address and access instructions on the physical tag. Set out who may access the storage area and where keys must go when not in use.

Include what to do with unknown or duplicate-labeled sets. Assign a temporary reference, record where they were found, and obtain authorized identification before permanently changing labels or combining records.

4 Specify what happens at checkout

The issuer and recipient should check the set’s reference and contents before it leaves. Record the named borrower, issuer, purpose, checkout time and return deadline. Use one agreed timezone and a consistent date format so deadlines are unambiguous.

Decide how receipt is acknowledged and what the team does if its normal system is unavailable. A fallback paper entry can preserve the event for later entry into the main record. When it is entered later, keep the actual movement time separate from the time someone updated the system.

For longer assignments, define a review date and recall process rather than leaving keys assigned indefinitely without review.

5 Choose whether direct handovers are allowed

Do not leave this decision to the person holding the keys. Choose a return-to-storage rule, or permit direct transfers only under defined conditions. McNeese State University, for example, prohibits key loans and transfers in its published policy. A business using a different rule needs to document that choice. [2]

If you allow direct handovers, require authorization for the recipient, identification and counting of the set, a handover record, and acknowledgement of receipt. State whether the original return deadline remains in force and who may approve a change.

A request is not a completed transfer. If a recipient declines or does not respond, the sender should retain the set and contact the designated coordinator. If the keys have already physically changed hands, record that discrepancy promptly and establish the actual situation; do not let an unchanged software status conceal an unrecorded movement.

Use a key handover record for the details. Never enter a return to storage just to close the sender’s checkout when no return occurred.

6 Control copying and higher-access keys

Say who can authorize a duplicate, who may produce it and how the new copy enters the register. Also identify who may authorize lock changes. A replacement request should not bypass the incident procedure for the key it replaces.

For master keys or other sets with wider access, choose stricter approval, storage and review arrangements appropriate to your sites. Write down which sets receive that treatment. Avoid using “master key” as an unexplained label when staff need to know which approval applies.

7 Define a confirmed return

A message saying “I dropped them off” is a reported return. Your procedure should identify who checks the reference and contents, records receipt and confirms the storage position. If you use an approved collection point, distinguish the deposit report from the later check into storage.

When part of a set is missing, record what was received and what remains unexplained. Do not close the event as a complete return. Give the discrepancy an owner and use the incident route where the circumstances require it.

Include returns when a job finishes, a role changes or someone leaves. Removing software access and recovering physical keys are separate tasks; make both visible in the departure process.

8 Separate overdue keys from missing keys

An overdue set has passed its agreed return deadline without a recorded return. A missing set cannot currently be accounted for. The response should reflect the facts and the access at risk, rather than treating every late return as identical.

Assign someone to follow up overdue records. Preserve the original deadline when an extension is authorized, recording the new deadline, approver and approval time. Repeatedly moving dates without explanation hides the original problem.

For suspected loss, theft or unauthorized use, provide an immediate reporting route and a fallback contact. The designated decision-maker should assess protective action, including whether authorized lock changes are needed. A worksheet follow-up date must not become permission to delay urgent escalation.

9 Cover checks and recordkeeping

Specify who reconciles the register with storage and recorded holders, and how often. Choose the frequency for your circumstances and any applicable obligations. Include triggers such as an incident, office move or change of custodian, rather than relying solely on a calendar reminder.

Check in both directions: can you account for every registered set, and is every set found in storage registered? Distinguish a holder reporting possession from someone physically checking the set. The physical key audit guide includes a worksheet for recording discrepancies and follow-up.

Set access permissions for the records and decide how corrections, retention and secure disposal work. Preserve the original entry when correcting an event, with a dated explanation. Do not add a universal retention period to a template without deciding what your business actually needs and must retain.

A key control policy example in practice

This fictional example shows how a policy translates into a routine task. It is not a KeyDocket customer case study.

An agent needs set KD-201 for an approved inspection. The issuer checks the job authorization and the set’s three recorded keys. Both people check the ring, and the issuer records collection at 10:00 with a 17:00 return deadline.

At 14:00, a contractor asks the agent for the set. Under this office’s return-to-storage rule, the agent cannot simply hand it over. The coordinator checks the contractor’s authorization and arranges a return and fresh issue if the work is approved.

The agent returns all three keys at 16:25. The receiver checks the set, records receipt and places it in the recorded position. If only two keys had arrived, the receiver would record the partial return and escalate the discrepancy rather than mark the whole set available.

The important work happened before the log was completed: the team had already decided who could authorize issue, whether transfers were allowed and what counted as a return.

How to introduce the policy to your team

Start by filling in the template’s operational decisions with the people who actually issue and receive keys. Confirm the contact route works outside office hours and that deputies know what they are authorized to decide.

Reconcile the starting inventory. Resolve duplicate references and unexplained sets before treating the register as the baseline. Record outstanding issues explicitly instead of silently assuming everything is available.

Then rehearse a normal checkout and return, a declined handover, a partial return and an unavailable system. Ask staff to show where they would record each event and whom they would contact. Adjust instructions that require guesswork.

Approve a version, record its effective date and make it available at the point of use. Review early exceptions with the team. A policy that nobody can follow during a busy shift needs a practical correction, not simply another reminder email.

Keeping the policy workable as the team grows

Paper or a shared spreadsheet may suit a team with one issuing point and a consistent person maintaining the record. Decide who reviews open entries and how colleagues find the current version. Adding software does not decide the authorization rules for you.

KeyDocket provides a shared register for recorded checkouts, handovers and returns. Its published workflow keeps the sender as the recorded holder until the recipient accepts a handover. QR labels open records for authorized workspace users; they do not provide GPS tracking or prove possession. [3]

Your team still needs to check permissions, record movements accurately and act on discrepancies. Use the software to support the policy you adopt, and check that its workflow fits your chosen handover rule.

Explore the KeyDocket demo to see how a shared register could support your team’s process.

Frequently asked questions

Is a key control policy the same as a key holder agreement

No. The policy sets out the organization’s operating rules. An individual acknowledgement or agreement records what a particular person has accepted. This template does not create a separate liability agreement or set financial penalties.

Can contractors be covered by the same policy

Yes, you can include them in its scope, while specifying who approves each assignment and who receives the keys. Do not treat inclusion in the policy as blanket permission to enter client premises or pass keys to another worker.

How often should we review the policy

Choose a review date and owner, and review it when the process, sites or responsibilities change, or an incident exposes a gap. This guide does not prescribe a universal review interval or audit frequency.

Does the template establish compliance

No. It provides original operational wording for adaptation. The institutional examples below illustrate particular policies; they are not evidence that this template meets your contracts, insurer conditions or legal obligations.

Sources and further reading

[1] CUNY Graduate Center key control policy. See Administration of the Locking System, Control of Locking Devices, and Key Authorization and Eligibility.

[2] McNeese State University key control policy. See Key Control Rules. The no-transfer rule described above belongs to that institution.

[3] How KeyDocket works. Source for the product workflow description, rather than an independent test of the service.

Sources checked October 2, 2026. The template and recommended procedures are original editorial material, not reproductions of the institutions’ policies.