Key register: what to record, who holds the keys, and how to audit them

01

What a key register is, and whether the law requires one

A key register, also called a key control register or key management register, lists the keys to a building and tracks their movement, giving an audit trail of who held each key and when. It usually has two parts: an inventory of every key and card, with what it opens and how many copies exist, and a sign-out log, sometimes kept as a key log book, showing who took a key, when, on whose authority and when it came back. Offices, schools, councils, shopping centres and strata buildings keep one, as do the contractors who hold their keys.

For an ordinary workplace, no Australian law says "keep a key register". The duty is the outcome. Under section 20 of the model Work Health and Safety Act, which every state and territory except Victoria has adopted in its own version, the person with management or control of a workplace "must ensure, so far as is reasonably practicable, that the workplace, the means of entering and exiting the workplace and anything arising from the workplace are without risks to the health and safety of any person" (the wording here is from Queensland's Work Health and Safety Act 2011). In Victoria, section 26(1) of the Occupational Health and Safety Act 2004 (authorised version 045) requires a person who has, to any extent, the management or control of a workplace to ensure so far as is reasonably practicable "that the workplace and the means of entering and leaving it are safe and without risks to health".

Regulation 40 of Queensland's Work Health and Safety Regulation 2011 adds that the workplace must be maintained so as to allow people "to enter and exit and to move about without risk to health and safety, both under normal working conditions and in an emergency". A plant room nobody can open during a fault, or a key held by someone who has left, is a failure of that duty; the register shows who can open what.

Some regulators do require a register. In Victoria's gaming venues, the Victorian Gambling and Casino Control Commission's Gaming Machine Area Key Management Register template says venues "must maintain a Key Management Register for the control and management of gaming equipment keys", in line with chapter 12 of the venue operational requirements in its Venue Manual, and that the register "must be kept securely and must be able to be produced at any time" for inspection. Its columns are a good model for any key register: the date and time of issue, who a key was issued to, the key number, the purpose, who authorised it, and the date and time of return and who received it, with a name, licence number and signature for each person. Where your sector, licence or contract sets a register of its own, keep it in the form it asks for.

02

What a key register should record

A key register template that works on most sites has an inventory page and a movement page. The inventory records each key once:

• A key number or code, stamped or tagged on the key, never the address or the room name, so a lost key does not say what it opens.
• What it opens: the doors, gates, roller doors, cabinets, plant rooms or lift and service keys, and whether it is a master, sub-master or single-door key.
• How many copies exist, and where the spares are kept.
• The type: a standard key, a restricted key that only an authorised locksmith can cut, an access card or fob, or a padlock key.
• The current holder, or the cabinet hook it lives on when nobody has it.

The movement page, or key log book, records each time a key changes hands:

1. the date and time it was issued;
2. the key number;
3. the name of the person who took it, their employer if they are a contractor, and their signature;
4. why they need it, and whether it is for a shift, a job or ongoing;
5. who authorised the issue;
6. the date and time it came back, and who received it;
7. anything noted: damaged, returned late, reported lost.

Access cards and fobs belong in the same register, even where the access control system keeps its own log. The system shows which card opened which door; the register shows who was given the card and who said they could have it, which the system cannot.

03

Issuing, storing and returning keys

A register is only as good as the rules around it. Write down, for each building:

• Who may authorise a key: usually the building or facility manager, with a deputy for when they are away. A person should not authorise their own master key.
• Where keys are kept: a locked key cabinet or key safe in a staffed or secure room, with its own key or code held by few people. Hooks should be numbered to match the key codes.
• What goes home and what stays on site. Master keys and keys to plant rooms, switch rooms and the fire panel are best signed out and back the same day.
• Contractors: cleaners, security, maintenance and locksmiths. Record the company as well as the person, and ask the company to keep its own record of which of its staff holds your keys.
• Leavers: keys, cards and fobs collected on the last day, cards cancelled in the access control system, and the register updated the same day.
• Lost keys: reported at once, recorded, and a decision made about whether to rekey.

Where a contractor holds keys as part of a security service, check the licence. In Victoria, Victoria Police's private security licensing page says "all private security activities are licensed activities" and that "an unarmed guard is a person who is employed or retained to protect, watch or guard any property while unarmed". Every other state and territory licenses security work under its own law, so ask for the licence that applies in your state before handing over keys.

Agree in writing who pays when a contractor loses a key. On a master key system, one lost key may mean rekeying every lock it opens, which can be every door on the site.

04

Keys in an emergency, and doors that must never be locked

The emergency plan is where a key register earns its keep. Regulation 43 of Queensland's Work Health and Safety Regulation 2011 requires a person conducting a business or undertaking at a workplace to prepare an emergency plan providing for emergency procedures, including "an effective response to an emergency", "evacuation procedures" and "notifying emergency service organisations at the earliest opportunity", and to maintain it so that it remains effective. The other model WHS jurisdictions have the same regulation in their own versions.

SafeWork NSW's Code of Practice: Managing the work environment and facilities (August 2019, based on Safe Work Australia's model code) lists what emergency procedures should address where relevant, including "the distribution of emergency phone numbers, including out-of-hours contact numbers" and "access for emergency services and their ability to get close to the work area". Both depend on keys: the out-of-hours contact has to be someone who holds them, and access for emergency services may mean a gate, a car park barrier or a plant room only a key will open. Many emergency plans are written to AS 3745-2010 Planning for emergencies in facilities; whatever the plan says about wardens and the arrival of the fire brigade, the register should show that the keys it relies on exist and are where the plan says.

Fire safety law limits what a key may do. In Queensland, section 11 of the Building Fire Safety Regulation 2008 says a person "must not lock a door on an evacuation route of a building if the person knows, or reasonably ought to know, that another person is within the building on the internal side of the door", and puts the same duty on the occupier. Section 10 says such a door is not locked if it can be opened from the inside using one device that can be operated by one downward or pushing action using one hand, such as a handle, lever or panic bar. Other states and territories have their own fire safety laws, so check yours; as a working rule everywhere, an exit is locked with a key only when the building is empty.

So list the keys the emergency plan relies on, check them whenever the plan is tested, make sure the chief warden or after-hours contact can reach them day and night, and never chain or padlock an exit while the building is occupied.

05

How to maintain a key register and audit the keys

A key register goes stale quietly. Staff change, contractors change, a key is lent and never signed back, and after a year the register describes a building that no longer exists. Keeping it true takes two habits.

A daily check at lock-up. The person who locks up checks the key cabinet: every hook that should hold a key has one, every key signed out today has come back or has a reason recorded, and the cabinet is locked. It takes a minute, and it finds a missing key the same evening instead of weeks later.

A periodic key audit. No law sets a frequency for an ordinary workplace, so set one to the risk: often quarterly, each school term, or after a change of contractor. A key audit means:

1. Count every key in the cabinet against the inventory.
2. Ask every listed holder to produce their keys, cards and fobs, or confirm in writing that they still hold them.
3. Compare the access control system's list of live cards with the register, and cancel any card with no current holder.
4. Follow up every key that cannot be found, record the outcome, and decide whether to rekey.
5. Check that the keys the emergency plan relies on are present and work.
6. Sign and date the audit, and note what changed.

Keep the register itself secure: it is a map of who can open what. It also holds names, phone numbers and signatures, which are personal information. The Privacy Act 1988 applies to most organisations with an annual turnover above $3 million and to some smaller ones; the OAIC's guidance for small business says "a small business is one with an annual turnover of $3 million or less" and lists the small businesses the Act covers regardless, such as health service providers. A private sector employer's handling of its own staff's employee records is exempt where it is directly related to a current or former employment relationship, as the OAIC's guidance on privacy in employment explains; that exemption does not reach a contractor's staff. Where the Act applies, the Australian Privacy Principles include APP 11: "An APP entity must take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure." Record only what the register needs.

06

Where the key record fails, and where SiteClara fits

Most key registers fail the same way. The sign-out page is filled in on Monday and forgotten by Wednesday. The nightly cabinet check is ticked in advance on a sheet inside the cabinet door, or not done at all, and a missing key turns up as a problem weeks later. And a missing key is mentioned to whoever is nearby and never reaches the building manager.

SiteClara records routine checks at the point where they are done. A printed QR poster, with an optional NFC tag behind it, sits at each place a check is scheduled, such as beside the key cabinet. The person locking up scans or taps on their own phone, with no app to install, sees the checks due there, such as the key cabinet check, and marks each one done or explains what stopped them. The time and the named person are recorded as it happens, with a photo when one is asked for, and a problem they report, such as a key not returned or a cabinet left unlocked, goes onto the site's list of jobs until someone closes it.

The supervisor sees what was due, done and missed, and records the reason a check was missed. Each day they review the checks and photos, add a note and approve a report that goes to nominated management or client contacts at 8am the next morning, showing what was reported, what was completed, what is still open and how the scheduled checks went.

07

Questions people ask

Is a key register a legal requirement in Australia?

Not for an ordinary workplace: no Australian law names one. Section 20 of the model Work Health and Safety Act, here in Queensland's Work Health and Safety Act 2011, requires the person with management or control of a workplace to ensure, so far as is reasonably practicable, that "the means of entering and exiting the workplace" are without risks to health and safety, and a register is a practical way to show the keys are controlled. Some regulators do require one: Victorian gaming venues must keep a register of gaming equipment keys, as the Victorian Gambling and Casino Control Commission's Gaming Machine Area Key Management Register template says.

Is there an official key register template?

We know of no general one. The nearest is the Victorian Gambling and Casino Control Commission's Gaming Machine Area Key Management Register template, written for gaming equipment keys, which records the date and time, who a key was issued to, the key number, the purpose, who authorised it, and the date and time of return and who received it, with a name, licence number and signature for each person. Those columns suit most key registers.

How do you maintain a key register?

Record every issue and return as it happens, with the key number, the holder, who authorised it and the times, update it the day someone leaves, and audit every key and card against it at a set interval. Keep it secure: the Gaming Machine Area Key Management Register template says that register "must be kept securely and must be able to be produced at any time" for inspection, a sound rule for any key register.

08

Further reading, and a list to take away

Start with section 20 of your state's Work Health and Safety Act, or section 26 of Victoria's Occupational Health and Safety Act 2004, then the emergency plan duty in regulation 43 and SafeWork NSW's Code of Practice: Managing the work environment and facilities. For holders' details, read the OAIC's Australian Privacy Principles quick reference.

Before you rely on your key register, check that:

• every key, card and fob is in the inventory, with a code that does not name the address or room;
• every issue and return is recorded with the time, the holder and who authorised it;
• keys, cards and fobs are collected and cancelled on a leaver's last day;
• the key cabinet is locked, and checked at lock-up every day;
• the keys the emergency plan relies on are listed, present and reachable after hours;
• no exit is ever locked with a key while people are inside;
• a key audit happens at a set interval, and lost keys lead to a decision about rekeying;
• the register holds only the personal details it needs, and is kept secure.