Key holding: nominated keyholders, alarm response and keeping control of keys

01

What key holding means

Key holding means two related things, and the difference matters for the law.

• Nominated keyholders: the people a business names to respond when its premises need attention out of hours, usually because the intruder alarm or fire alarm has gone off. They may be the owner, members of staff, a managing agent or a keyholding company.
• A keyholding service: a security company that holds a client's keys under contract and sends an officer to the premises when needed. It is usually sold together with alarm response, and often with mobile patrols and lock and unlock services.

Under the Private Security Industry Act 2001, which applies across the UK, keyholding carried out under contract is a licensable activity. The Act describes it as keeping custody of, or controlling access to, any key or similar device for operating a lock, and anyone doing it as a service for a client needs a licence from the Security Industry Authority (SIA). The SIA issues a key holding licence, and its security guard and door supervisor licences also cover keyholding, so an officer on a patrol and response contract usually holds one of those. The SIA's guidance, Find out if you need an SIA licence, sets out what is and is not licensable, and is worth checking before offering or buying the service: it says you need a key holding licence for security work that involves keeping, or controlling access to, any key or device for operating a lock, as part of a contract for services.

An employee who holds the keys to their own employer's building, as an in-house keyholder, does not need an SIA licence to do so. The employer still has a duty under health and safety law to consider the risks to that person, which becomes important when they are asked to attend an alarm alone at night.

02

What a keyholder does

A keyholder's job starts with a phone call, usually from the alarm receiving centre that monitors the site, or from the police. Depending on the premises and the arrangements, a keyholder or a keyholding company may be expected to:

• respond to alarm activations, attending the premises within an agreed time;
• meet the police or other emergency services and give them access to all relevant parts of the building;
• check the premises inside and out, with the police where there are signs of a burglary or other security breach, and find the cause of the alarm;
• reset the alarm and set it again, or arrange for the alarm engineer to attend if it will not set;
• secure the building, arranging a glazier or boarding up where a door or window is damaged;
• deal with other emergencies, such as a burst pipe, a power failure or a flood, calling the right contractor;
• let people in out-of-hours, such as contractors, engineers or staff who have locked themselves out;
• check unattended or vacant premises on a schedule, where the insurer requires vacant property checks;
• report what they found, what they did and what is still outstanding.

Most alarm activations are false alarms, caused by a door left open, an insect on a sensor, a fault or a user error. Keyholders still have to respond to false alarms, and each is a chance to find and fix the cause, because repeated false alarms have consequences with the police, as the next section explains.

03

What the police and councils expect of keyholders

Intruder alarms that are remotely monitored and qualify for a police response are registered with the local police force, which issues a unique reference number for the system. The police apply the National Police Chiefs' Council's security systems policy, which sets conditions for that response. Among them, the alarm user is expected to have at least two keyholders who are trained to operate the alarm, can be contacted by phone and can attend the premises within 20 minutes of being notified; a keyholding company can fill the role. The monitoring centre, not the police, keeps the keyholder details, so tell the alarm company whenever they change. Your alarm installer and the police force's alarms administration can confirm the exact requirements that apply to your system.

The same policy limits police response to systems that generate repeated false alarms: after a number of false calls in a year, a force can withdraw its response until the problem is fixed. Keyholders who attend, find the cause and get it repaired are what keeps the response in place.

In England and Wales, a local council can also designate an alarm notification area under the Clean Neighbourhoods and Environment Act 2005. Within one, anyone responsible for premises with an audible intruder alarm must nominate a keyholder and give the council their details, so that an alarm sounding for hours can be switched off. Check with your council whether your premises fall in such an area.

Fire alarms are different. Many fire and rescue services now have policies on automatic fire alarms that limit when they attend an unconfirmed alarm from certain premises, so the keyholder or someone on site may be the first to check. Your local fire and rescue service publishes its own policy.

04

Choosing between staff and a keyholding company

Asking staff to be keyholders is the traditional arrangement and costs nothing directly, but it has limits. The staff member may live far away, may not be available, and may be asked to walk alone into a building at night where an intruder could still be present. An employer who relies on staff keyholders should assess that risk, give clear instructions never to enter where there are signs of a break-in and to wait for the police, and make sure somebody knows they have gone.

A key holding company takes that role on, with trained security officers available through the night. A keyholding and alarm response contract should cover:

1. Response time: how quickly an officer will attend after a call, and how the company meets that across its area.
2. Key storage: where the keys are kept, in a secure key safe or vault, and how they are identified. Keys should carry a code, not the client's name or address, so that lost keys cannot be traced to the premises.
3. Access to keys: who in the company can draw them, and how each issue and return is logged.
4. What the officer does on arrival, and what they will not do unless the client authorises it, such as calling out a contractor at the client's cost.
5. Reporting: a report after every attendance, saying what was found, what was done and what remains.
6. Charges: the standing fee and any per-call charges, including long attendances waiting for a glazier or engineer.
7. Licensing and standards: SIA licences for the officers, which the client can verify on the SIA register, SIA Approved Contractor Scheme status for the company where it has it, and working to BS 7984-1, the British Standard for keyholding and response services. Inspectorate bodies such as the NSI certify keyholding companies against it.

Is keyholding safe for a business? It depends on the controls. A company that stores coded keys in a secure vault, logs every movement and screens its staff is usually a safer place for a set of keys than a manager's kitchen drawer. The questions above are how to tell the difference.

05

Key control and the audit trail

Whoever holds the keys, the premises needs to know where every key is. Key control is the unglamorous part of security that most often fails quietly: a leaver who never returned a master key, a contractor's copy nobody remembers issuing, a key safe code unchanged for years. Good practice is simple:

• A key register: every key and key set, which doors it opens, how many copies exist and who holds each one.
• Signed issue and return: each key issued is signed out to a named person with the date and signed back in, including keys lent to contractors for the day.
• Codes kept separately: alarm codes and key safe codes are never written on or with the keys, and are changed when someone who knew them leaves.
• Restricted keys where it matters: a restricted key system, where copies can be cut only on the authority of a registered holder, for master keys and high-security areas.
• Regular audits: a count of the keys in the cabinet against the register, on a set cycle, with any missing key followed up.
• Leavers and lost keys: keys recovered on the last day, and a clear rule for when a lost key means changing the lock or cylinder.

A keyholding company should give the client the same visibility: a record of each time the client's keys left the safe, who took them, why and when they came back. That record, together with the attendance reports, is the audit trail that shows the keys were controlled.

The personal details on a keyholder list, such as names, home addresses and phone numbers, are personal data. Keep the list where only people who need it can see it, and share it with the alarm company and police as required, not more widely.

06

Where the key record fails, and where SiteClara fits

Key registers are usually a paper book in the key cabinet or a spreadsheet on one person's computer. The weekly key audit is due but nobody records whether it was done, the lock-up check at the end of the day is a habit rather than a record, and a keyholder's report of a damaged door at 3am reaches the facilities team only when someone reads the email. The first anyone knows of a missing key is when it is needed.

SiteClara does not hold, track or control keys. What it can do is record the routine checks around them, and what a keyholder finds when they attend. A printed QR poster, with an optional NFC tag behind it, goes at a location such as the key cabinet, the alarm panel or the final exit. Staff or a keyholding officer scan the code or tap the tag on their own phone, with no app to install; they are enrolled by text and sign in with a link. They see the checks due there, such as the weekly key count or the lock-up check, and mark them done, or explain what stopped them, and can report an issue or incident with a photo. A reported issue, such as a damaged door or a key missing from the cabinet, goes onto the team's list of jobs until someone closes it, and a supervisor can escalate it to the building manager, who can answer it.

The supervisor sees what is due, done and missed, and can record the reason a check was missed. Each day the supervisor reviews and approves a report that goes to nominated management or client contacts at 8am the next morning, showing what was reported, completed and still open, and how the scheduled checks went. It is priced per building, with no per-person fees.

07

Further reading, and a list to take away

The Security Industry Authority publishes the licence types, including key holding, its public register of licence holders and the register of approved contractors. The National Police Chiefs' Council's security systems policy sets out the conditions for police response to alarms, and your police force's alarms administration can explain how it applies locally. BS 7984-1 is available from the British Standards Institution. Your council can tell you whether it has an alarm notification area, and your fire and rescue service publishes its policy on automatic fire alarms.

Check that:

• you have at least two current keyholders, or a keyholding company, for each building;
• the alarm monitoring centre has the current details;
• staff keyholders know never to enter alone where there are signs of a break-in;
• a keyholding company holds the right SIA licences, codes your keys and logs every movement;
• every key is on a register, signed out and back in, and audited on a set cycle;
• codes are kept apart from keys and changed when people leave;
• every attendance produces a report, and faults found are followed up.