Key register: issuing, returning and accounting for every key on site

01

What a key register is, and which rules sit behind it

Key control has two parts. The key schedule lists every key the site holds: its number, what it opens, how many copies exist and where each one lives. The issue and return log records every movement: the key out, who signed for it, the time, and the time it came back. Together they are the key register. Many posts keep the log in a bound hard cover book with numbered pages, so that a missing page shows; larger sites use an electronic key cabinet that releases a key only to an authorised card or PIN and logs the movement itself.

No statute requires a key register. An office block, factory, school, shopping centre, sectional title scheme or estate decides for itself how it controls its keys. Where a security company holds them, though, the Code of Conduct for Security Service Providers, 2003 applies. Section 28 of the Private Security Industry Regulation Act 56 of 2001 makes it "legally binding on all security service providers, irrespective of whether they are registered with the Authority or not" and, to the extent the Act provides, on anyone using their own employees to protect their own property. Four parts of it bear on keys:

• What a key is. Regulation 4 says a key "includes any object which is used to lock, unlock, close or engage a locking mechanism of any kind", which takes in padlock keys, masters and the cards, fobs and remotes that release a lock.
• The client's property. Regulation 9(15) says a provider may not, "without a legal ground justifying such conduct, use, alienate, hand over, be in possession of, or retain any property of a client", nor "intentionally or through gross negligence damage or lose any property of a client". The keys a client hands over are the client's property, and the register shows where they went.
• Confidential information. Regulation 9(14) requires a provider to "take all reasonably necessary steps to protect and safeguard any confidential information concerning a client, including information relevant to the security, safety or protection of the client". A schedule saying which key opens the cash office is exactly that.
• Systems of control. Regulation 13(2) requires a security business to run systems of management, control and supervision that ensure "effective control over the rendering of security services". A key register, and a supervisor who checks it, is one of the plainest examples.

A breach of the Code is improper conduct under regulation 24. On a finding of guilt, regulation 25 allows a warning or reprimand, suspension of registration for up to six months, withdrawal of registration, a fine of up to R10 000, publication of the details, or any combination.

02

What a key register should record

The key schedule, kept separately from the daily log and away from the counter, lists for each key or set:

• A key number or tag code that does not name the door. A tag reading "K14" tells a finder nothing; a tag reading "Server room" tells them where to go.
• What it opens, and whether it is a master or sub-master.
• How many copies exist and where each is kept: the key cabinet, the client's safe, the managing agent's office.
• Who may draw it: the people or roles the client has authorised, and whether it may leave the site.
• Restricted keys, such as masters, the cash office or the firearm safe, marked for a second signature or the client's approval each time.

The issue and return log, one line per movement:

• the date and the time out, in the 24-hour clock;
• the key number, and the number of keys on the ring;
• the name and company of the person drawing it, their staff or contractor number, and the reason, such as a work order or permit reference;
• their signature, and the issuing officer's name and initials;
• the time returned, the number of keys returned, and the receiving officer's initials.

Record what the site needs to know who holds a key, and no more. Section 10 of the Protection of Personal Information Act 4 of 2013 (POPIA) allows personal information to be processed only if, given the purpose, it is "adequate, relevant and not excessive". A name, company and staff number identify the holder; an ID number or a copy of an ID document rarely adds anything.

The occurrence book records the key count at takeover and anything out of the ordinary, such as a key not returned or a lock found damaged, but refers to the key register rather than copying it. The visitor register records the contractor coming onto site; the key register records what they were given once inside.

03

How to maintain a key register at the post

Regulation 11(5)(a) of the Code makes the employer take reasonable steps to ensure every officer "has been properly informed about the nature and scope of his or her functions and duties". For keys, that means a written procedure in the site instructions (see security officer duties) that an officer can follow on their first shift:

1. Check authority before issuing. Confirm the person is on the authorised list for that key, or get the client's or supervisor's approval and note who gave it.
2. Issue one set, one line. Write the time and key number yourself, count the keys on the ring, and have the holder sign.
3. Keep keys on site. A key that may not leave the premises is returned before the holder signs out, and the gate officer checks before letting a contractor go.
4. Receive and count. On return, count the keys, write the time in, initial the line and hang the set on its numbered hook.
5. Count at every shift change. The outgoing and incoming officers count the cabinet together against the schedule, list every key still out and who holds it, write the count in the occurrence book and both sign.
6. Chase what is overdue the same day, not at the next audit.
7. Report a lost key at once to the supervisor and the client, with the time and circumstances in the occurrence book. The client decides whether to change the lock or re-key the cylinder.

Emergency keys. Agree with the client which keys the fire brigade or armed response may need at night, such as the main gate, the fire control room and the riser cupboards, and keep them where the site's emergency evacuation plan says. Key control never locks people in: section 13(1) of the City of Johannesburg Emergency Services By-laws, for example, requires every escape door to have "a fail-safe locking device or devices that do not require a key in order to exit". Other municipalities' fire safety by-laws differ; read your own.

Load shedding. Know how an electronic cabinet opens in an outage, and log keys on paper until power returns.

04

Copies, locksmiths and lost keys

If nobody knows how many copies of a master exist, a full cabinet proves nothing. Record every copy made and destroyed.

Locksmiths are regulated. "Performing the functions of a locksmith" is a security service under the Act, and regulation 16 of the Code says a locksmith:

• may only open a lock, or "reproduce, duplicate, manufacture or provide a key", if the person asking "furnishes written proof of his or her identity with sufficient contact particulars as well as the authority to make the request" (regulation 16(c));
• must make reasonable enquiries to verify that proof when the circumstances need it (regulation 16(d));
• must keep a proper record of that information "for a period of at least three years in a secure place" (regulation 16(e));
• may not duplicate, reproduce, manufacture or possess any key or key code "unless this is done for lawful purposes" (regulation 16(g)).

So never send an officer or a contractor to a key cutter with a master on a verbal instruction. The client, or the person the client authorises in writing, orders the copy, and the site adds the new key to the schedule the day it arrives. Where a building uses a restricted key system that the supplier will cut only on a named person's signed authority, the schedule should say who holds that authority.

When a key is lost. Regulation 9(15)(b) prohibits a provider from losing a client's property "intentionally or through gross negligence". A register showing who held the key, when it was issued and that the shift counts were done is the evidence both sides will want. Record the loss, the decision on re-keying, and the date the lock was changed.

05

Checking the register, keeping it and choosing a system

Checking. A security supervisor visiting the post should read the key register as well as the OB: keys out overnight with no reason, lines with no return time, signatures in one hand, a shift-change count showing every key present on a day the log says three were out. Once a month, or as the contract sets, count every key against the schedule, including copies held off the post, and report the result to the client.

Keeping. Regulation 10(1) of the Private Security Industry Regulations, 2002 requires every security business to keep "all the records and documents concerning the management, administration and other matters relating to the rendering of security service by it", for at least four years (regulation 10(2)(b)). The named records in regulation 10(7) do not include a key register, so agree in the contract who owns completed books and how long they are kept. Section 14 of POPIA says records of personal information must not be kept "any longer than is necessary" for their purpose unless a law, a contract or the responsible party's lawful functions require it.

Keeping it safe. Section 19 of POPIA requires "appropriate, reasonable technical and organisational measures" to protect personal information. A key schedule taped inside the cabinet door fails that and regulation 9(14) at once.

Paper or electronic. A bound book is cheap and works in an outage, but it can be filled in later and cannot tell you a key is overdue. An electronic key cabinet releases each key only to an authorised person, logs every movement and can alert when a key is late back. Where a security business keeps records electronically, regulation 10(4)(b) requires a dated backup every day on which it renders a service and the records change. Before choosing a product, look past the list of features and ask:

• How does it open, and who controls the override, during load shedding?
• Does it use fingerprints? Section 26 of POPIA prohibits processing biometric information unless an exception in section 27 applies, so know which one first.
• Who at the supplier can see the log, and can the client export it?
• Is every issue traced to a named person, and can an entry be changed without trace?

06

Where the key register fails, and where SiteClara fits

The key register records the keys handed across the counter and written in. It is weak at everything around it. The shift-change count is signed as correct at 06:00 whether or not anyone opened the cabinet. The monthly count against the schedule is done when the client asks. The cabinet that will not lock and the padlock found cut on the back gate are mentioned to whoever was passing and are still there next week. The client sees the book only if they walk to the guardhouse.

SiteClara records the routine checks around the keys where they happen. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint: the key cabinet, the control room, the back gate, the plant room door. The officer scans the code or taps the tag on their own phone, with no app to install, and marks the scheduled check done, such as the shift-change key count or the evening lock-up round, or says what stopped them. The time and the named officer are recorded as it happens. A fault found at a door or cabinet can be reported there with a photo, and it stays on the team's list of jobs until someone closes it.

The supervisor sees what was due, done and missed, and can record why a check was missed. The supervisor approves the daily report, and it goes by email to nominated management or client contacts at 08:00 the next morning: what was reported, what was completed, what is still open and how the scheduled checks went.

07

Questions people ask

What is a key register?

It is the book or electronic log that lists every key on a site and records each one issued and returned: the key number, who took it and why, the times out and in, and the officers who handed it over and received it back. The Code of Conduct for Security Service Providers, 2003 defines a key in regulation 4 as including "any object which is used to lock, unlock, close or engage a locking mechanism of any kind", so cards, fobs and remotes belong in the register too.

How do you maintain a key register?

Keep a schedule of every key and copy, issue each key only to an authorised person on a signed, timed line, count every key back in, and count the whole cabinet against the schedule at every shift change. Where a security company runs it, regulation 13(2) of the Code of Conduct for Security Service Providers, 2003 requires systems of management, control and supervision that ensure "effective control over the rendering of security services", and regulation 11(5)(a) requires the employer to take reasonable steps to ensure every officer has been "properly informed about the nature and scope of his or her functions and duties", so the procedure should be written down and a supervisor should check the register.

08

Further reading, and a list to take away

PSIRA publishes the Act, the 2002 Regulations and the Code of Conduct together on psira.co.za; the Act and POPIA are on gov.za; each municipality publishes its own fire safety by-law. Before the next key goes across the counter, check that:

• a key schedule lists every key and copy, kept away from the counter;
• key tags carry a number, not the name of the door;
• the client has named, in writing, who may draw each key and who may order a copy;
• every issue and return is a signed, timed line with a key count;
• the cabinet is counted at every shift change, and the count is in the OB;
• overdue keys are chased the same day, and lost keys reported at once;
• no escape door depends on a key to open;
• completed books are stored securely for a period agreed in the contract.