A building key audit often starts after a preventable problem: a former employee still has a key, a tenant moved out without returning one, or nobody can say who holds the master key. Knowing how to audit building keys before that happens gives you control over access, reduces security gaps, and helps you make clear decisions when a key is missing.
For a home, rental property, office, storefront, or multi-unit building, the goal is simple: identify every lock, every keyholder, and every key that can open a protected area. The process does not need to be complicated, but it does need to be accurate. A key cabinet full of unlabeled copies is not a key system. It is a security risk waiting to become an emergency.
Start With Every Door and Access Point
Do not begin by counting loose keys. Begin with the building itself. Walk the property and create a complete list of doors, gates, cabinets, storage rooms, mailrooms, utility spaces, and other secured areas. Include doors that are rarely used. Those are often the doors people forget to rekey after a turnover or repair.
For each opening, record the location, lock type, keyway, and whether it is part of a master-key system. Note the condition of the hardware as well. A lock that sticks, has visible damage, or requires a key to be forced can create a lockout or leave the door improperly secured.
Your list should also identify doors with electronic access, keypad locks, or combination lockboxes. Although this is a key audit, physical and electronic access should be reviewed together. A former worker who no longer has a key but still knows a keypad code can remain a security concern.
Build a Clear Key Inventory
Once you know what each lock protects, gather every available key. This includes keys held by owners, managers, maintenance staff, employees, tenants, contractors, cleaners, security personnel, and off-site administrators. Check lockboxes, key cabinets, vehicle key rings, desk drawers, filing cabinets, and any emergency key storage.
Assign each key a unique identifier. Avoid placing the full building address, unit number, or room name directly on the key tag. If keys are lost or stolen, detailed labels make them easier to misuse. A simple code such as B-14 or Office-A2 is safer, as long as the matching inventory is stored securely.
For each key, document:
- Its key ID and the lock or doors it operates
- Whether it is an individual, master, sub-master, or emergency key
- The person or company currently responsible for it
- The date it was issued, returned, copied, or reported missing
- Whether duplication is restricted or the key is stamped “Do Not Duplicate”
A spreadsheet may be enough for a small property. Larger commercial sites may need a controlled key-management log with sign-out procedures. What matters is that the record is current, protected, and easy for an authorized manager to review.
Verify Who Has Access, Not Just Who Should
A common audit mistake is comparing keys only to an old list of approved holders. That list may be outdated. Instead, contact each listed keyholder and verify the key is still in their possession and still required for their role.
For employees, ask whether their responsibilities still require access to restricted rooms, supply areas, server rooms, or rear entrances. For rental properties, verify keys are returned after move-out and that no unauthorized copies were made. For contractors, confirm whether access was temporary and whether all issued keys have been recovered.
This step can reveal uncomfortable answers. A missing key may have been loaned to a friend, handed to a former employee, or placed in an unapproved hiding spot. Address the issue directly without turning the audit into a blame exercise. The priority is restoring control of the property.
If someone cannot physically produce a key, treat it as unaccounted for. Do not assume it is harmless because it has probably been lost for a long time. A key with no known location is a key that may still open your building.
Review Master Keys With Extra Care
Master-key systems are useful because they reduce the number of keys a manager or maintenance team must carry. They also raise the stakes when one key goes missing. A grand master key may open many doors, while a sub-master key may open an entire floor, department, or group of units.
During a building key audit, identify exactly what each master-level key opens. Do not rely on memory. Test keys carefully or have a qualified locksmith verify the system. Then limit possession to people whose jobs genuinely require that level of access.
Master keys should not be left in shared drawers, maintenance carts, unlocked offices, or labeled lockboxes. They should be signed out, returned promptly, and kept in a secured location. If you cannot account for a master key, rekeying or redesigning the affected system is usually the safer choice.
There is a trade-off. Rekeying a large master-key system can cost more than replacing a few individual locks. But leaving a missing master key active can expose every area it operates. The right response depends on the key’s reach, the sensitivity of the spaces, and whether there is any realistic way to recover it.
Check for Unauthorized Copies and Weak Key Control
Keys multiply easily when there is no policy. A manager makes a copy for convenience, a tenant duplicates one for a roommate, or a contractor keeps a key for a future job. Over time, the original inventory becomes meaningless.
Ask keyholders whether they have made copies or given access to anyone else. Review purchase receipts or prior locksmith invoices if available. If standard hardware-store keys are used throughout the building, duplication may be difficult to control. Restricted keyways can provide better control because copies are available only through authorized channels.
“Do Not Duplicate” markings can discourage casual copying, but they are not a complete security measure. The stamp alone does not physically prevent duplication. For properties with sensitive access needs, ask a professional locksmith about restricted key systems, patent-protected keyways, or other controlled options that fit the building and budget.
Decide When Rekeying Is the Right Move
An audit should end with action, not a folder that is forgotten until the next incident. Rekey locks when keys are missing, former tenants or employees may still have access, ownership changes, or the number of uncontrolled copies is unknown.
Rekeying changes the internal configuration of the lock so old keys no longer work. It is often more cost-effective than replacing good hardware, especially when the lock is in proper condition. Lock replacement may be the better option if hardware is worn, damaged, outdated, or unable to support the level of key control you need.
For a rental unit, rekeying between occupants is a practical way to reset access. For an office, consider rekeying after staff changes involving people with broad access. For a commercial property with multiple suites or departments, a locksmith can help determine whether selected rekeying, a revised master system, or a phased hardware upgrade makes the most sense.
Create a Key Policy People Can Follow
The best audit loses value if keys are distributed casually the following month. Put a basic key-control policy in writing. State who can approve key issuance, where keys must be stored, whether copies are allowed, how keys must be returned, and what happens when a key is lost.
Require signed acknowledgment for master keys, building keys, and keys to sensitive areas. Set a return deadline when employment ends, a lease ends, or a contractor completes work. For properties with frequent turnover, schedule regular reviews rather than waiting for a security issue.
A quarterly review may work for busy offices, retail spaces, and managed buildings. A homeowner or small landlord may only need to audit after a move-out, renovation, lost key, or change in household access. The schedule depends on how often people enter and leave the property.
Get Professional Help When the Records Do Not Match
If your inventory reveals missing master keys, unknown copies, damaged locks, or a confusing key system, do not guess at the fix. An experienced locksmith can identify the hardware, evaluate access risks, rekey affected locks, and organize a safer key plan without unnecessary damage to doors or existing hardware.
YES Locksmith provides mobile locksmith service for homes, rental properties, offices, and commercial buildings throughout Daly City, San Francisco, and nearby Bay Area communities. When access control is uncertain, a trained technician can address the problem on-site and help restore security quickly.
A key audit is not about counting metal keys. It is about knowing who can enter your property when you are not there. Start with one door, one lock, and one accurate record, then close every gap you find before it becomes someone else’s opportunity.
