Key Control Policies for Organisations
The security of a master key system isn’t just the cylinders. It’s the process: who can order keys, who approves them, how keys are issued and returned, and what happens when a key is lost. This page lays out a clean policy structure that keeps your suite auditable and controllable through staff turnover.
- “Anyone can order keys” chaos
- Contractor keys drifting into the wild
- No record of who holds master tiers
- Panic-driven rekeys after a lost key
Trusted master key system support
Speak to an MLA accredited locksmith team with in-house planning, documented suite records, and practical support before and after installation.
Master locksmiths with BSI accreditation
MLA approved locksmiths, BSI certified key systems, and independently audited security standards.
Quick efficient and keys worked without any problems, and it was more economical than some online key cutting services
Peter Bainbridge
This is the third time I have used Lock and Key and each time they have been extremely helpful and always met my requirements. Once you use keyed alike you really appreciate not having to carry muliple keys around with you.
Ged McConville
Easy to navigate website and ordering if you have the information required. Packed well and fast delivery. 1st class service. Highly recommend this company.
Sandra Thorn
A sane key control policy structure
This is the policy skeleton that works for councils, NHS estates, BTR, schools, FM, and commercial buildings. It stays lightweight, but it’s strong enough to support audits and incident response.
1) Ownership & scope
- Define who owns the key system (department and named role).
- Define scope: which buildings, blocks, and doors are in the suite.
- Define “restricted zones” and what extra controls apply.
2) Ordering authorisation
- Who can request keys, who approves, and what evidence is required.
- Define tier rules: Servant key requests may be simpler; GMK/MK tiers should be strict.
- Define supplier route: one approved provider to prevent uncontrolled duplication.
3) Issuance, handover & returns
- Issue keys against a named person (or role) with date and location.
- Require return on leaving role, job changes, or contract end.
- Maintain a “key register” that survives staff turnover.
4) Contractors & temporary access
- Use role keys (services/contractor tiers) rather than “all access”.
- Time-limit access with process (or use hybrid access control on critical doors).
- Require sign-out, return, and escalation path for missing keys.
5) Lost keys & incident response
- Define what counts as an incident (lost GMK/MK, lost key on ID lanyard, etc.).
- Define response: risk assessment, selective rekey, recode, or replacement.
- Define emergency route and who can authorise action out-of-hours.
6) Audit & review
- Schedule periodic audits: reconcile keys in circulation vs register.
- Review access tiers after refurbishments, departmental changes, new buildings.
- Maintain documentation and re-order references in a controlled location.
HMOs are where key control gets tested
High turnover, contractors, and copying risk. If you manage HMOs, your policy needs to be tight and operational.
Policy guides - you decide how to manage
Most organisations don’t need a 40-page policy. They need a policy that actually gets used. These two templates are deliberately practical.
Minimum viable policy (fast to implement)
A simple policy that reduces uncontrolled duplication and makes lost keys survivable.
- One named system owner (role + backup).
- Single supplier route for all key orders.
- Key register: who holds what, issued date, return required.
- GMK/MK tiers require senior approval.
- Lost key response plan and escalation contact list.
High-security policy (audit-heavy environments)
For NHS estates, labs, MOD, and sites with sensitive zones or compliance pressure.
- Restricted key profile + controlled ordering references.
- Split custody or ultra-limited GMK issuance (and sign-out rules).
- Contractor access controls and time-limited process.
- Regular audits and review cycles tied to estates change control.
- Formal incident response for lost master tiers.
Key control by sector
Sector pages include trigger events, hierarchy examples, and where policy matters most.
Hospitals & NHS Estates
Policy pressure points, contractor access patterns, and audit requirements.
Local Authorities
Policy pressure points, contractor access patterns, and audit requirements.
Build-to-Rent (BTR)
Policy pressure points, contractor access patterns, and audit requirements.
Schools & Colleges
Policy pressure points, contractor access patterns, and audit requirements.
Universities
Policy pressure points, contractor access patterns, and audit requirements.
Facilities Management Companies
Policy pressure points, contractor access patterns, and audit requirements.
Commercial Buildings
Policy pressure points, contractor access patterns, and audit requirements.
Housing Associations
Policy pressure points, contractor access patterns, and audit requirements.
House in Multiple Occupation (HMO)
Policy pressure points, contractor access patterns, and audit requirements.
Key control policies: common questions
Open the sections you need.
Do we need restricted keys for key control? ⌄
What’s the minimum we need to start? ⌄
What should we do if a master tier key is lost? ⌄
Want a policy that actually gets used?
We’ll help you design the suite and the process: ordering routes, approvals, issuance, and incident response that survives turnover.
Prefer to talk?
Phone: 01296 752080
Email: info@lockandkey.co.uk
See how your whole system connects
Explore your keys, groups and communal doors in a visual system map. See expected access connections, give people the keys they need, and manage orders and permissions in one secure place.
You decide who gets the keys.
An order outside someone’s access comes to you for approval. Check who is ordering, where the keys are going and exactly what they requested. Approve it when it checks out, or deny it when it doesn’t.
Pair these approvals with PREM 4, our usual patented keyway, for control over key supply as well as who can order. Every decision leaves a record in your system’s history.
Already have TSR or HMJ keys? Use the ordering page above. For another key range, contact us to find the matching product.