Custody of Keys: Governing Building Access When People Leave
Photo: 玄史生, CC0, via Wikimedia Commons
Physical access is often treated as an administrative afterthought. A fob is handed back, a key is dropped into a drawer and an alarm code is changed when someone remembers. For UK SMEs, that informality is a governance weakness. A former employee or contractor may retain a credential, a copy of a key or knowledge of a door code. The exposure is wider than theft: it can affect insurance cover, lease compliance, fire safety arrangements and the security of personal data held on site.
Access credentials are controlled assets
A building access credential is not a perk. It is an asset that allows entry to premises, storage areas, plant rooms or restricted zones. The board does not need to inspect every key, but it should ensure that access is issued, recorded, reviewed and withdrawn under a documented process. In a small company, the operations manager or office manager may keep the register; a director should remain accountable for the control.
The process should cover employees, directors, contractors, cleaners, agency staff and anyone else who receives a fob, key, code or building permission. It should also cover access held through a landlord or managing agent, because the tenant may not physically hold the credential even though it has authorised the occupier.
Maintain a single access register
The register is the foundation. It should be restricted to those who need it, but it should be complete. A useful register records the person, their role or company, status, the items issued, the areas they can access, the issue date, the return date and the name of the person who authorised the access. Where a landlord issues a fob, record the landlord reference alongside the tenant record.
Avoid a register that lists only names. It should show authority: who approved the access, under what rule, and when it was last reviewed. For contractors, record the sponsoring manager and the contract end date. For temporary staff, record the expected last day. A register that cannot answer who approved a master key is not a control; it is a contact list.
Zone the premises
Not all access carries the same risk. Define simple zones, such as general office, meeting rooms, finance, secure storage, communications room, plant and roof. Apply different approval levels and return rules to each. A cleaner may need general office access but not the finance archive. A contractor may need plant access for a fixed period but not an alarm code that remains valid after the work is complete. Zoning allows the company to prioritise revocation when time is short.
Use a departure checklist
The checklist should start when notice is accepted, not on the final afternoon. For a resignation, confirm the last working day and identify every access item held. For a dismissal or immediate departure, revoke high-risk access at once and escort the person from the premises where appropriate. For a contractor, begin demobilisation before the contract end date.
A workable checklist includes: retrieve all fobs, keys and passes; disable or delete access control credentials; change shared alarm codes where the individual knew them; recover parking permits and lock-box codes; notify the landlord or building manager; update the access register; and record the time and date of each step. Where the person works remotely or leaves without returning items, document the exception and decide whether locks or codes must be changed.
The checklist should be evidence, not just activity. A signed return form, an email from the landlord confirming deactivation or a screenshot from the access control system is stronger than a note saying that keys were collected.
Coordinate with the landlord
Many SME tenants occupy multi-let buildings where the landlord or managing agent controls fobs, building access systems and out-of-hours permissions. The lease or building rules may require the tenant to notify the landlord of authorised occupiers. Agree a named contact on each side, use a standard notification template and set an expected turnaround for deactivation. Include landlord-issued credentials in the tenant register so that the two records can be reconciled.
Where the landlord runs a building security review, attend it and bring the tenant record. Do not assume that the landlord's system is the complete record. The tenant remains responsible for who it authorises to enter its demised premises, even when the building reception issues the fob.
Control codes, keys and shared secrets
Alarm codes should be unique to individuals where the system allows. Where a shared code is unavoidable, rotate it when anyone with knowledge leaves. Master keys should be serialised and signed for. Key safes and lock-boxes should be changed after a departure if the code was known. Informal copies are the weakest link: a key cut for a former office manager can outlast several organisational charts.
Review and report
Run a quarterly reconciliation between the register and the access control system, and an annual audit of the whole process. Report simple metrics to the board or management team: outstanding returns, overdue contractor access, time taken to revoke access after departure and exceptions approved outside policy. These measures turn physical access from a facilities anecdote into governance evidence.
Physical access control does not require a large security team. It requires a named owner, a complete register, a departure checklist that is used consistently and a working relationship with the landlord. For an SME, that is proportionate governance: enough structure to protect the premises and demonstrate control, without turning a key handover into a bureaucratic exercise.
