Key Audit Checklist: How to Audit Your Keys Step by Step

A key audit is a scheduled check that every key you own is either in its place or with the person your records say holds it. You count the keys on hand, confirm each key that is out with its named holder, and treat every key you cannot account for as a security decision, not a paperwork gap. Done twice a year, it takes hours. Skipped for three years, it takes weeks.

Most teams already suspect their key records are off. The audit is how you find out by how much, and which gaps actually matter. This guide gives you the procedure: what to prepare, a checklist you can run on the day, how often to repeat it, and what to do with the keys that don't add up.

If you don't have written rules for who may hold which keys yet, start with our key control policy guide. This article assumes the rules exist and covers checking that reality matches them.

What a key audit actually checks

A key audit answers three questions for every key in your register:

1. Does it exist? The key is physically somewhere you can see it.
2. Is it where the record says? Either on its hook or with the named holder on file.
3. Should it be there? The holder is still authorized for that key, and the handout hasn't quietly turned into a permanent arrangement nobody approved.

The first two are a physical key inventory. The third is what turns a count into an audit. A key that is "accounted for" with a contractor whose job ended in March is still a problem.

Before the audit: what to prepare

An audit is only as good as the list you audit against. Get these ready before anyone opens the key cabinet.

• The key register. Every key you own, with an ID, what it opens, and its class (restricted, standard, low-risk). If you have no register, building one is your first audit.
• The current handout record. Your sign-out sheet, log book or system, showing every key that is out, who has it, and when it was due back.
• The authorization list. Who is allowed to hold which class of key.
• A list of people who left since the last audit: staff, temps, contractors, cleaning crews.
• Two people. One counts, one records. It is faster and it removes the "I counted my own cabinet" problem.
• A blocked window. No handouts or returns during the physical count, or the numbers move under you.

Key audit checklist

Copy this and run it top to bottom. Every line should end with a tick or a written note.

Part 1: Physical count

• Freeze handouts for the duration of the count
• Count every key on hand, cabinet by cabinet, hook by hook
• Match each key on hand to its register entry by ID
• Note any key on hand that is not in the register (unknown keys)
• Note any hook or slot that is empty but has no handout on record
• For identical keys or access cards, count the quantity on hand against the expected total
• Check spare and duplicate keys separately; spares are the ones nobody looks at

Part 2: Keys that are out

• List every key the record says is out, with holder and due date
• Contact each holder and ask them to show the key (photo or in person, not "yes, I have it")
• Flag every key past its due date
• Flag every key held by someone who has left or whose contract has ended
• Flag every key held by someone not authorized for its class
• Flag every handout with no due date at all

Part 3: Reconcile

• Register total = keys on hand + keys confirmed out + keys flagged missing
• Every unknown key identified (what it opens) and registered, or destroyed
• Every flagged key assigned an owner and a deadline to resolve
• Missing keys moved into the lost-key procedure (see below)

Part 4: Close out

• Write a one-page summary: date, who audited, totals, discrepancies, actions
• Record decisions on missing keys, including any rekeying, and why
• Update the register for anything added, retired or rekeyed
• Book the next audit date before you leave the room

That last line matters more than it looks. Audits without a booked date drift from six months to "after the busy season" to never.

How often should you audit keys?

There is no single legal interval for most businesses, so match the frequency to the risk:

Situation	Suggested frequency
Small office, stable staff, few keys	Once a year
Standard baseline for most teams	Twice a year
Restricted keys (masters, server rooms, safes)	Quarterly
High contractor or staff turnover	Quarterly
After a break-in, a lost master, or a key holder leaving on bad terms	Immediately, for the affected keys

Two triggers outside the calendar are worth adding to your routine. When someone leaves, audit the keys they held on their last day, not at the next scheduled audit. The employee offboarding checklist for keys and equipment builds that into every exit. And when a key is reported lost, audit every key on the same lock or master system.

What to do with discrepancies

Every audit finds something. The value of the audit is in how calmly and consistently you handle it.

Overdue but located

The key exists, the holder still has it, the due date passed. Get it back or set a new due date with an explicit approval. Then ask why it was overdue. If the same keys keep running late, the due dates are wrong or the process has no reminder. Our guide on overdue equipment tracking covers the chasing side.

Held by the wrong person

The key is safe, but the holder is not authorized, or the record shows someone else. This usually means a person-to-person handoff that skipped the log. Recover the key, re-issue it properly if needed, and fix the habit, not just the record.

Unknown keys

Keys in your cabinet that are on no register. Find out what they open. Register the ones you need. Destroy the ones you don't, and write down that you did.

Missing keys

The key is not on hand, not with its recorded holder, and nobody can produce it. Give the search a short, fixed window (a few working days is common), then declare it lost. Leaving a key in "probably around somewhere" status is how an audit finding becomes an incident.

Once declared lost, answer two questions:

1. What does this key open? One door, a floor, a whole master system.
2. Who held it, and when was it last confirmed? This tells you how long the exposure window is and whether the loss is likely innocent.

The rekeying decision

Rekeying costs money, so teams are tempted to wait and hope. Decide using the key's class, ideally by a rule you agreed before any key went missing:

• Restricted keys (masters, safes, server rooms, residents' units): rekey the affected locks. No debate, no waiting period.
• Standard keys (offices, storerooms): the responsible manager makes a documented risk call. Consider what is behind the door, whether the key is marked with the address or company name, and whether a former holder left on bad terms.
• Low-risk keys (lockers, cabinets): replace the key and note it.

Whatever you decide, write down the decision and the reason. The next auditor, or your insurer, will ask.

Why the next audit is usually worse than this one

The first audit is painful because you are reconstructing history. The uncomfortable truth is that the second one often isn't much easier.

Paper sheets and spreadsheets have the same weak points every time:

• Gaps. A handout that never made it onto the sheet looks exactly like a key that never left.
• No history. Sheets get replaced, binders get cleared out, spreadsheet cells get overwritten. When you need to know who held a key last spring, the record may not exist.
• No due dates enforced. If the field can be skipped, it gets skipped, and nothing is ever officially overdue.
• Shared logins. If several people use one account to update the log, every entry says the same name. That is a log you cannot audit. We wrote about why in how a shared login ruins your sign-out log.

So every audit turns into a hunt: walk the building, chase people by email, cross-read handwriting, and hope the record you're checking against is right. For more on the paper side, see where a key sign-out sheet and a key log book start to break down.

How guardable turns a key audit into a report

guardable replaces the sheet with a record that can't quietly fall behind. Each key is registered once: a specific key as a unique item with its own history, identical access cards as bulk stock with a quantity. Every handout is an order to a named client or colleague with a due date, and every return is logged against that order.

That changes what an audit looks like:

• Part 2 of the checklist is already done. Live availability shows every key that is out, who has it and when it is due back. Anything past its due date flags itself on the dashboard, the orders list and the holder's client page.
• History doesn't disappear. guardable keeps an event-sourced, immutable audit trail: who handed a key out, who returned it and exactly when. Entries are appended, never edited over, so the record you audit against is the record that happened.
• Missing key questions have answers. "Who held this key, and when was it last returned?" is a look at the key's history, not an afternoon in the archive.
• Leavers are a quick check. Open the person's client page and see everything they still hold before their last day.
• Everyone logs as themselves. Pricing is per workspace with unlimited users, so nobody shares a login and every entry has a real name behind it.
• Multiple sites stay separate. Each site can have its own workspace with its own permissions, so you audit one building at a time without mixing records.

You still do the physical count. Keys are physical, and no software replaces looking at the hook. But the half of the audit that used to be detective work becomes reading a list and confirming it. For the wider picture, see our guide to key management software.

Frequently asked questions

What is a key audit?

A key audit is a scheduled check that every key in your register is either on hand or with its authorized, recorded holder. It combines a physical key inventory with a review of who holds what, and ends with decisions on overdue, misplaced and missing keys.

How do you audit keys?

Freeze handouts, count every key on hand against the register, confirm every key that is out with its named holder, flag overdue and unauthorized holdings, reconcile the totals, then handle each discrepancy and record the decisions. Book the next audit before you finish.

How often should keys be audited?

Twice a year is a sensible baseline. Audit restricted keys and high-turnover sites quarterly, and run an immediate targeted audit when a key holder leaves or a master key goes missing.

Do I have to rekey if a key is missing?

For restricted keys such as masters, safes and server rooms, yes: rekey the affected locks. For standard keys, make a documented risk decision based on what the key opens and how it went missing. Agree these rules before a key is lost, not during.

---

Make your next key audit a report, not a hunt. Start tracking your keys in guardable for free: every handout logged with a due date, overdue keys flagged automatically, a permanent history for every key. Up to 50 items, unlimited orders and unlimited users, no credit card, no time limit.