An effective key control program is required for all TAPA certifications.
I have visited a few companies whose key control program consisted of a plastic container full of keys such as that shown in the picture. Needless to say, they did not meet the requirements for key control.
Components of an Effective Key Control Program
Key Control Inventory
The first step is to inventory all the keys belonging to the company and create a master list of keys.
The keys can be divided into different groups depending on how you would like to control the keys. Groups might be identified such as fork lift keys, vehicle keys, office building keys, warehouse keys, secure room keys, high value cage keys, master keys, security equipment keys, etc.
Key Identification Label
Each key should be labelled with unique identification information or number. It is important that the key identification number does not indicate what the key opens. The inventory number can be affixed to the key by metal key stamping, markings, or attaching a label on a key ring.
The unique identification is used to create the master list of keys.
Key Issuance / Key Register
Each time a key is issued, the key register will document who received the key. There might be two different types of key registers, such as a register of keys given out every day and a different register for keys permanently issued to employees.
The key to the high value cage should not be permanently issued to an employee and taken home. The high value cage key must be registered each time it is issued.
The key register form should contain information such as the key number, date and time issued, name and signature of the person that issued the key, name and signature of the person that received the key, expected date and time the key will be returned, date and time the key was returned, and the name and signature of the person that received the key back into inventory. The expected date and time of the return is important if some keys might be issued for longer than one day. This will help identify missing keys during a daily control of the key register.
Remember – The key control register must be readable. The names of the people involved should be printed so that individuals can be identified. Signatures are important to prove receipt of the keys.
Control of Restricted Keys
Some keys are not allowed to be issued to all employees. Restricted keys might include master keys and keys to the high value cage. If master keys are issued, a supervising manager one level higher than the recipient should authorize master keys to be issued. The authorization to issue restricted keys should be traceable and in writing.
Persons allowed to have the high value cage key must be identified and approved by management before they can have the high value key. The names permitted to have the high value cage key must be available to the person issuing the keys. Therefore, the list of authorized persons should be kept updated, especially when the employee no longer has authorization to have the high value key.
Daily control of the key register should be conducted at the end of shifts. If a key is missing, the responsible person for key control should make every effort to get the key back as soon as possible. Some companies might want to write an incident report in the event a key is not returned as expected.
Master Keys
Some companies have master keys. The master key opens everything. Normally, master keys are taken home by the responsible manager.
There may be a reason for master keys… and it should be justified in a risk assessment. However, there is little reason for mater keys to be taken home. Master keys retained by managers is a huge risk especially when warehouse contain a few billion euros or dollars worth of cargo and stored products.
This article is about physical key control… however, it should be recognized that master electronic keys have the same risks.
Key Control Audits
The key control program should be periodically audited. How often does “periodically” mean? Management must decide the frequency of the key control inventory and issue procedures. It will certainly depend on the impact of the loss of key. The master list of keys, key issuance register, physical inspection of all the keys, and the key issuing procedure should be audited at least once a year during internal self-assessments.
Lost Keys
Work procedures and key control training should stress the importance of reporting lost keys.
If keys are lost, or reported as lost, the lock for the key should be replaced depending on the importance of the key. For example, fork lift keys or office door keys might not be as important as vehicle keys or master keys.
Key Storage
Everyone has their own opinions on the best way to store keys under a key control program. Perhaps the best way is to have a combination safe mounted to the floor in the office where the keys are stored and issued. A combination safe can have the combination number changed when an employee leaves.
There are a variety of automated safe key management systems with biometric and app access. Any automated system must be assessed on an individual basis.