Key control in hotels: master keys, store keys and the key log

Hotel key control is the custody system for every key and access card in a hotel: which keys exist, what each one opens, who may hold it, when it is signed out and returned, and what happens when one is lost. It covers master keys, storerooms, cash offices and plant rooms, not just guest room cards.

The night shift ends and the floor master key is not in the box. Nobody is certain who signed it out, because nobody signed it out: it was passed hand to hand. That gap, not the lock, is what key control exists to close. After reading this you will be able to build a key register, decide who may hold which key, run sign-out and return each shift, respond to a lost key the same day, and audit the whole system monthly.

What is key control in a hotel?#

Key control is the custody system for every key and card in the building: a numbered register, a rule for who may hold each one, a signature at every issue and return, and a written response when one goes missing.

Start by separating two jobs that are often confused. The door-lock system decides whether a card opens a door; it records which card touched which lock and when. Key control decides who is allowed to ask for that card, and what happens to it afterwards. A lock with a perfect audit trail still fails if the card changes hands without a signature. If you want the mechanics of the lock side, read how door lock systems, key cards and encoders work with the PMS.

The scope is wider than guest rooms. It includes mechanical master and sub-master keys, storeroom keys, the cash office and safe, plant and technical rooms, roof and gate keys, vehicle keys, card-based master and emergency cards, blank card stock, and the encoder itself. Whoever can use the encoder can produce a card for any room in the building, which is why it belongs in the register like any other controlled item.

Three artifacts hold the system together: a numbered register, a role matrix and a shift log. Drop any one and the register becomes a list nobody checks. What fails first in practice is rarely the hardware: it is a key copied "just for this shift", a master card left in an unlocked drawer, or a leaver's card still active a month later.

Ownership is shared across front office, housekeeping and security, but each shift needs one named person accountable for the key box. The system stays procedural even in a fully electronic hotel.

Which keys and cards must a key register cover?#

Every key that opens something a guest, a contractor or a staff member should not open freely, plus every card and card-making device that can be turned into one.

Walk the building once with a notepad and list every lock: guest floors, back-of-house doors, stores, cash office, safe, plant, roof, external gates, vehicle keys, minibar cabinets. Stamp a number on a durable tag for each key. The log records the number, never the door name, because door names change and numbers do not.

Record master cards by their serial number, not as "master card 1". Count blank card stock the way you count a cash float. Include keys that live outside the building: contractors, tenants, an external cleaning company, a resident manager's flat. Finally, note which keys are on a restricted profile that cannot be copied at a local shop, and where the spare of each is kept.

Who may hold which key?#

A role matrix fixes, before any shift begins, which role may carry which key and which keys never leave the building at all.

Rows are roles, not names: general manager, duty manager, front office supervisor, night auditor, housekeeping supervisor, maintenance chief, security, cashier. Columns are key classes. Apply least authority: a floor master belongs to the housekeeping supervisor on duty, not to every room attendant on the floor.

The emergency or grand master usually has two named holders plus one sealed copy in a break-glass container, with a log entry every time the seal is opened. Cash office and safe follow dual control: two people, two keys, or a key plus a combination, so no single person can open alone. The same principle applies to the front desk itself; see front desk cash handling, floats and dual control for how the two controls reinforce each other.

Name an alternate for every holder. Without a deputy, the rule collapses on the holder's day off and the key goes to whoever is nearest. Sign and date the matrix, and review it when a role changes, not only when a person leaves.

How does sign-out and return work each shift?#

Every key leaves the register with a signature and a time and comes back the same way, and the shift handover counts the physical keys against the log.

The issue line records name, role, key number, time out, expected return time and the signature of the person taking it. The return line records time in, condition, and the signature of the person receiving it back, not the person handing it over. At handover the outgoing and incoming supervisors count the keys together against the log and both sign; a count done alone is a claim, not a check. The wider handover discipline is covered in the front desk shift handover checklist.

Master cards are counted at the start and the end of every shift, in the same discipline as a cash float. A missing key at handover is an incident that starts then; the shift does not close quietly with a note for the morning. Keep one log per shift at the desk. A notebook that travels home in a pocket is not a log.

What happens when a key or master card is lost?#

The same day: establish exactly what is missing, contain the exposure, then decide whether to cancel, re-key or accept the risk, and write the decision down.

Establish the facts first: which key number, who had it, when it was last seen, which doors it opens, and whether the tag carried a room number or the hotel name. Search, but time-box the search; containment starts while people are still looking, not after they stop.

For a lost card master, cancel it in the lock system, read the lock audit trail for any use after the loss, reissue, and recount the blank card stock. For a lost mechanical master, the real choice is re-pinning or replacing cylinders on the affected doors against accepting the risk. The general manager decides with security, and the reason is recorded. Whether to move guests, change locks or tell them is a management decision; keep any guest communication factual and short.

Record the incident, the decision, the cost and the change to the process, and review it within the week while memories are fresh.

How do you control keys for contractors, seasonal staff and leavers?#

Treat them as short-lived holders: a key issued for a task and returned at the end of it, and a card switched off before the person walks out of the building.

Contractors sign keys out against a work order and return them the same day. Where the job allows it, they are escorted and hold no key at all. Seasonal intake puts key and card issue into the first-day paperwork, on the same form that records the person's row in the role matrix. Leavers return keys and have cards deactivated during the exit process, before the last walk to the door, with a signed clearance line.

The common failure is the shared key: a store key that "everyone knows where it is" is not controlled, it is merely familiar. At seasonal closure, consolidate keys, count the spares, collect master cards and store them under seal with a signature on the seal, as part of closing a seasonal hotel for winter. Keep a leaver list and check it against active cards at the monthly audit, because deactivation is easy to promise and easy to skip.

How do you run the monthly key audit?#

Someone who does not hold the keys counts every key against the register, checks the master cards and the encoder, and signs the result.

The physical count checks that every numbered key is either in the box or accounted for by a signed issue record with a name and a time. Check both directions: keys in the register that no longer exist, and keys in the building that were never registered. Count master cards and blank stock, and review who currently has encoder access.

Spot-check two doors: compare the lock's own audit trail with the shift log for the same hours and see whether the same people appear in both. Every exception gets a named owner and a date; the audit stays open until exceptions are cleared or escalated to the general manager. Sign and date the audit and file it with the register, so the next audit starts from a known state rather than an assumption.

What to do next#

Start with the register this week: walk the building, number every key and card, and write down who holds each one today. The role matrix, the shift log and the monthly audit only mean something once that list is real, and each of them protects the one before it.