- › Most organizations can revoke an electronic badge in seconds and cannot produce a count of the master keys in circulation.
- › Keys get copied, lent, kept by former staff and contractors, and left in drawers, and none of that shows up in any log.
- › A single lost master key on a standard keyway can mean rekeying a building, which is why losses tend to go unreported.
- › Restricted keyways, a key register with signatures, and a scheduled count cost far less than one rekey.
- › Start with an assessment that counts keys, maps what each level opens, and identifies which doors never moved to electronic access.
Ask a facility manager how quickly they can shut off a former employee’s badge and you will usually get a confident answer measured in minutes. Ask the same person how many keys exist that open the server room, the main electrical room, or the executive suite, and the answer tends to become a pause, then an estimate, then a promise to find out.
That gap is common, and it is expensive in a way nobody notices until a key goes missing. The electronic access system gets the budget, the audits, and the reporting. The mechanical key system underneath it, which still protects many of the most sensitive rooms in the building, often runs on a spreadsheet that stopped being accurate years ago.
Why Keys Outlive Every Other Control
A badge is a record in a database. It can be revoked, it expires, and every use leaves a log entry. A key is a piece of metal that works until the lock is changed, leaves no trace when it is used, and can be copied at a hardware store for a few dollars unless the keyway is restricted.
That difference matters most at the moments when access should end. When an employee leaves, the badge gets disabled as part of offboarding, and the keys depend on somebody remembering to ask for them back. When a contractor finishes a job, the badge expires on schedule, and the key they were lent for the mechanical room frequently goes home in a toolbox. We have written about the population that holds your access without appearing in any HR process, and keys are where that problem is hardest to see, because there is no record to audit.
Keys also get copied for convenience. A department head makes a spare so the team is not locked out on weekends. A property manager cuts extras for a new tenant. Each copy was made for a reasonable operational reason, and every one of them is now outside any inventory you hold.
How a Master Key System Works, and Why It Raises the Stakes
Most commercial buildings use a master key system, where locks are pinned so that a change key opens one door, a submaster opens a group of doors such as a floor or a department, and a grand master opens nearly everything. It is an efficient design that lets a small number of people carry a small number of keys and still reach the whole building.
The same efficiency is what makes a lost master key serious. A lost change key means rekeying one door. A lost submaster means rekeying every door in that group. A lost grand master on a system without restricted keys can mean rekeying the entire building, which runs to many thousands of dollars in hardware and labor for a large facility, plus the disruption of redistributing new keys to everybody.
That cost has a predictable effect on behavior. When reporting a lost key triggers an expensive rekey, people delay reporting it, hope it turns up, or quietly decide it probably fell somewhere harmless. The organization ends up with less information precisely because the consequence of honesty is large and visible.
What Makes a Key System Controllable
Restricted keyways. A restricted or patented keyway means blanks are only available through an authorized dealer, and duplicates require an authorized signature. This removes the hardware store copy entirely and is the single most important decision in the system, since it determines whether your key count can ever be accurate.
A key register with signatures. Every key issued gets a record of who holds it, which key it is, what it opens, and when it was issued, with a signature from the holder. The register should list keys by number, which requires stamping each key with a unique identifier at issue.
A scheduled count. At least once a year, and at every departure, the keys on the register get physically accounted for. Keys that cannot be produced are treated as lost, which is exactly what they are.
Fewer masters. Review who carries master and submaster keys and whether they need them. In many buildings the list has grown by accumulation, and every holder you remove reduces what a single loss can cost.
A reporting path that does not punish. Make it straightforward to report a lost key without that report becoming a personal problem for whoever lost it. A late report of a lost grand master is far more expensive than an early one.
Where Electronic Access Should Replace Keys
For your most sensitive rooms, the right answer is often to take them off the mechanical system altogether. Server rooms, electrical rooms, and rooms holding cash, records, or controlled substances are good candidates for electronic access with logging, so that entry leaves a record and revocation happens in one place.
Many buildings added electronic access to the perimeter and left the interior on keys, which means the doors with the most sensitive contents are often the ones with the least visibility. When those systems do produce logs, they belong in your monitoring, which is the argument we made in the badge data your SOC never ingested.
What It Costs to Leave This Alone
The business case is straightforward because the costs are concrete. A single building-wide rekey after a lost grand master usually costs more than setting up a restricted keyway and a proper register in the first place. After a theft or an incident involving an interior room with no forced entry, an insurer or investigator will ask who had keys, and “we are not sure” is a difficult answer to give about a room that held something valuable.
There is also a liability dimension. If a former employee or contractor uses a retained key to enter a building and harm somebody, the question of whether the organization took reasonable steps to recover that key will be asked, and a signed register with an exit check is the evidence that answers it. The same logic applies to the notice period covered in the two weeks after they resign, when access is most likely to be misused and least likely to be watched.
Where to Start
Begin with an assessment. Count the keys you can find, starting with every master and submaster, and compare that count with whatever records exist. Map what each master level opens. Identify which sensitive doors are still on the mechanical system. Check whether your keyway is restricted and whether your locksmith will cut duplicates without authorization.
That work usually takes a few days for a single building, and it will tell you whether you are looking at a register to rebuild or a system to replace. Either way, you will finally have an answer to how many master keys exist, which is a question that should never take more than a minute to answer about a building you are responsible for.
Dusten Trounce is Director of Physical Security at Grab The Axe.
A leader defined by a 'bias for action,' Dusten specializes in physical security assessments that impact profitability. He leverages high-logic strategies to pinpoint high-ROI vulnerabilities, ensuring defense measures actually scale with the business.
View Author Page →
