Key Blank and Key Control Inventory

Purpose

A restricted keyway is worth exactly as much as the shop's custody of its blanks. The customer is not buying a harder pin stack; they are buying the fact that nobody can walk into a hardware store and get a blank that fits. That promise is defeated by a coffee can of restricted blanks in a truck, by an unlogged draw, or by a departing employee whose cabinet key was never collected, and none of those show up until a key exists that nobody in the shop cut.

This procedure makes the promise auditable. One ledger, one signer list, one reconciliation that has to close: blanks on hand plus blanks received minus blanks issued equals blanks counted. When it does not close, the shop knows within a month rather than finding out from a customer's security incident, and the customer gets to decide about re-pinning while the decision is still cheap.

Scope

Covers custody of restricted and patented key blanks from receipt to issuance or destruction, the customer's authorized signer list, cut-key issuance, miscut destruction, the periodic count, and the actions triggered by a custodian's departure or a suspected compromise. Open (unrestricted) blanks are covered at stock-control level only, because their security value is near zero and their cost is inventory, not liability.

Excludes master key system design and bitting-list custody (see the commercial master key system setup SOP, which owns the bitting list as a record), and the on-the-spot verification of a walk-in customer asking for a duplicate (see the identity and authority verification SOP, which owns that gate). This procedure assumes the requester's authority has already been established and asks only whether the blank and the cut key were properly tracked.

Roles and responsibilities

The independence in that last row is the whole point of the table. A custodian counting their own draws will reconcile a variance out of memory, and memory is exactly what the ledger exists to replace.

Procedure

Step 1: Register the signer list with the customer before the first blank is cut. For each restricted system, record at least two named individuals (not roles), their specimen signatures, their titles, a review date no more than 12 months out, and the written route for adding or removing a signer, which is a letter from an officer of the company and not a phone call. Acceptance: a signed authorization card on file with two or more names and a live review date. Wrong looks like "the office manager" as the authorized signer, which authorizes whoever holds that job title next year. Stop rule: no card on file means no blanks are drawn for that system, including for the customer who is standing at the counter insisting.

Step 2: Store restricted blanks behind two locks, and log every opening. Blanks live in a locked cabinet inside a locked shop area, and the cabinet key is held only by the named custodians. Log each opening with date, custodian and reason. Acceptance: blanks accounted by serial in the register, cabinet log current, no restricted blanks anywhere else in the building or on a vehicle. Wrong looks like a partial box left on the bench after a big job. Stop rule: a restricted blank found outside the cabinet triggers an immediate count of that system's stock rather than a quiet return to the drawer, because it means one draw was already untracked.

Step 3: Draw against a work order, recording serials at the cabinet. One draw per job, serials written on the ticket while standing at the cabinet, not reconstructed after cutting. Acceptance: the serial list on the ticket matches the blanks in hand, count included. Wrong looks like a draw recorded as "3 blanks" with no serials, which makes any later variance untraceable. Stop rule: if you cannot write the serials because the blanks are unmarked, stop and take it to the custodian - unmarked restricted stock is a receiving error that gets resolved with the supplier, not absorbed.

Step 4: Cut, stamp, test, and destroy miscuts on the spot. Eye protection on at the machine, because brass swarf comes off the wheel at eye height, and never clear chips with a finger while the wheel is turning - stop the machine and use a brush. Every cut key is tested in a cylinder of that system before it leaves the bench. A miscut is destroyed immediately by cutting it down past the shoulder, and the destruction is logged against its serial the same minute. Acceptance: every key tested and turning, every miscut logged as destroyed. Wrong looks like a miscut dropped in a scrap tray to deal with later; that tray is where an untraceable working blank comes from, because a miscut on one system is often close to a workable cut on another. Stop rule: a key that will not turn does not get filed to fit - it is destroyed, logged, and re-cut from a fresh serial.

Step 5: Issue against a signature, and count aloud. Release cut keys only to a person named on the signer card or to a recipient that card designates in writing, and record the count, the stamp codes, the recipient and the date beside the signature. Compare the signature to the specimen on the card, which is the reason the specimen is collected. Acceptance: signature matches, count on the log equals count in the recipient's hand. Wrong looks like keys left at a front desk for collection. Stop rule: no listed signer available means the keys go back into the cabinet as finished stock against that job, logged, and the delivery is rescheduled; they do not ride in the truck until someone signs.

Step 6: Return and close the job the same day. Unused blanks return to the cabinet before the technician goes home, and the ticket's disposition line is completed: delivered, destroyed, or returned, one line per serial. Acceptance: every serial drawn has a disposition, and the sum of dispositions equals the draw count. Wrong looks like a ticket closed with two serials blank. Stop rule: a ticket cannot be closed with an open serial - it stays open and appears on the custodian's daily exception list until the blank is physically in the cabinet or logged destroyed.

Step 7: Count monthly, by someone who did not draw. Count restricted blanks by serial against the register once a month; open stock quarterly is enough. Reconcile as opening count plus receipts minus issues equals physical count. Acceptance: variance of zero on every restricted system. Wrong looks like a variance explained verbally at the count and never written down. Stop rule: any unexplained variance on a restricted system stops cutting for that system, and the system owner is notified within one business day, because the decision that follows is theirs - they may want cylinders re-pinned, and they need to make that call before an unaccounted blank has time to become a cut key.

Step 8: Treat a departure or a compromise as a same-day job. When a custodian leaves, when a cabinet key cannot be accounted for, or when the shop is broken into, change the cabinet lock the same day, run a full serial count before the new lock goes on, and notify every affected system owner with the count result. Acceptance: lock changed, count completed, notifications sent, all dated the same day. Wrong looks like waiting for the monthly count because nothing appears to be missing. Stop rule: if the count cannot be completed that day, the notification still goes out that day with the reason, because the customer's exposure starts when the key went missing, not when the shop finished counting.

The record this produces

Four records, and they are checked against each other rather than read alone:

• The authorization card per system: signers, specimens, titles, review date, and the change history of who was added or removed and on whose letter
• The blank register: serial, receipt date, supplier, draw date, job number, disposition (delivered, destroyed, returned) and disposition date
• The issuance log: date, system, stamp codes, count, recipient, signature, and the ticket it came from
• The count sheets: date, counter's name, opening, receipts, issues, expected, physical, variance and its resolution

The office holds all four. They get read by the next monthly counter, by the customer's security officer during an audit of their own system, and by the shop's insurer if a key ever turns up where it should not. Keep them for the same period as your job records; the exposure on a restricted system does not end when the invoice is paid.

Worked pass: a monthly count that fails by two

Restricted system for a medical office suite, counted on the first business day of the month by the office administrator, who drew nothing during the period.

Ledger: opening physical count 43 blanks, receipts 25, issues out and not returned 20 (19 cut and delivered against signature, 1 miscut destroyed and logged). Expected closing is 43 plus 25 minus 20, which is 48. The physical count comes to 46. Variance is 2 blanks short.

Step 7's stop rule fires immediately, before anyone starts guessing. Cutting on that system is held, and the practice manager is notified the same afternoon with three facts: two blanks are unaccounted, no cut key is known to be missing, and the shop will report the trace result within two business days. That call is uncomfortable and it is the whole reason the customer paid for a restricted system.

The trace runs on the register rather than on recollection. All 25 receipts are present in the log with serials. All 20 issues carry dispositions. The 46 counted serials are compared against the register's expected serial list, and the two missing serials are consecutive, which points at a single event rather than a slow leak. The draw log for the period shows no entry for them, so they left the cabinet without being written down.

They surface on the second day in a field technician's parts box: drawn for a suite rekey that the customer cancelled while the technician was in the vehicle, taken along, never entered on a ticket because the job never opened. They are returned to the cabinet, logged retroactively as a draw and a same-day return with the reason recorded, and the physical count goes to 48, matching expected. Cutting resumes and the practice manager gets the closing note.

Two things changed afterwards. The draw log moved to the cabinet door so a draw cannot happen while the ticket is still in the truck, and cancelled jobs got an explicit return line in dispatch. Had the blanks not been found, the customer's decision would have been whether to re-pin the eleven cylinders that keyway serves, and that decision is why the one-business-day notification is in step 7 rather than at the end of the trace.

References

• Manufacturer key control program terms for the restricted or patented keyway in use (signer card, serialization, and the dealer's custody obligations), which govern over anything here and vary by platform
• ALOA Security Professionals Association guidance on key control practice and records
• See related: Commercial Master Key System Setup SOP (owns bitting-list custody), Identity and Authority Verification Before Any Work SOP (owns the requester gate), Rekey and Lock Change SOP