How to Set Up Key and Code Control for the Shop
Why this matters
Ask a shop owner how many keys to the building exist and the honest answer is usually "I'm not sure." Keys got copied for a new hire at the hardware store, one went home with a tech who quit two years ago, and the alarm code is the same four digits everyone has used since the shop opened, including two people who no longer work there. When parts start disappearing on weekends, the alarm log says "user 1 disarmed at 6:12 a.m." and user 1 is everybody. Key and code control is the boring paperwork that makes the locks and the alarm mean something. The wider picture (lighting, cameras, where to store what) is in Physical Security for a Shop Full of Tools and Parts. Customer house keys, lockbox codes and gate codes are a different custody problem with different rules, covered in Customer Keys, Codes and Lockbox Custody; keep them off this register.
Step 1: Count what you have before you change anything
Collect every key to the building you can find, and ask every employee to bring theirs in for a count (not to keep, just to see). For each one, note what it opens and who had it. List the alarm panel's user codes from the panel's programming menu or ask the alarm company for the list: most panels hold a set number of user slots, and you want to know which are in use.
Why first: you cannot decide what to rekey until you know what is missing. The count also tells you whether the old system can be saved: if every key that exists is accounted for, a register can start from today. If keys are unaccounted for, the locks they open get rekeyed before the register starts, or it starts out wrong.
Step 2: Move to a restricted keyway
A restricted keyway is a lock and key profile whose blanks are not sold to the public. Copies are cut only by the manufacturer or an authorized locksmith, usually only on a signed request from someone on an authorization card the shop controls. Some restricted keyways rely on a patent, which expires; ask the locksmith how long the protection on the one you choose runs.
Why: with a standard keyway, any key that leaves the building may already have been copied, so you have to treat every unreturned key, and arguably every returned one, as a possible duplicate. A "do not duplicate" stamp on a standard key is a courtesy, not a control; many key-cutting counters will copy it anyway.
What it costs you: new cylinders, and a locksmith relationship. Interchangeable-core cylinders (where a small core can be pulled with a control key and swapped in a minute) make later rekeying much quicker, which matters for Step 6.
Step 3: Design the key system around who needs what
Map doors to roles, not to people:
- Change keys open one lock or one group of locks: the front door and office, the rear man door and the bay, the parts room and the cylinder cage.
- A master key opens every lock in the system.
Give each person the fewest change keys their job needs. Office staff do not need the cage; the lead tech who receives freight does. Every key gets a stamped number that the register tracks, so "a front-door key" becomes "key C2."
The master. Decide who holds it, and keep it to one or two people. A second master goes in the safe, not on anyone's ring. Losing a master means rekeying every cylinder in the building, so it is the one key that never gets lent.
Step 4: Give every person their own alarm code
Program one alarm user code per person. Never share a code, and do not reuse a departed person's slot without deleting and re-adding it. Most panels log which user code armed and disarmed the system; that log only means something if each code belongs to exactly one person.
- Use the panel's master or installer code only for programming, held by the owner and the alarm company.
- If the panel supports schedules, limit codes for people who have no reason to be in the building at 2 a.m.
- If the panel offers a duress code (one that disarms normally while silently signaling the monitoring center), decide whether to set it up and tell the people who hold codes how it works.
- If the shop uses fobs or cards instead of codes, the same rule applies: one credential per person, deleted, not just collected, when they leave.
Record the slot, never the digits. The register lists which slot belongs to whom. Writing the codes themselves on a register that hangs in the office turns it into the most useful document a burglar could find.
Step 5: Write the register
One page, kept in the office (and a copy wherever the owner keeps business records). Every key by number, what it opens, who holds it, when it was issued and when it came back. Every alarm slot, who holds it, when it was added and when it was deleted. Each holder signs for their keys when they get them.
KEY AND CODE REGISTER Rev. 09/28/26
Master holder: Owner Spare master: safe
----------------------------------------------------
KEY OPENS HOLDER ISSUED RETURN
M1 all (master) Owner 03/02 -
M2 all (master) safe 03/02 -
C1 front, office Office mgr 03/02 -
C2 front, office Dispatcher 03/02 -
C3 rear door, bay Lead tech 03/02 09/28
C4 rear door, bay Tech, R.V. 04/14 LOST *
C5 parts rm, cage Lead tech 03/02 -
C6 rear door, bay Lead tech 09/28 -
----------------------------------------------------
SLOT LEVEL HOLDER ADDED DELETED
01 master Owner 03/02 -
02 user Office mgr 03/02 -
03 user Dispatcher 03/02 -
04 user Lead tech 03/02 -
07 user Tech, R.V. 04/14 09/25 4:10p
----------------------------------------------------
* not returned 09/25; rear door and bay office
door cores swapped 09/28; C3 replaced by C6
Step 6: Close out a holder the day they leave
When someone leaves, on good terms or bad, the same three things happen that day, in this order:
- Delete their alarm code or credential before or during the exit conversation, not after. A code is the one access that cannot be taken back by asking for it.
- Collect every key on the register next to their name, and check the stamped numbers, not just the count.
- Decide on rekeying from what came back. All keys returned on a restricted keyway: no rekey needed. A change key missing: rekey the cylinders that key opens, and reissue keys to everyone else who held that change key. A master missing: rekey the whole system. A standard keyway with any doubt about copies: rekey what that person could open.
The same steps run when a key is reported lost by someone still employed.
What breaks if skipped: the code stays live for weeks because nobody remembered whose slot was whose, and the first sign is a 3 a.m. disarm in the log.
A worked example: the key that did not come back
A nine-person plumbing shop moved to a restricted keyway on March 2 and set up the register above. In April it hired a tech, R.V., issued him change key C4 (rear man door and bay office door) and added him to alarm slot 07.
Friday, September 25. R.V. gave notice and finished his last shift. At 4:10 p.m., while he was cleaning out his truck, the office manager deleted slot 07 at the panel and wrote the time on the register. At the exit conversation he returned his truck keys and fuel card but said he had lost C4 a few weeks earlier and had been using the lead tech's rear-door key.
What the register said. C4 opened two cylinders: the rear man door and the bay office door. It did not open the front door, the parts room or the cage, and he never held a master. The keyway was restricted, so a hardware-store copy was unlikely, but a lost key is a key someone may have found, and the register showed it had been gone for weeks without anyone writing it down.
The decision. Rekey the two cylinders C4 opened, not the whole building. On Monday, September 28, the locksmith swapped the two interchangeable cores. The only other person holding a key to those two cylinders was the lead tech, whose C3 no longer worked; it was replaced with a new change key, C6, and C3 was destroyed. The register gained the C6 line and the footnote. Total: two cores and one new key, against the rekey of every cylinder in the building that a lost master would have required.
The alarm log. The panel's history showed slot 07 last used to disarm at 6:48 a.m. on September 25, his last day, and nothing after. Weekends from early September onward showed only slots 01 and 04, owner and lead tech.
What the shop changed. The lost key had been missing for weeks before anyone knew, so the register now gets a quarterly count: every holder shows their keys to the office manager, who checks the stamped numbers against the page. A lost key is reported the day it is noticed.
What would change the answer. On a standard keyway, the shop would have had to assume C4 might have been copied before it went missing, and the rekey would have been the same two cylinders plus a harder look at whether any other key R.V. had handled could have been copied too. Had R.V. held the master, every cylinder in the building would have been rekeyed before Monday morning.
How you know it is under control
Pick any day and you can answer four questions from the page in a minute: how many keys exist, who holds each one, which alarm slots are live and whose they are, and which departed employees still have access (the answer is none). If you can name a person who left and cannot point to the line where their code was deleted and their keys came back, the register is not finished.
References
- Alarm panel user manual: user-code slots, event log, schedules and duress features (varies by panel)
- Your locksmith: restricted keyway, authorization cards, interchangeable-core options and patent term
- See related: Physical Security for a Shop Full of Tools and Parts; Customer Keys, Codes and Lockbox Custody; The End of Day Yard Close SOP