Keys, Alarm Codes and Access Cards at a Business

Why this matters

At a house, a key under the mat and a garage code texted by the homeowner are the whole access story. At a business, every door, keypad and card reader is tied to a record, and the record is the point. When cash goes missing from a back office, the first thing the owner pulls is the alarm log and the door log, and the first question is who was in the building. If your tech used the store manager's code, the log says the store manager was there. If your tech used a code nobody can tie to your shop, the log says nothing useful at all, and your shop is now the unexplained name in an investigation.

The basics of carrying and returning customer keys are covered in Customer Keys, Codes and Lockbox Custody. This card is the business slice: why a business code belongs to a named person, what the systems record, and what happens when an alarm goes off with your tech inside.

Why a business code is tied to a person

A commercial alarm panel usually supports many user codes, each with a user number. Every time the system is armed or disarmed, the panel and the monitoring company's central station record which user number did it and when. That is the audit trail.

The trail only works if each code belongs to one person. A shared code, the same digits used by every manager or written on a sticky note inside the office door, records the same user number for everyone who knows it. The log then answers "was the system disarmed at 9:42 pm" but not "by whom," and the second question is the one that matters after a loss.

So a well-run business does three things, and a shop should expect and welcome all three:

• Issues a code per person, including a separate code for a contractor, labeled with the contractor's name.
• Restricts it. Many panels can limit a user code to certain days and hours, or to disarming certain areas (called partitions) of the building, such as the stock room but not the pharmacy or cash office.
• Deletes it when the job ends. A contractor code that still works six months later is a gap in their security that your shop's name is attached to.

The shop's side of this is simple: never accept a code that belongs to an employee, and never pass a business code from one tech to another without telling the business. If a tech who was issued a code leaves your company, tell every business that issued one, so they can delete it.

The other secrets that come with an alarm

A keypad code is not the only secret a monitored business has, and mixing them up causes most of the bad nights.

• The keypad code disarms the system. It is what your tech enters at the door.
• The verbal passcode is what someone tells the central station operator when they call, to prove the alarm was a mistake and cancel a dispatch. It is often different from the keypad code and usually belongs to the keyholders only. A contractor normally does not get it.
• A duress code disarms the system while silently signaling a hold-up. Some businesses have one. A tech should never be given one, never guess at a code, and never "try a few" at a keypad, because a wrong entry can be indistinguishable from an attempt at forced entry.

If the business does give your tech the verbal passcode, treat it as the more sensitive of the two, because it can cancel a police response.

Keyholder lists and the phone call at 2 am

When a monitored alarm trips and nobody cancels it at the keypad, the central station typically follows a call list the business has set up: call the premises, call the keyholders in order, and dispatch police or a guard depending on the business's instructions and local rules. Some jurisdictions require some form of verification before police will respond to a burglar alarm, and many local ordinances fine businesses for repeated false alarms, so the business has a direct reason to care when your tech sets one off.

The practical consequences for a shop:

• Tell the business before an after-hours visit, so a keyholder knows a contractor will be in the building and is not woken to a surprise.
• Ask whether they want the central station told, many businesses call their monitoring company to put the account on test or note a scheduled visit. That is the business's call to make, with their own account.
• If your tech sets off the alarm, they stay on site, do not leave the building to "get away from it," call the keyholder or the business contact immediately, and wait for police or the keyholder if either is coming. Leaving looks exactly like a burglar who heard the siren.

The full after-hours entry sequence is its own procedure. See related: The After-Hours Business Entry and Alarm SOP.

Access cards and fobs

Card readers are the same idea as user codes, with more detail. Each card or fob is a credential assigned to a person, and the access control system logs every door it opens, and usually every attempt that was refused.

Common restrictions a contractor credential carries:

• A schedule, so the card works only during the hours the work is planned.
• A door group, so it opens the loading dock and the mechanical room but not the server room or the executive floor.
• An expiration date, after which it stops working without anyone having to collect it.

Three rules travel with any card your tech is issued. It is used only by the person it was issued to. It is never used to let someone else in behind you; holding the door for an unbadged person, often called tailgating, defeats the log for both people. And it is returned or reported lost the same day it should have been, because a lost card is a door that someone else can open in your shop's name. Fire code, as adopted locally, generally keeps the egress side of exit doors free to open without a card, so a schedule that runs out while your tech is inside does not trap them; it does mean they cannot get back in from the truck.

Worked example: one missing deposit bag, two kinds of code

A shop services rooftop units at two small retail stores, each with a monitored alarm. At both, the tech arrives after close on a Wednesday, disarms the alarm, works on the rooftop unit for a little over an hour, and arms the alarm on the way out. At both, a deposit bag is reported missing from the back office the next morning.

Store A gave the tech the store manager's code, because it was quicker than calling the alarm company. Its log for Wednesday night:

ALARM EVENT LOG  - Store A, Wednesday
time      event      user   name on account
21:36     disarmed   02     store manager
22:51     armed      02     store manager

The log says the store manager was in the building from 9:36 pm to 10:51 pm. The manager was home. The only way to place the tech is the shop's own ticket, and the only way to show the tech was nowhere near the back office is the tech's word. Every person who knows user 02's code is now a suspect, including the manager, the assistant manager who also uses it, and the contractor.

Store B had issued the shop a contractor code, user 14, restricted to the sales floor and stock room partitions, valid only on scheduled nights. Its log for Wednesday night shows:

ALARM EVENT LOG  - Store B, Wednesday
time      event      user   name on account
21:42     disarmed   14     contractor, HVAC shop
21:42     area 3     -      cash office stays armed
23:05     armed      14     contractor, HVAC shop

The cash office partition never disarmed, so the panel would have alarmed had anyone opened that door (it carries a door contact) while the tech was in the building. Store B's investigation starts with whoever disarmed the cash office last before Wednesday night, which is not the shop.

What the comparison shows. At both stores the tech did the same work for a similar hour, 75 minutes at Store A (9:36 to 10:51 pm) and 83 minutes at Store B (9:42 to 11:05 pm). At Store A the shop's protection is its own ticket. At Store B the business's own system protects the shop. The quicker option at Store A saved perhaps ten minutes of setup on the first visit.

What changes the answer. If the business cannot issue a separate code (an older panel, or no one with the access to program it), the shop records on the ticket that the tech was given a shared code, by whom, at what time, and the arm and disarm times the tech used. That is weaker than a user code, and the shop says so to the business in writing rather than accepting it silently.

Keys at a business

Physical keys at a business are often on a key control system: numbered keys, a log of who holds which, and a restricted keyway, a lock profile whose blanks are sold only to authorized locksmiths on the owner's signature, so a copy cannot be cut at a hardware store. A key handed to your tech may be logged against your shop by number. Return it to the person who issued it, get the return noted, and never copy it, even when it would save a trip.

A master key, one that opens many locks in the building, is a much larger responsibility than a single door key. If a business offers your tech a master to save time, ask for an escort or a single-door key instead. A lost master can mean rekeying a whole building.

References

• See related: Customer Keys, Codes and Lockbox Custody
• See related: The After-Hours Business Entry and Alarm SOP
• See related: The Business Lockup and Handback SOP
• See related: Badging, Background Checks and Getting Onto the Site
• Local false-alarm and alarm-response ordinances, which vary by city and county