A key control log is filled out one row at a time, and every row has to answer the same four questions: which key moved, who took it, who authorized and witnessed the handoff, and when it is due back. To fill out a key control log correctly, capture a complete set of fields at the moment of issuance, close the entry out the moment the key is returned, and never leave a return column blank. The federal government has used a dedicated form for this purpose, GSA Form 138, since 1970, and the same structure works for any commercial building, school, or apartment complex.
Fields Every Entry Must Contain
Each row in the log should capture the following, with nothing skipped:
- Key serial number or identifier, matching the code stamped or engraved on the key itself.
- Location or lock served, written as a code rather than spelled out (so a lost log page doesn’t become a map of your building).
- Recipient’s full legal name and department. Not a nickname.
- Date and time of issuance.
- Expected return date, filled in at issuance. A blank return-date column is useless; overdue items need to be visible at a glance.
- Date and time of actual return, completed when the key comes back.
- Issuing officer’s signature, confirming who handed the key over and verified the recipient’s identity.
- Recipient’s signature, acknowledging they received the key and accept responsibility for it.
If you’re logging on paper, give the signature columns enough width to be legible. An illegible scrawl in the “issued by” column defeats the purpose of having a signature at all. If you’re logging in a spreadsheet, you can sort by expected return date to flag overdue keys, filter by recipient to see everything one person holds, and search by serial number to trace a specific key’s history.
Filling Out an Issuance Entry
Treat every handoff as a small chain-of-custody event. Done the same way every time, the process is quick.
First, confirm the recipient’s identity with a photo ID. Ten seconds of verification prevents someone from picking up a key under a coworker’s name. Second, confirm the request has been authorized, typically by a department head or facilities manager. Third, write the entry: serial number, recipient’s full name and department, date and time, and expected return date. Fourth, both parties sign. The officer’s signature confirms they handed the key over; the recipient’s signature acknowledges responsibility.
Enter the row into the master log immediately. Don’t stack up handwritten notes to transcribe later. Entries written from memory an hour after the fact are where errors and gaps appear.
Filling Out a Return Entry
When the key comes back, the person on duty inspects it and confirms the serial number matches the open entry in the log. Record the return date and time in the return column, and have both parties initial or sign the return. That closes the loop.
Skipping the return documentation is the single most common failure in key control logs. If a return isn’t recorded, the log shows the key out when it’s actually back in the cabinet, and that ambiguity is worse than useless during an audit or an incident investigation. Close the entry at the moment of return, not at the end of the shift.
Where the operation runs on a database or an electronic key cabinet, the timestamp is applied automatically when the slot is accessed, which removes disputes about when something happened. For smaller operations, a shared spreadsheet with cell-level edit tracking produces a defensible record as long as file access is restricted to authorized personnel.
Labeling Keys So Entries Match the Object
The identifier on the key has to match the identifier in the log, and the labeling scheme shouldn’t give away what each key opens. Use alphanumeric codes or color-coded rings rather than stamping “Suite 302” or “Server Room” on the blank. A master labeled “M-001” and a sub-master labeled “SM-014” tell your team what they need to know; they tell someone who finds the key in a parking lot nothing useful.
Serial numbers stamped directly on the metal give you a permanent reference even if a ring tag falls off. Distinguishing master-level access from single-door access in the coding scheme matters because it changes the stakes when a key goes missing. One office closet is an inconvenience. A master that opens an entire floor is a potential rekeying event.
One note on duplication: keys stamped “Do Not Duplicate” carry no legal weight, and any locksmith can copy them. Patented keyway systems, on the other hand, restrict legal duplication, and unauthorized copying of a patented design can trigger civil penalties under federal patent law. If controlling duplication matters, invest in a patented system rather than relying on the stamp.
Logging a Lost Key
A lost key gets its own entry, not an edit to the original issuance row. Require the person who lost it to report the loss within 24 hours. In the log, record the date reported, the key’s serial number, the recipient it was issued to, and the outcome of the response: replacement issued, locks rekeyed, investigation opened.
The response itself scales with the risk. A single-door key to a low-security space may only need a replacement and some added monitoring. A master or sub-master usually calls for rekeying every affected lock. Rekeying a standard commercial cylinder typically runs $20 to $35 per lock, which is manageable for one door and significant for a master that opens fifty.
Documenting the loss in the log protects the organization if an unauthorized entry later traces back to the missing key. Without a dated record of the report and the response, you have no way to show what was known when.
A separate question sometimes comes up: whether the employee can be charged for replacement costs. Federal law allows this under the Fair Labor Standards Act only if the deduction doesn’t push the employee’s pay below the federal minimum wage for that workweek and doesn’t cut into overtime owed, and asking for cash reimbursement is treated the same as a payroll deduction.1U.S. Department of Labor. Fact Sheet 16 – Deductions From Wages for Uniforms and Other Facilities Under the FLSA2eCFR. 29 CFR 531.35 – Wage Payments Many states impose stricter rules, so check your state’s labor department guidance before charging anyone.
Storing and Retaining the Completed Log
Completed logs contain names, signatures, sometimes employee IDs, and a map of who accessed which parts of your building and when. Store paper logs in a locked filing cabinet. Store digital logs in encrypted folders with access restricted to facilities managers, security officers, and internal auditors. A completed log left in an unlocked drawer or on an open shared drive defeats the purpose of keeping one.
No single federal statute sets a retention period for private key control logs. The IRS requires taxpayers to keep records for at least three years from the date of filing, with a seven-year window in narrow situations like claiming a loss from worthless securities or bad debt.3Internal Revenue Service. How Long Should I Keep Records As a practical matter, retaining key control logs for at least seven years covers most audit, insurance, and litigation scenarios. Your insurer or industry regulator may require longer, so confirm before you destroy anything.
When logs do reach the end of their retention period, dispose of them properly. The FTC’s Disposal Rule under FACTA requires businesses to take reasonable measures to prevent unauthorized access to consumer information during disposal. For paper, that means shredding, pulverizing, or incinerating. For digital files, that means overwriting or degaussing the storage media so the data cannot be reconstructed. A certified document destruction vendor and a certificate of destruction on file is the cleanest approach.4eCFR. 16 CFR 682.3 – Proper Disposal of Consumer Information
Falsifying Entries at Federal Facilities
One boundary worth knowing. If the facility is federal, falsifying a key control log is a federal crime. Under 18 U.S.C. ยง 1001, knowingly making a false statement or using a fraudulent document in a matter within the jurisdiction of the federal government carries fines and up to five years in prison.5Office of the Law Revision Counsel. 18 USC 1001 – Statements or Entries Generally Signing someone else’s name, backdating an entry, or recording a return that never happened all qualify. The statute doesn’t reach private-sector logs, but a falsified entry at any facility can become evidence of negligence in a civil suit if an unauthorized entry leads to property damage or injury. Fill out every row as if it will be read in a deposition, because one day one of them might be.