Most apartment buildings and commercial properties don’t have a written key control policy. Keys get cut, handed out, and never tracked again. A maintenance tech leaves and keeps his keys. A contractor gets a copy made “just in case” and never returns it. A former tenant’s key never gets collected because nobody kept a list of who had one.
None of that shows up as a problem until something goes wrong, a break-in with no forced entry, a tenant dispute over who had access, an insurance claim that gets denied because the property couldn’t show it controlled its own keys. A written key control policy is how a property management company avoids that exposure.
What a Key Control Policy Actually Is
A key control policy is a written document that answers four questions for every key on the property: who can have one, how it’s tracked, when it gets replaced, and who is authorized to make more. It’s not a filing cabinet full of receipts. It’s a system, restricted keyways, a tracking log, and clear rules for when rekeying happens.
Without that system, a property is relying on trust and memory. Neither holds up over years of tenant turnover and staff changes.
The policy itself doesn’t need to be long or complicated. What matters is that it’s written down, that everyone with access to keys knows it exists, and that someone specific is responsible for enforcing it. A policy that lives only in the property manager’s head disappears the day that person leaves or gets too busy to remember every exception they’ve made.
The Problem: Keys Circulate Without Anyone Noticing
Here’s what typically happens without a policy. A property has standard keyways that any hardware store or locksmith can duplicate. A tenant moves out and turns in one key, but she had two cut over the years. A maintenance contractor works on a unit and gets a master key temporarily, nobody logs when it’s returned. A former employee’s access was never formally revoked because keys don’t come with an on/off switch the way access cards do.
Multiply that across a 40-unit building over five years and there’s no way to say with confidence how many working keys exist for any given lock. That’s the exposure. If there’s ever a break-in with no sign of forced entry, “we don’t know who has keys” is not a position a property manager wants to be in during a lawsuit.
Restricted Keyways as the Foundation
The fix starts with the key itself. Standard keyways can be duplicated at any hardware store, no questions asked. Restricted keyways solve that by legally controlling who can cut a duplicate.
Medeco and Mul-T-Lock both manufacture restricted key systems built around this idea. Keys are stamped “do not duplicate” and registered to specific authorized signers on the account. A hardware store can’t cut one, only an authorized dealer can, and only for someone on the signature card. Pro Locksmith LLC is an authorized Mul-T-Lock dealer.
This single change closes the biggest gap in most buildings’ key control: the ability for anyone with a key to walk into a hardware store and make more. With a restricted keyway, duplication requires a signature on file with the locksmith or manufacturer, not just possession of a key.
Key Tracking: Logs, Serialization, and Audits
A restricted keyway controls duplication. It doesn’t tell you who currently holds a key. That requires a tracking system on top of it:
- A sign-out log for every key issued, who received it, what it opens, the date, and a signature
- Serialized keys where each key in the system has a unique number tied to a specific person or unit in the log
- Periodic audits where someone physically confirms who still has which keys, especially after staff turnover
This doesn’t need to be complicated. A spreadsheet with columns for key number, holder name, unit or door, date issued, and date returned covers most small and mid-size properties. What matters is that it exists, it’s kept current, and someone is responsible for updating it every time a key changes hands.
Master Key System Security
Most commercial and multi-unit residential properties run a master key system, individual unit keys that work only their own lock, plus one or more master keys that open multiple units for maintenance and management staff. Master keys are the highest-value target in the system, because losing one compromises every door under that master.
A few rules that matter for master key security:
- Master keys should go to the fewest people possible, property manager, maintenance supervisor, and rarely anyone else
- Master keys should never leave the property with a contractor
- If a master key is lost, that’s not a “replace the key” problem, it’s a “rekey everything under that master” problem, because you no longer control who can open those doors
When to Rekey
A key control policy needs clear triggers for rekeying, not a vague “we’ll get to it eventually” standard. The common triggers:
- Tenant turnoverevery unit gets rekeyed between tenants, no exceptions
- Staff changeswhen a maintenance employee, super, or manager with key access leaves
- Lost or unreturned keysif a key can’t be accounted for, the lock it opens should be rekeyed
- Security incidentsa break-in, an unauthorized entry, or any event that raises doubt about who can get in
Waiting to rekey “until it becomes a problem” is how uncontrolled keys accumulate in the first place. The cost of rekeying a unit is small compared to the liability of an unauthorized entry traced back to a key that should have been retired.
COI Requirements for Key Access
Any contractor, cleaning company, or vendor who receives a key or access credential to a commercial property should be required to provide a certificate of insurance (COI) before that access is granted. This protects the property if something goes wrong while that vendor has access, property damage, theft, or an incident during their work. A COI requirement should be written into the key control policy itself, not handled informally case by case.
Pro Locksmith LLC provides a certificate of insurance on request for commercial clients, and we recommend property managers require the same from every vendor who receives building access.
Legal Liability If a Key Gets Copied
This is the scenario every property manager should think through before it happens: a key is copied without authorization, and later there’s a break-in, an assault, or a theft traced back to that key. If the property has no record of who had keys, no restricted keyway preventing duplication, and no rekeying policy after past turnover, the property’s negligence case is hard to defend. Courts and insurers look at whether the property took reasonable steps to control access. “We never really tracked it” is not a strong answer.
A written key control policy, restricted keyways, a tracking log, and defined rekeying triggers, is the paper trail that shows a property took access control seriously. It doesn’t just prevent problems. It’s the evidence that the property did its part if something happens anyway.
Common Gaps We See on Broward Properties
A few patterns show up repeatedly when we work with property managers on key control:
- No consequence for unreturned keys. Lease agreements often don’t specify what happens if a departing tenant fails to return every key. Without that language, the property has little leverage to enforce full key return.
- Contractor keys treated as an afterthought. A landscaping crew, a pest control vendor, or an HVAC contractor gets a key for convenience, and it stays in circulation long after the job is done.
- No distinction between staff turnover and tenant turnover. Properties often rekey when a tenant leaves but forget that a departing maintenance employee or leasing agent may also hold keys that need to be accounted for.
- Verbal-only policies. The rules exist, but only as something the property manager remembers to mention. New staff and new vendors never see them in writing.
Each of these is a small gap on its own, but they compound. A property with two or three of these gaps running for several years usually has no real answer to “who currently has keys to this building.”
Building the Policy
A basic key control policy for a Broward property should cover:
- What keyway system is in use (restricted, ideally Medeco or Mul-T-Lock)
- Who is authorized to request duplicate keys, and how that request is verified
- How keys are logged, sign-out sheet, serial numbers, or an electronic log
- When rekeying happens automatically (every tenant turnover, at minimum)
- What triggers an emergency rekey (lost key, terminated employee, break-in)
- COI requirements for any vendor receiving keys or access
Pro Locksmith LLC works with property management companies across Hollywood, Fort Lauderdale, Pembroke Pines, Davie, Pompano Beach, and Coral Springs to set up restricted key systems and rekey units on turnover. We’re licensed and insured, we quote flat-rate pricing before starting work, and every technician on site is our employee, not a subcontractor.
Sources: Medeco and Mul-T-Lock restricted key system product literature. Pro Locksmith LLC is an authorized Mul-T-Lock dealer.
Storing Keys the Right Way
A tracking log records who has keys. Just as important is where the keys that are not issued live. On many properties, spare unit keys hang on hooks in a maintenance closet with the unit number written on a tag. Anyone who gets into that closet can open any unit in the building.
A better setup uses a locked key cabinet in a controlled room, with access limited to the people named in the policy. Inside the cabinet, key tags should carry a code rather than a unit number or address. The code is matched to the unit in a separate record that is kept elsewhere. If the cabinet key or a single tagged key goes missing, the person who finds it cannot tell which door it opens.
Larger properties sometimes use electronic key cabinets that release individual keys only to authorized users with a PIN or card and record every checkout and return. These are not necessary for every building, but they remove the guesswork of a paper log for properties with a busy maintenance team.
Protect the Master Key Chart
A master key system is built from a chart, sometimes called a bitting list, that records the cut depths for every key in the system. Anyone with that chart and a key machine can cut working keys for the building, including masters. It is the most sensitive document in the entire key control program.
Keep the chart in the hands of the locksmith who manages the system and one designated person at the management company, not on a shared drive or in a filing cabinet with general property records. If the chart has ever been emailed widely or left in a maintenance office, treat that as a lapse and discuss with your locksmith whether the system needs to be rebuilt.
Designing the Keying Hierarchy for an Apartment Property
How the master key system is structured decides how much damage one lost key can do. A typical residential property might use these levels:
- Change keys: each unit’s own key, opening only that unit.
- Building or section masters: open all units in one building or on one floor, for staff assigned to that area.
- Property master: opens all units, held by the property manager and maintenance supervisor only.
- Common area keys: separate keys for the mailroom, laundry room, pool gate, fitness room, trash rooms, and electrical and mechanical rooms.
Keeping mechanical and electrical rooms on a separate level from residential units is important. Vendors like elevator and fire alarm contractors need access to those rooms but have no business entering units. Likewise, tenants may need a key to the pool gate and laundry room but should never carry a key that opens anything else.
When a property is built out with more levels than it needs, the system becomes hard to manage. When it has too few, a single lost key compromises too much. Your locksmith should design the hierarchy around how your staff actually works.
Amenity Access: Keys or Credentials?
Pool gates, fitness rooms, clubhouses, and package rooms are shared by every tenant, which makes them the hardest doors to control with metal keys. Every move-out takes a key that still opens the pool gate unless it is collected, and rekeying a common area lock on every turnover is not practical.
Many properties move amenity doors to fobs or keypads for exactly this reason. When a tenant moves out, their credential is deleted, and the amenity stays secure without any hardware change. Unit doors can remain on restricted mechanical keys. If you are keeping mechanical locks on amenities, plan to rekey them on a regular schedule rather than waiting until the number of unreturned keys is unknown.
A Clean Move-Out Key Procedure
Key control breaks down most often at move-out. A written procedure keeps it consistent.
- At move-in, record the number of keys and credentials issued to the tenant, and have the tenant sign for them.
- At move-out, collect every key and credential and compare the count to the move-in record.
- Note any missing keys on the move-out inspection and apply whatever the lease says about unreturned keys.
- Rekey the unit before the next tenant receives keys, whether or not every key was returned.
- Deactivate any fobs or codes the tenant held on the day they move out.
- Update the key log with the new key numbers issued to the next tenant.
The rekey should happen even when all keys come back, because there is no way to know whether copies were made during the tenancy if the keyway was not restricted.
Vendor and Contractor Access Without Handing Over Keys
Instead of lending a key to each vendor, many properties use a checkout system. The vendor signs out a key at the office at the start of the job and returns it at the end of the day. The key never leaves the property overnight. For recurring vendors like pest control, a staff member can accompany them, or a keypad lock on a mechanical room can be given a vendor code that is changed on a schedule.
What should not happen is a vendor keeping a building key on their truck ring for months. Build the checkout rule into the policy and into vendor agreements so it is not a matter of individual judgment.
Responding to a Lost Master Key
Every property should decide in advance what happens when a master key is lost, because the moment it happens is the wrong time to debate it. A written response might look like this:
- The person who lost the key reports it immediately to the property manager, with where and when it was last seen.
- The manager decides, based on the circumstances, whether the loss creates a real risk. A key dropped into the ocean is different from one left in a vehicle that was broken into.
- If there is risk, the locksmith is called to rekey every lock under that master, starting with the most sensitive doors.
- The incident is documented in the key log with the date, the decision, and the work completed.
Some properties keep a supply of spare cylinders or cores pinned to a new master so a large rekey can be completed more quickly. Talk to your locksmith about whether that makes sense for your building.
When Management Companies Change
A change in management company is one of the riskiest moments for key control. The outgoing company may hold keys, charts, and logs, and the incoming company may inherit a system it knows nothing about. Make key control part of the transition checklist: collect every master key, the key cabinet keys, the master key chart, and the key log, and confirm with the locksmith who has been maintaining the system. If the outgoing company cannot account for its masters, a rekey of the affected levels should be part of the transition budget.
Annual Key Control Review
Once a year, a property manager and the locksmith should sit down with the key log and ask a few questions. Who holds master keys, and do they still need them? Which units have not been rekeyed since the last tenant? Are there vendor keys that were never returned? Is the key cabinet access list current? Does the master key chart still match the locks in the doors? A short annual review catches the drift that builds up over a year of daily operations.
Pro Locksmith works with property managers across Broward County, as well as in Boca Raton, Delray Beach, Aventura, and North Miami, to design keying hierarchies, maintain master key charts, and handle turnover rekeys on a schedule that fits each property.