Somebody who left in March can still open the back door, and the alarm code has been the same since the venue opened. What a key audit actually finds, why it never happens, and the hour that closes it.

Ask a venue how many people can open the building. The answer is a pause, then a number, then a longer pause, then a smaller number of names than the first number.

Nobody is being careless. Keys get cut when somebody needs one, and there is no moment in the life of a venue when somebody sits down and counts them.

⚠️ What this page cannot tell you

⛔ What you are obliged to control, what your insurer requires, and what conditions attach to your premises are matters for your insurer, your solicitor, and your licensing authority. An access failure can affect a claim, and the terms differ by policy.

⭕ Ask them once and write the answer down. Everything below is the operational half: knowing who can get in, which is yours regardless of what anybody requires.

What an audit actually finds

Every venue that does this for the first time finds the same four things.

The person who left and kept a key

⇒ Not maliciously. They handed in the obvious one and forgot the back door, or they were never asked, because the person who would have asked was busy that week.

⇒ The Two Weeks Before Someone Quits

The key that was cut for a reason nobody remembers

⚠️ A contractor, a delivery, a period when somebody was covering. The reason ended; the key did not.

The alarm code everybody knows

Told to new starters as a matter of course ／ never changed ／ written down somewhere

⭕ A code known to more people than can be listed is not a control. It is a formality that reassures the person who set it up.

And the door that was never on the list

⇒ The cellar hatch, the fire door with a bar that can be propped, the shutter that only half locks. ⚠️ Access is not the same as keys, and the list is always longer than the keyring.

⇒ The Fire Exit Nobody Walks

Why it never gets done

There is no moment for it

⇒ Nothing triggers a key audit. It is not attached to an incident, a shift, or a month-end, so it waits for a burglary, which is a poor scheduling mechanism.

Asking feels like an accusation

⚠️ Asking three people to bring their keys in reads as suspicion unless it is framed as routine. ⭕ Doing it on a fixed date once a year makes it about the date, not the person.

And the cost of a lock change feels larger than the risk

⇒ Until you price it against a night's takings, an insurance excess, or a claim that gets questioned. The comparison is rarely made.

What it costs when it is wrong

The count that cannot be explained

⚠️ Money missing from a safe that six people can open is not an investigation, it is a shrug. Access defines what you are able to conclude, long before anything happens.

⇒ The Cash-Up That Takes An Hour

The stock that walks

⇒ Stock Shrinkage Behind the Bar: Finding the Real Number

And the suspicion that lands on everybody

⭕ This is the real damage. When anybody could have, everybody is slightly under suspicion, and the good staff feel it most because they care most.

⇒ The Staff Who Never Get Told

The list nobody has

One page. It does not need software and it does not need a policy document.

Every way in, not every key

Front ／ back ／ cellar ／ fire doors ／ shutters ／ office ／ safe ／ stock room
Alarm ／ tills ／ any padlock that matters

⚠️ Start from the doors and work back to the keys, not the other way round. The keyring will not tell you about the window that does not lock.

Who holds what, by name

⇒ Not "the managers". ⭕ Names, because the point of the list is to answer one question: if something happened last night, who could have been inside?

When they got it, and when it comes back

⇒ Two dates. The second one is the one everybody forgets to fill in, and it is the whole reason the list exists.

⇒ The Floor Manager Handover

The moment that matters most

Almost every access problem originates on one day: the day somebody stops working there.

It is the last thing anybody is thinking about

⚠️ A resignation involves a rota gap, a final shift, and often some awkwardness. The keys come up in none of that conversation.

The person who should ask is the person least likely to

⇒ The manager is managing the gap. ⭕ Which is why it belongs on a written list of leaving steps rather than in somebody's judgement on a difficult day.

And a bad leaver is not the common case

⚠️ The common case is somebody perfectly decent with a spare key in a kitchen drawer who has genuinely forgotten. Designing for that person is what makes the process feel normal.

⇒ Three Weeks Into A New Hire

Codes and cards behave differently from keys

Half of most venues' access is not metal, and it drifts in a different way.

A code is copied the moment it is shared

⇒ A key can be counted; a code cannot. ⚠️ Once it is told to somebody, you have no way of knowing how far it went, which changes what changing it means.

Cards and fobs can be turned off, which is the point

⭕ The advantage of a fob is not security, it is revocation — one person leaves and one fob stops working, with no locksmith involved.

But only if somebody actually does it

⚠️ A system that can revoke, operated by nobody, is a system that cannot revoke. ⇒ The step belongs on the same list as the keys.

And the shared login is the same problem indoors

⇒ One account that everybody uses means the record of who did what has no names in it.

⇒ The Till That's Always Short

Who is inside when nobody is trading

The other half of access is the people who are legitimately there at four in the morning.

Cleaners, contractors and deliveries

⇒ Somebody has arranged for each of them to get in, usually informally. ⚠️ These arrangements outlive the arrangement, and they are almost never on anybody's list.

⇒ The Cleaning Nobody Sees

The person who comes back for something

⭕ Perfectly normal, and worth knowing about. A one-line note beats a rule nobody follows.

And the night the last person is alone

⚠️ Locking up alone is a safety question as much as a security one. Who knows they are there, and who knows when they left?

⇒ The Shift That Always Runs Over

The hour that closes it

Walk the building and list every way in

⇒ With somebody who works nights, because they know about the door you have forgotten. Twenty minutes.

Ask for every key back, on one date

⭕ Not to keep them. To count them, and hand back the ones that should exist. The number that does not come back is the finding.

Change what needs changing

⚠️ Codes are free to change. Locks are not, but you now know which locks, which is a much smaller number than you feared.

And put it on a date next year

⇒ The Report You Open Every Monday

What good looks like

The name test

Ask who can open the back door. ⇒ A list of names means you have a control. A number means you have a guess.

The leaver test

Take the last person who left. ⚠️ Can you say what they handed back and on what date? If not, the process is a habit rather than a step.

The code test

Working     — the code changed when the last person left
Not working — it has not changed since the venue opened

Where the record has to sit

Who holds what, from when, and until when belongs beside the shift and staff records rather than on a keyring in an office drawer. Kept there, a leaver's last day includes the keys automatically. Kept in the drawer, it depends on somebody remembering on a day when they are thinking about the rota.

⇒ The Incident Log You Do Not Keep

Three to hold

1  Start from the doors, not the keys — access is wider than the keyring
2  A code told to somebody cannot be counted, only changed
3  The whole thing turns on one day: the day somebody leaves

The Keys You Cannot Account For