An outdated (or non-existent) key control program can pose serious safety and security risks for multifamily affordable housing organizations.
“We’ve been seeing a lot of security issues and claims related to poor key management,” said Elizabeth Owens, HAI Group’s director of risk control and consulting.
When it comes to key control, the safety of residents and employees is first and foremost, noted Jesse Larson, business development manager for InstaKey Security Systems.
“Most organizations don’t focus on their door security needs until there’s an actual security breach; until there’s an actual missing master key, or an unforced entry or some scenario that has created a liability for the organization,” Larson said. “That’s generally when the first thought of ‘oh what do we do now’ occurs.”
An effective key control program results in operational efficiency (less time finding out which keys exist), cost controls (spend less money on lock hardware and changes), and enhanced security (reduce your liabilities). Keep reading to learn how to revamp your key control program.
(Note: Larson joined HAI Group’s 2021 Virtual Risk Management Conference to discuss key control challenges and solutions specific to the affordable housing industry. You can watch the full session below.)
Key control challenges
One of the biggest challenges to key control is developing a uniform program to match operations across multiple properties. You might have a particular style lock in a newer single-story structure and a completely different style in an older high-rise property. This inconsistency can cause headaches and security mishaps, said Larson. Another challenge is finding commercial-grade lock solutions rather than the residential locks you often find in a retail store. Larson said one of the most overlooked challenges is keeping track of who is carrying what keys and what those keys open.
“Who has the key to get into this unit versus that unit, offices, sheds, and garages,” he said. “Tracking and managing the keys is generally the biggest problem and one that is most misunderstood.”
Not sure if your key control program is up to snub? Ask yourself these questions (being prepared for these events is crucial to an effective key control program):
-
Are you controlling which doors residents and employees have access to? “Do you control which keys are given out, or is it just keys on a board, and we hope they work?” Larson added.
-
If a resident’s key is lost, stolen, or note returned, are you doing anything to prevent that key from being utilized to enter the property or unit without you knowing about it? “When tenants move in and out, is there a process around which keys they’re given and whether or not those keys come back?” Larson said.
-
If an employee is terminated and doesn’t return their master key, do you promptly rekey to prevent unauthorized access? Do you know how much it will cost to replace all of the locks associated with that master key?
-
If a security breach arises, are you able to quickly track down key records? Looking at these records should tell you which locks are affected, which keys are missing, and who had those keys?
-
How fast can you find replacement hardwood and a locksmith or staff member to replace locks? Does your maintenance team have the bandwidth to swap out locks and recut keys during a time-sensitive situation? Larson said he’s heard from several housing organizations that have had difficulty finding a locksmith or scheduling work.
Components of a secure, cost-efficient key control program
1. Restricted keys
A key that can be copied will be copied, Larson said. But you can’t copy a restricted key.
“It truly allows the organization to make sure if they have three keys, those three keys aren’t going to turn into five keys without them knowing about it because it’s not possible,” he said. “You can give restricted keys to a resident, and as long as you get those keys back, you know that you’re still secure because no additional copies could have been created outside of your process.”
Larson suggests employees and residents sign for keys upon receipt. This triggers a sense of responsibility and lets the keyholder know they’re required to return the key(s) upon leaving the organization or moving out of their unit.
“You can then create a ‘separation checklist’ for employees and residents including a list of anything they had access to,” Larson said. “Then you have a nice clean list to be able to check security, and if you get the key back, there’s no need to change locks.”
2. Rekey avenues
Plan for key issues before they arise. Create a document that lists your organization’s process of rekeying and changing locks, including the people and costs involved.
“Have the plan written down and readily accessible to people who need access to the information so they can respond quickly,” Larson said. “There’s going to be a cost involved, but you also need to identify and weigh the risks and associated losses by electing not to rekey.”
Larson suggests developing procedures for different scenarios. For example, if a key is lost over the side of a boat, the chance of a security issue is low. But if a key’s lost or stolen on your property, “now you have a potential security issue,” Larson said.
Procedures should be as simple and clear as possible. The more gray area in your rekey procedures, the more likely they are to be misunderstood or avoided.
“Some agencies start with ten master keys, and if they’re missing more than three of those masters, they’re going to do something about it,” Larson said. “Set parameters around when you’re going to rekey, what are the concerns you have prior to rekey, and when you should take action.”
3. Records management
The importance of tracking access and managing key ownership can’t be overstated. Larson said cloud computing is revolutionizing recordkeeping, leading to the development of web-based programs that allow for real-time key tracking and management. You can instantly find out who has access to every location, unit, and door.
Keeping your key tracking information in one central location makes sharing information during inspections and audits easy. Property managers can also easily determine what keys are available to give to new residents.
Larson said to look for a software solution that can store and track keys, keyholders, and locations. The system should also allow you to grant multiple levels of user rights and capabilities. If you have six properties with a property manager at each location, only allow access to the key information they need for their property. You can also give security, maintenance, and executive management visibility as necessary.
“All of the necessary information is tracked in one program with the ability to parse out who has access to what and who has the responsibility of what,” Larson said. “It really does make for a great records management program.”
4. Policies and procedures
Create simple yet effective policies and procedures for your key control program that are easy to communicate to residents and staff. Define roles and responsibilities that hold keyholders accountable.
Larson said when an employee asks for a key, you shouldn’t hand it out without consideration. Establish an approval-based key issuance process.
“Identify the person and their manager, and take it up the chain to just make sure they are given the right key for their role and responsibility, not just a master key because it’s convenient,” he said.
Conduct periodic audits to ensure compliance. This can be done when residents move in or out, or when employees leave the organization. If you don’t have much turnover, plan for a regular audit at the same time every year. The audit can include reaching out to staff to ensure they still have the keys they’re supposed to have. You can also check that the keys are still functioning or if they’re worn and need to be replaced.
“This helps with peace of mind and liability, so you know you’re still secure,” Larson said. “And if you do rekey, you’re doing it for a cause.”
When to update your locks
As with anything with moving parts, locks do fail over time, Larson said. If your locks aren’t working well or the system no longer fits into your procedures, it might be time to look for a new system.
“But if the locks are still working well, the keys are still secure, and the system matches the function of your property, changing locks just to change them might not be worth the spend,” he said.
Larson said a set timeframe to change locks (e.g., every ten years) isn’t necessary if you have an effective key control program in place.
“With a quality program and the right controls, you would know at the end of 10 years whether you’re secure or if you need to forge ahead with an update,” he added.
Since finding a locksmith can be difficult in an emergency, consider using locks with interchangeable cores. These locks can be switched out by staff in a matter of seconds, Larson said. Interchangeable cores are removed with a control key. Once you remove the core, you can swap it with another door or put in a new core.
“If you’re going down the path of new locks, I recommend the interchangeable core,” Larson said. “It makes maintenance and support easier without having to wait for a locksmith.”
Managing keys and locks for vacant units
As noted earlier, it’s important to have a clear-cut and straightforward procedure. That applies to vacant units as well, even though the process might differ by organization. Larson said most organizations he works with change locks when a unit becomes vacant.
“It’s almost like a new resident has already moved in,” he said. “You’ll have the keys ready to go when the unit turnover is complete.”
Some organizations use a temporary set of locks and keys so contractors can come and go from units during the turnover process. Larson said there’s nothing wrong with this approach as long as any prior access is blocked.
Contact our Risk Control and Consulting team for more resources and answers to your housing organization’s risk-related questions.
Interested in Working With HAI Group? Our Account Services team is ready to assist you.
Includes copyrighted material from a company under the HAI Group family, with its permission. This post is for informational purposes only and is not intended to provide legal advice, and shall not be relied on as such. We strongly recommend consulting with legal counsel or an appropriate subject matter expert.
