Commercial Property Key Management: A Checklist for Landlords

Commercial Property Key Management: A Checklist for Landlords

Key management can look minor right up until a tenant moves out, a vendor needs after-hours access, or no one can say how many copies of a suite key exist.

For a commercial landlord, the goal is not a complicated security program. It is a dependable operating record: know which keys exist, who has them, why they have them, and what should happen when access changes. That record makes tenant handoffs cleaner, gives vendors clearer instructions, and keeps a vacancy from turning into a scavenger hunt.

Use the checklist below to build a process that fits your buildings, lease obligations, and local requirements. If a key or access decision affects legal rights, life-safety systems, or a tenant’s security obligations, confirm the applicable requirements with qualified counsel, your insurer, and the appropriate local authority.

Start with a complete key inventory

Before creating rules, find out what you are managing. Walk the property and list every key, fob, card, remote, and code-controlled access device that the ownership or management team controls.

For each item, record:

• A simple key or credential ID—not the full access instructions on a loose tag
• The property, building, door, gate, suite, room, or equipment it opens
• The access type: metal key, fob, card, remote, key-box key, or other credential
• Whether it is a master, sub-master, common-area, suite, mechanical, mailbox, gate, or emergency-access key
• The number of copies or active credentials known to exist
• The place where unissued copies are stored
• The person responsible for the record

Do not assume the key cabinet tells the whole story. Ask the property manager, maintenance lead, cleaners, security provider, and regular vendors about keys kept in vehicles, tool bags, lockboxes, or old files. A temporary key often becomes an untracked permanent copy.

Set one owner for every key group

Keys get loose when everyone is allowed to issue them and no one is responsible for reconciling them. Assign one person or role to maintain the custody log and approve routine issuance. That person does not need to hand over every key personally, but they should be able to answer who approved access and whether it was returned.

For a small portfolio, this can be the owner or property manager. For a larger property, it may be a site manager with a backup contact. Keep the backup person current, especially before vacations, staff changes, or a management transition.

A good working rule is simple: no key leaves storage without a record, and no return is considered complete until the record is updated.

Use a written handoff for tenants

Tenant keys should be issued as part of a documented possession or move-in handoff, not as a casual favor at the loading dock. Match the handoff to the lease and the space being delivered.

At a minimum, record:

• Tenant business name and suite
• Authorized recipient’s name and contact information
• Date and time issued
• IDs or descriptions of the keys, fobs, cards, remotes, or mailbox keys issued
• Quantity issued for each item
• Any instructions about replacement charges, copying, return, or reporting a loss, subject to the lease
• The recipient’s acknowledgment of receipt

If a tenant wants an additional copy, use the same process. You do not need to make the form heavy, but the request should identify who is receiving access and what is being issued. This is especially useful when the original tenant contact has changed several times over a long lease term.

Give vendors access for a specific job and window

Vendor access is where informal habits create the most confusion. A contractor may need a key to inspect a roof leak, a cleaner may need recurring common-area access, and a technician may need access after tenants have left. Those are different situations and should not all be handled with an open-ended key loan.

Before handing over access, document:

• Vendor company, on-site contact, and phone number
• The work order, service request, or reason for entry
• Areas the vendor needs to enter
• The expected access window and return deadline
• The key or credential ID and quantity issued
• The PigJet or property contact responsible for receiving it back

For recurring vendors, review access on a fixed cadence. A vendor that no longer has an active contract, recurring assignment, or current point of contact should not remain on the active custody list by default.

When possible, pair vendor access with the related maintenance record. A maintenance tracking workflow gives the team one place to see the request, vendor assignment, completion evidence, and any access notes.

Make vacancy and move-out returns a required closeout step

A move-out is the easiest time to lose control of copies. The tenant may return a ring with most—but not all—of the issued keys. A former employee may have a fob. A vendor may still have a temporary key used during turnover work.

Add access recovery to the move-out checklist before the security deposit, final utility review, or turnover file is closed. Compare returned items against the original custody record, then note:

• What was returned and in what quantity
• What is missing, damaged, or no longer active
• Whether the locks, cylinders, codes, fobs, or other credentials need review or change
• Who approved the next action and by when
• The completion date and supporting record

The right response to a missing key depends on the property, access level, lease terms, and local circumstances. Treat it as a decision that needs an owner and a documented next step—not an issue to rediscover when the next tenant takes possession.

For lease-driven deadlines and handoffs, keep the access task alongside the broader lease calendar. Commercial lease renewal tracking can help owners organize the dates and responsibilities that lead into a change of occupancy.

Plan emergency access separately from routine access

Routine key custody and emergency access overlap, but they are not the same thing. A maintenance key issued to a contractor should not become the property’s only emergency plan.

Document who should be contacted first, who has authority to provide access, and which records identify critical areas such as electrical rooms, mechanical rooms, roof access, fire-control spaces, or tenant-controlled areas. Keep contact information current and make sure the people named understand their role.

If the property uses a fire-department key box or similar emergency-access system, confirm its location, contents, and maintenance requirements with the local fire authority. Requirements vary by jurisdiction and building type; OSHA notes that some jurisdictions require key boxes for certain buildings or fire-alarm systems, while others allow the code official to require them when appropriate.[^1]

Keep detailed emergency-access instructions out of broadly shared files. The operating record should tell the right people where the authorized plan lives and who can approve changes.

Keep a simple key custody log

You can start with a spreadsheet, a secure property-management record, or a controlled paper log. The tool matters less than updating it at issue, return, loss, and review.

Here is a simple format:

| Field | What to record | | --- | --- | | Key or credential ID | A unique label for the item or set | | Property and access point | Building, suite, door, gate, room, or equipment | | Access level | Suite, common area, master, mechanical, emergency, or other | | Issued to | Tenant contact, employee, vendor, or manager | | Reason | Move-in, service call, recurring work, inspection, or other purpose | | Date and time out | When custody changed | | Expected return | The due date or end of access window | | Date and time returned | When the item was received or deactivated | | Approved by | The person or role authorizing access | | Notes | Loss report, replacement, condition, or related work order |

Avoid recording key cuts, combinations, alarm codes, or detailed lock instructions in a log that is shared widely. Store sensitive details only where access is limited to the people who need them.

Review the log before it becomes an emergency

A monthly review is a reasonable starting point for many small commercial portfolios. Sort the log for overdue returns, access with no current reason, missing acknowledgments, and tenants or vendors whose contacts have changed.

Ask a few straightforward questions:

• Which keys or credentials are currently out?
• Are any past their expected return date?
• Does each item have a named holder and an approved purpose?
• Did every recent move-out include a documented access review?
• Are recurring vendors still active and still authorized?
• Does the emergency-access contact list still match the people who can act?

The discipline is not about perfect paperwork. It is about reducing avoidable uncertainty when someone needs access—or when someone should no longer have it.

Build key custody into the rest of your operations

Key management works best when it is part of the normal operating flow: move-in, vendor dispatch, maintenance, move-out, and incident follow-up. If a key is lost, a lock is changed, or access is disputed, link the custody entry to the related property record rather than relying on memory or a text thread.

An incident reporting workflow can help organize the facts, contacts, follow-up work, and communication when an access-related event needs attention.

Bring property operations into one place

PigJet helps commercial landlords organize lease obligations, maintenance work, tenant records, and property operations in one place. Request a demo to discuss a workflow that fits your portfolio.

[^1]: Occupational Safety and Health Administration, “Fire Service Features of Buildings and Fire Protection Systems,” accessed October 10, 2026.