Key, alarm code and safe access log for a restaurant: who has what, and what to change when someone leaves

Ask a small restaurant owner how many back-door keys exist and you'll usually get a guess: the opener's set, the one a former opener never returned, the office spare, the landlord's, the cleaning company's. The alarm code hasn't changed since installation, and several former employees know the safe combination.

None of that matters until something goes missing. Then you need to know, quickly, who could have got in.

This post is a ready-to-use key and access log: an inventory, a matrix of who should have what, logs for keys, alarm codes and the safe, a lost-key report and a quarterly audit. Our post on promoting your first shift lead says to keep a key log when you hand over keys; this is that log, filled out.

Step 1: the access inventory

Walk the building and list everything that controls access, including the things that aren't keys.

Count the copies that exist, not the ones you think are in use. If you don't know, rekey (Step 5).

Step 2: the access matrix by role

Decide who should have each kind of access before you look at who actually does. Our default for a small café or restaurant:

Two principles behind it:

• Fewest people for the most sensitive things. The safe combination belongs to the people who count and deposit cash. Our cash handling post covers that routine.
• Everyone gets their own code or login. A shared alarm code tells you the alarm was turned off. A personal code tells you who turned it off.

Step 3: the key issue and return log

Number every key (stamped, engraved or a numbered tag), then log every key that leaves the office.

• One line per key, not per person. Three keys, three lines.
• Signed going out, initialed coming back by the manager who receives it.
• Spares are on the log too, issued to "Office spare", so you can see the spare is still in the drawer.

Step 4: the alarm code and safe logs

Never write a code or combination in any log. The log records who holds a code and when it changed. The codes themselves stay with the alarm company and the owner.

Alarm code holders

Most alarm panels give each code a user number. Ask your alarm company whether it can report which user armed and disarmed the system; that's why personal codes are worth the setup.

Safe combination changes

Keep this page in the owner's file, not on the office wall.

Step 5: when to collect, change or rekey

Most access problems come from not acting on the day something changes.

A locksmith can usually rekey a lock (so old keys stop working) rather than replace it; ask which applies to your doors.

For the rest of a departure (final pay, the conversation, the schedule), see letting someone go, done right (coming Nov 10). For logins, Wi-Fi and shared accounts, see passwords, shared tablets and staff accounts (coming Nov 15). This log is the physical half of the same checklist.

Step 6: the lost-key report

Step 7: the quarterly access audit

Once a quarter, the owner or GM checks:

• Every key on the log is returned or with a current employee who still needs it. Look at the spares in person.
• The alarm company's current user list matches the people who should have codes. Keypad codes too.
• Everyone who knows the safe combination still needs it. If not, change it.
• POS manager overrides match the people in manager roles.
• The cleaning crew and any vendor with access are still current, with their own codes.
• The closing checklist still includes "alarm set" and "doors checked" (see checklists staff will actually follow).
• Anything that came up has a fix and a date in the manager shift log.

Where Mays fits

Mays doesn't track keys, alarm codes or safe combinations. Never put a code or combination in a chat message, a shared article or a form. Mays helps with the routine around them:

• App access goes with the job. When someone leaves, deactivate them under Locations & Users → Users. They can't sign in on the web, in the app or with their PIN on a shared kiosk, and their hours and history stay. See Deactivating team members.
• The key log as a form. Under Tasks → Types, build a Key issue and return form: an Employee field, Text for the key number, Single choice for Issued or Returned, a Date / time and a Signature. Submissions land in Task Data, and Export CSV gives you the log by date range. See Building custom forms and Task Data.
• The audit on the calendar. Make the Step 7 list a checklist template with a Quarterly frequency, assigned to the GM. See Scheduling and assigning checklists.
• A lost key or one not returned. Post it in the Logbook under Incidents or Staff, with Needs follow-up. See The manager logbook.

What Mays doesn't do: there's no key inventory or list of who holds which key, and it doesn't connect to alarm panels, keypads or safes. Deactivating someone in Mays changes nothing outside Mays. Each form submission is a separate entry, so matching returns to issues is up to you; keep the paper or spreadsheet log as the master list.

Know who can get in

Number the keys, give everyone their own code, write down every change the day it happens, and check the list against your team once a quarter.

Start your free trial: 30 days, every module, no card needed. Or book a walkthrough and we'll set up the key form and the quarterly audit with you.