A cleaner key access policy formally controls who receives keys, fobs and alarm codes, how each handover is logged, and how access gets revoked the moment a contract or staff member changes. The facilities manager or an equivalent named custodian holds responsibility for audits and sign-off. That accountability has to connect directly to your workplace health and safety duties and client confidentiality obligations, not sit as a standalone form nobody reads.
TL;DR:
- The key register and audit trail are the most critical components for preventing security breaches and must log every key, fob, or code transfer with signatures and secure storage.
- Access must be revoked immediately and all keys or codes reissued or changed upon staff or contract termination to avoid lingering vulnerabilities.
- Only a named, responsible custodian should oversee key custody, audit scheduling, and incident sign-offs to ensure accountability and compliance.
- Using electronic fobs or smart codes with unique, time-limited access makes audits easier and increases traceability compared to physical keys.
- Regular scheduled and unannounced audits, combined with documented handovers and incident reports, significantly reduce the risk of unauthorized access or key mismanagement.
Table of Contents
- What must a cleaner key access policy include?
- How do you set up cleaner key custody and handover?
- Keys, fobs, codes or lockboxes: what should you use?
- Do screening and supervision actually reduce risk?
- What belongs in the service agreement and records?
- What do you do after a lost key or a breach?
- Building a copy-ready key access policy template
- Publisher perspective: why documented access is a service quality issue
- Let 360 Cleaning Solutions handle your access control
- Sources
- FAQ
What must a cleaner key access policy include?
A policy that only lists rules without a paper trail is decoration, not protection. Every functional key access management policy needs five working parts.
- Key register: unique IDs or tags for every key, fob and code, tied to a name and a date.
- Named authorised holders: a defined list of who holds access and to which areas specifically, not “the cleaning team” as a blanket entry.
- Restricted area map: server rooms, safes, medical record stores and staff-only zones marked as off-limits regardless of general site access.
- Alarm code policy: unique codes wherever the system allows, with a documented change process when codes must be shared.
- Handover and lock-up checklist: the physical steps a cleaner follows on arrival and departure, including alarm arming.
The registry and audit trail matter more than any other line item. UNSW’s key management procedure works because every request is logged, every collection carries a signature, and every key sits in secure storage between uses, with lost-key reporting triggering possible cost recovery.
Pro Tip: Store alarm codes and access instructions in an encrypted field-management app rather than writing them on a key tag. A lost key with a code attached is a lost site.
How do you set up cleaner key custody and handover?
Building the workflow in order stops gaps from opening between hiring, issuing access and revoking it, as detailed in this hotel check-in process workflow.
- Approve the candidate first. Confirm identity documents and a national police check before any key leaves the office. This aligns with the security and privacy outcomes set out in CPPCLO3005, the nationally recognised unit covering personal and property security on cleaning sites.
- Complete a key custody form. Record the date, key or fob ID, authorised areas, and a signature from both the cleaner and the issuing manager.
- Confirm arrival and completion. A supervisor checks the cleaner has arrived, followed alarm arming or disarming steps correctly, and finished the scheduled work.
- Process the return. Log the key back into the register on collection, and revoke access immediately if the contract or the individual’s employment ends.
Verbal handovers create the most confusion in this entire process. If it is not written down and signed, it did not happen, and you have no way to prove who held which key on which night.
Keys, fobs, codes or lockboxes: what should you use?
Physical keys, electronic fobs, smart codes and lockboxes each solve access differently, and each demands its own control layer.
- Physical keys are cheap and simple but offer no remote deactivation. A strict key register with tagged, numbered keys is the only thing standing between a lost key and a full re-key of the premises.
- Fobs and cards deactivate instantly and generate a usage log, which makes audits far faster. The trade-off is a formal lost-fob procedure, because a stolen card without one is a silent access point.
- Smart codes work well when they are unique per user and time-limited, since that combination makes each entry traceable to a person.
- Lockboxes suit smaller or lower-risk sites but only if the code rotates on a fixed schedule rather than staying static for years.
Whatever combination you run, the operating rules stay constant: revoke access immediately on any staff change, change shared codes the same day, and run audits on a set schedule. Access control SOPs for Australian workplaces recommend tying these controls to broader WHS and visitor management systems rather than treating cleaner access as a separate problem.
Do screening and supervision actually reduce risk?
Screening catches problems before they start, but it is only the first layer. Supervision and audits catch the problems screening misses, because circumstances and people both change after the induction paperwork is signed.
- National police checks and verified references form the non-negotiable baseline before any key is issued.
- Site induction should cover access boundaries, client privacy expectations and exact alarm handling steps, not a generic cleaning briefing.
- Supervisors need a schedule of both announced audits and random spot checks, because predictable audits only catch predictable problems.
- Training and competency should be documented against a formal benchmark such as CPPCLO3005, which specifies outcomes for confirming and applying property security procedures on-site.
Key audits work best when they are both scheduled, at least annually, and unannounced, with every outcome recorded against the named custodian who signs off on any remediation. A background-check routine that is easy to repeat matters more than an impressive one-off screening, which is why a simple, repeatable hiring process beats an ad hoc one every time.
What belongs in the service agreement and records?
The contract is where key access policy stops being an internal document and becomes enforceable. A well-drafted service agreement needs an explicit access and key custody clause, not a vague reference to “standard security procedures.”
- State exactly which party holds custody of keys between cleans and how handovers are logged.
- Request certificates of currency for public liability and any relevant insurance before issuing access, not after.
- Define how lost-key or re-keying costs are allocated and recovered, including whether the cleaning provider or the client bears the expense.
- Retain key registers, signed handover forms and incident reports for a set period, so an audit or dispute has documentation to draw on.
Staff policies that align with employment contracts reduce legal exposure precisely because vague clauses on keys, alarms and contractor status are where most disputes start.
What do you do after a lost key or a breach?
Speed matters more than process perfection in the first hour after an incident.
- Revoke access immediately. Deactivate the fob or code in question, and consider re-keying the affected areas the same day if a physical key is unaccounted for.
- Notify the right parties. That may mean police, your security monitoring provider, or your insurer, depending on the severity and whether anything was accessed.
- Document everything. Record the incident, the costs involved, and every remedial step taken, because this record is what an insurer or auditor will ask for later.
- Review the policy. Feed the incident back into your next scheduled audit and adjust the policy if it exposed a gap.
Formal compliance records covering access arrangements are what separate a business that can prove due diligence from one that is guessing after the fact.
Building a copy-ready key access policy template
A working template needs six sections: purpose and scope, key register fields, authorised holder list, alarm code procedure, incident response steps, and audit schedule. Each section should state who is responsible, not just what should happen.
Your key custody form needs, at minimum: date, key or fob ID, cleaner’s name, authorised areas, alarm steps confirmed, and two signatures. Store these forms and the master key register somewhere access-controlled and backed up, whether that’s a locked filing cabinet with restricted access or an encrypted digital system your onboarding process already references.
| Element | Minimum standard |
|---|---|
| Audit frequency | At least annual, plus random spot checks |
| Custodian | One named manager, not a shared role |
| Record retention | Key register, handover forms, incident reports kept for audit |
| Revocation trigger | Any staff or contract change, same day |
Publisher perspective: why documented access is a service quality issue
Most operators treat key access policy as paperwork you write once and file. We treat it as the backbone of reliable after-hours cleaning across the East Melbourne offices, childcare centres and clinics we service. A written handover with a signature does something a verbal one never can: it gives the client proof of exactly who held access, when, and for what.
That traceability is what lets a facilities manager sleep at night when cleaning happens after their own staff have gone home. Documented audits and consistent communication reduce a client’s risk far more than any single lock or code ever will, because the paper trail is what catches drift before it becomes a breach.
— Jonathan
Let 360 Cleaning Solutions handle your access control
A cleaning company that runs after-hours cleaning without lock-in contracts allows your key access policy to stay under your control rather than tied to a multi-year agreement you can’t easily exit if something goes wrong.
They confirm police checks and current insurance before any key or code changes hands, and conduct a site assessment to map which areas the cleaning team can access and which stay off-limits. That’s the same accountable handover process this article has walked through, applied to your site rather than left as a template on a shelf. If you run an office, medical clinic, or need a carpet steam clean scheduled around access hours you control, request a site assessment and quote through our office cleaning page and we’ll confirm the access arrangement in writing before the first clean.
Sources
Keep these references alongside your policy, not just in a bookmark folder. CPPCLO3005 sets the national training benchmark for site security procedures. Sprintlaw’s staff policy guidance and compliance records article cover legal risk. UNSW’s key management procedure offers a practical operational template worth adapting.
- CPPCLO3005 – Confirm and apply personal and property security procedures when cleaning a work site
- Staff policies for cleaning businesses | Sprintlaw Australia
- Key Management procedure | UNSW Estate and Facilities
FAQ
Who should hold custody responsibility for cleaner keys?
A single named custodian, usually the facilities manager, should own the key register, audit schedule and sign-off on any remediation after an incident.
How often should key audits happen?
Run regular scheduled audits plus random spot checks, and record every outcome against the responsible custodian.
What happens to access when a cleaning contract ends?
Access must be revoked immediately, keys returned and logged, and any shared alarm codes changed the same day the contract or staff member leaves.
Does 360 Cleaning Solutions confirm police checks before issuing access?
Yes, 360 Cleaning Solutions confirms police checks and current insurance before any key, fob or alarm code is issued to a cleaner on your site.
What should a key custody form record?
At minimum, it needs the date, key or fob ID, cleaner’s name, authorised areas, confirmation of alarm steps, and signatures from both parties.