Electronic Key Management vs Manual Key Registers: Is It Worth It?
Essential Security Supplies
Is electronic key management worth it? For a handful of low-risk keys on one supervised shift, a well-maintained paper key register can be sufficient. Once multiple shifts, contractors, shared master keys or repeated missing-key incidents are involved, an electronic key cabinet is worth assessing. It can restrict key release to authorised users and record removal and return events. Whether it pays back financially depends on the site's actual administration time, security exposure and ongoing system costs, not just key count.
Is electronic key management worth it? Compare the options
The important distinction is between recording a key handover and controlling who can take the key. An electronic cabinet does not replace sensible operating procedures, but it can make compliance easier to enforce and investigate.
| Decision factor | Manual key register | Electronic key cabinet |
|---|---|---|
| Who takes a key? | Custodian or staff member supervises sign-out | Designated users can be authenticated before release, subject to model and setup |
| Record quality | Depends on legible, timely and complete entries | Issue and return events can be recorded automatically |
| Missing keys | Staff search the register and contact users | Audit reports may identify the last recorded borrower |
| Overdue returns | Manual follow-up | Alerts or exception reports may be available |
| Upfront expense | Low | Cabinet, installation, configuration and training |
| Ongoing effort | Paper checking, filing and reconciliation | Permission reviews, alerts, software and maintenance |
Choose the register where key numbers, movements and risk are low and one accountable person can reliably supervise the process. Consider a cabinet where keys cross shifts or sites, contractors need time-limited access, master keys present a significant exposure, or locating and chasing keys consumes measurable time.
Measure the current key process before buying hardware
Count controlled keys, active users, daily handovers, shifts and external contractors. Identify the keys that open multiple rooms, secure critical equipment or could require expensive rekeying if lost. Record how long staff spend issuing keys, finding late returns, checking a sign-out sheet and compiling incident records. Ask whether every handover is recorded or whether the register is sometimes completed retrospectively.
Set a baseline using a representative two- to four-week period. A defensible business case begins with actual local measurements, not a claim that electronic systems always save money. Record separately which keys would move into a cabinet and which ordinary, low-risk keys could remain on the paper register.
What an electronic key cabinet controls, and what it does not
Depending on model, configuration and credentials, a managed cabinet can hold keys in individually controlled positions, restrict their release and maintain an event history. A key tag or fob identifies each key position. Administrators can assign people or roles to the keys they need and investigate who last checked out a missing set. The FERN360 key management range guide introduces the broader technology.
Do not confuse cabinet accountability with live key tracking. Once a conventional key is released, its actual location is not necessarily known until it is returned. If location tracking is essential, specify that as a separate requirement and verify the equipment supports it.
Audit trails, overdue keys and administrator ownership
An audit record should connect a key identifier, user, issue time and return time. Determine who reviews exceptions, how promptly overdue keys are escalated and who may export reports. Test how the cabinet distinguishes an unreturned key from an authorised extended issue, and whether a supervisor can see an individual key's history without excessive access to other staff records.
Our related guide, Electronic Key Cabinets: Audit Trails and Access Control NZ, covers detailed audit specification, permissions, contractors and power or network failures. Use that article for designing the control regime; use this comparison to decide whether moving away from a paper register is justified.
Calculate the business case using your own assumptions
Illustrative example only, not an ESSL savings claim: Assume a site processes 50 key handovers each week, and manual signing, checking and following up averages 3 minutes per handover. That is 150 minutes, or 2.5 staff hours a week. Across 48 operating weeks the baseline is 120 staff hours. At an assumed internal labour cost of NZ$35 per hour, that represents NZ$4,200 per year of manual process time before considering key-loss incidents.
If a cabinet reduces this work by half, the illustrative gross labour saving is NZ$2,100 a year. It is not a net return: subtract system administration, licensing, maintenance and other recurring costs, and compare the remainder with the installed cost. If a lost master key could trigger lock replacement or rekeying, model the probability and cost separately rather than treating a rare event as a guaranteed annual saving.
Document the measured handover minutes, assumptions, cost owner and approval threshold. Where administration is already efficient and the security risk is modest, the numbers may favour keeping a paper register.
Choose capacity: 32, 64 or 100 keys?
The photographed FERN360 options show why capacity should be specified by controlled key positions rather than building size alone. The FGKM-AS32 is a 32-key option, the FGKM-AM64 is a 64-key option, and the FGKM-AXL100 is a 100-key option. These are capacity references, not a claim that any particular model suits every site.
For a small reception, plant room or single-department key pool, a 32-key cabinet may warrant evaluation. A multi-department building with many shared users may require 64 positions; larger estates may consider 100 or multiple cabinets. Leave sensible room for additional keys, and verify physical dimensions, key bunch clearance, credential support, network configuration and capacity against current manufacturer documents before selecting a model.
New Zealand privacy requirements: staff logs and biometrics
Electronic key issue logs identifying staff are personal information, so the Privacy Act 2020 is relevant to access, security, permitted use and retention. Tell users why events are logged, limit report access to authorised roles and remove records when they are no longer needed for a legitimate purpose.
Some cabinet configurations offer finger vein or facial recognition. In New Zealand the Biometric Processing Privacy Code 2025 is now applicable to relevant biometric processing. Before selecting biometric credentials, assess necessity, effectiveness, proportionality, safeguards and the effects on staff; provide the required notices and explain any available alternative, such as a PIN or card. A non-biometric alternative is a practical specification consideration, not an automatic legal guarantee in every case. Review the Office of the Privacy Commissioner's Code and guidance and set justified retention and disposal practices for templates and event logs.
Users, contractors, power cuts and continuity
Allocate an owner to approve key permissions, remove leavers promptly and set contractor expiry dates. Ask what happens when a network connection drops or power fails, how events are recorded offline, how backup power works and how an emergency key release is authorised and documented. Requirements vary by cabinet model; confirm them in writing rather than assuming every cabinet behaves the same way.
Keep a protected recovery procedure for administrator lockout, failed credentials and emergency access. Specify which people can use that procedure and how the subsequent event is reconciled to the audit trail.
Run a key-specific pilot before rollout
Select a representative group containing an ordinary key, a high-risk or master key, an occasional contractor key and a key commonly used after hours. Include real operators, not only IT or purchasing staff. Check all of the following against agreed acceptance criteria:
- Enrol an authorised staff member, issue the intended key, and verify the logged user and time.
- Return the key and confirm the record closes against the correct identifier.
- Attempt an unauthorised key request and verify that release is denied and recorded as specified.
- Leave a key overdue and test the configured alert and escalation process.
- Temporarily remove contractor permissions and verify the access change takes effect.
- Test the manufacturer's power-loss and emergency access procedures safely.
- Test network outage and recovery where relevant to the proposed model.
- Export an audit report, confirm its accuracy and record who can access it.
Record each result, defects, retests and the named owner. Demonstrate how new staff are enrolled, how lost key incidents are investigated and how an administrator recovers the system without bypassing accountability.
Commissioning and handover documentation
Before acceptance, retain installed model identifiers, configuration, key-to-position schedules, authorised user roles, training records, current operating instructions, emergency access procedure and software or licence dependencies. Confirm installation position, power supply and any network requirements against the manufacturer's documentation. A cabinet that works in a demonstration is not yet proven suitable for every shift or exception case.
Assign responsibility for weekly overdue reports, periodic permission review, backup and recovery procedures, physical maintenance and security incident escalation. Build a review trigger around staff turnover, site expansions, changed master key arrangements and repeated exceptions.
Frequently asked questions
When is a paper key register still enough?
For a small, closely supervised site with few keys, a single custodian and reliable sign-out habits, a paper register may be adequate. Review it if shifts, contractors or missing-key incidents increase.
Does an electronic key cabinet track a key after it leaves?
Not necessarily. A typical cabinet records authorised release and return at the cabinet; it does not locate a key while someone carries it unless separate tracking equipment and services are specified.
What happens to an electronic key cabinet during a power cut?
Behaviour depends on the model, backup power and configuration. Test its documented emergency access procedure, event recording and recovery before handover; do not assume all cabinets release keys without power.
Can a New Zealand workplace use finger vein or facial recognition on key cabinets?
Potentially, but biometric processing must comply with New Zealand's Biometric Processing Privacy Code 2025. Assess necessity and proportionality, provide required staff notices, explain available non-biometric alternatives, and set appropriate security and retention arrangements.
Next step: specify the right key control method
Start with a key list, approximate handovers per week, number of users, shifts, contractors and the consequences of a lost high-security key. Compare the paper process and the cabinet options using the site's own evidence. For model selection, credential options, installation dependencies and a trade specification review, contact Essential Security Supplies. Confirm all proposed features against the exact current FERN360 model documentation before procurement.
