Duplicate Key Controls

Duplicate Key Controls. (a) Duplicate keys are replacement keys for broken sensitive and restrictive keys. Duplicate copies of all sensitive and restrictive keys must be maintained in a dual lock key box and must be properly secured as to limit access to authorized personnel only. The location and the controls surrounding the duplicate key box must be approved by the Commission in the licensee’s System of Internal Controls. (b) One duplicate key control log sheet must be maintained per each sensitive and restricted type key (this requirement also applies to those licensees who maintain their duplicate sensitive and restricted keys in an automated key box). The duplicate key control log will document the current issuance, receipt and inventory of all duplicate sensitive and restricted keys. When keys are removed from the duplicate key box, they must be added to the inventory of the appropriate key box location. The duplicate key control log must contain, but is not limited to, the following: 1. Date key received (month, day and year); 2. Date of issuance (month, day and year); 3. Time of issuance; 4. Key tag/ring number; 5. Number of keys made or destroyed; 6. Key name and description; 7. Signature of employee issuing key; 8. Signature of employee receiving key; 9. Reason for addition or removal of key; 10. Number of keys in beginning inventory; 11. Number of keys added or removed, and 12. Number of keys in ending inventory. (c) An inventory of duplicate keys will be maintained in such quantity that there will always be at least one duplicate key in inventory for each type of sensitive and restricted key. (d) On a quarterly basis, Accounting will conduct an audit of the duplicate key box documentation for completeness and accuracy. If any discrepancies are found they will be investigated and documented. (e) Every licensee’s System of Internal Controls must include procedures for the order and receipt of sensitive and restricted keys. (Adopted: 12/20/2007.)