Warehouse access and keys: who can enter and who can move stock

On Monday morning a batch of cable is found to be missing. Checking shows that seven people hold keys to the warehouse: the storekeeper, the gate guard, the manager, a driver, the cleaner, and a spare left behind by a predecessor. Everyone had the chance and nobody is responsible. Access and key control is not only about keeping thieves out. It makes every entry and every movement of goods the responsibility of a named person and leaves a trail that can be checked.

Start with a permission list

Put "who can enter where and do what" in one table:

• Areas: receiving, finished goods, valuables, hazardous items, offices.
• People: everyone who holds a key, an access card or a code.
• Type of access: may enter, may handle goods, may record, may approve adjustments.

Keep a separate key register showing key number, holder, date issued and number of copies. Physical keys, electronic cards, codes and user rights in 1C or your ERP all belong on the list. Laid out together, they often reveal people with far more access than their job requires.

An invented example: the storekeeper may enter receiving and finished goods and handle stock, but not change system quantities. The accountant may view stock and post entries, but not enter the storage area. The manager approves adjustments but does not handle goods alone. The guard logs entries and holds no key to the storage area. One row per role makes the picture clear.

Separate handling from recording

The most basic principle of internal control is that the person who handles goods should not also record them, and certainly should not approve adjustments.

• Whoever receives and issues goods should not be able to change quantities in the system directly.
• Whoever keeps the books should not enter the storage area alone.
• Whoever approves a stock adjustment should not be the person who proposed it.
• Counts should involve people who are not part of daily custody.

A small company cannot always separate everything. In that case add compensating checks: the manager reviews the adjustment log weekly, another person spot-counts regularly, and every adjustment carries a written reason and a signature.

Day-to-day rules for keys and codes

• Keep the number of keys as low as possible: one master key held by a named person, with one named deputy.
• Copying a key needs written approval and a register entry. Nobody cuts a copy privately.
• Stamp only a number on a key, never the name of the warehouse, so that a lost key does not reveal what it opens.
• Sign for keys at the end-of-shift handover and keep them overnight in a locked key box.
• Change codes regularly, and at once when someone leaves.
• Entry outside working hours needs prior approval and a log entry.
• Drivers, suppliers and contractors do not enter the storage area alone but are accompanied.

Cameras and access systems must comply with local law, including any duty to inform employees. Ask a legal adviser about the details.

Update when people change

Staff changes are when access most often goes wrong. When someone leaves or moves, complete these on the same day:

1. Collect the keys and cards and check them against the key register.
2. Disable the system account or change its rights.
3. If needed, change the padlock or the door code.
4. Update the permission list and tell the departments concerned.
5. If needed, run a handover count with the person.

An invented case: a warehouse has 12 employees, and 3 move or leave during the year. If the steps above are followed each time, each takes perhaps half an hour. If they are skipped, a year later there are three sets of access that nobody owns. (Figures are illustrative.)

Review once a quarter

Name someone outside daily custody to review every quarter: compare the permission list with reality, try the keys and cards, export system user rights and change logs, and look for accounts that should not exist and unusual adjustments. Correct findings on the spot and write them down. File the review record as the starting point for the next one.

In short

Keys and permissions are not a one-time setup but an ongoing routine. UzWarehouse's warehouse audit reviews goods-in and goods-out, locations, documents and access control, and traces count differences back to their cause, with practical recommendations.