From a Ring of Keys to a Real Audit Trail
A multi-attorney practice had no way to know who came and went after hours, and a departing employee's key was never collected. Here's how we replaced physical keys with badge-based access control.
This small professional services office had grown from a couple of attorneys to a multi-attorney practice sharing a suite in an office building, and its physical security had never caught up. Every staff member carried a key to the front door and, in most cases, a second key to the file room where client records were stored. It worked fine when the firm was small enough that everyone knew who had a key and why. It stopped working once the roster grew and people started coming and going - new hires, contractors, part-time staff, and eventually a departing employee whose key was never collected.
What we found
When we did the assessment, nobody at the firm could say with confidence how many keys existed for the front door or the file room, or who currently held them. The building's own entry system was shared with the landlord and other tenants, so even the front door of the building offered no way to tell which individual came through it. Internally, the firm had no log of who entered the office or the file room, at what time, or on what day. When we asked about the employee who had left several months earlier, nobody was fully sure whether that person's key had been returned, cut into a new copy, or simply lost.
Why this was a problem
A physical key is not accountability - it's just a way through a door. It can be copied without anyone's knowledge, it can't be limited to certain hours or certain doors, and it can't be revoked remotely. The only way to truly secure the office after any uncertainty about a key is to re-key every affected lock, which is disruptive, and firms in this situation often skip it or delay it because of the hassle. For a law office holding privileged client files, that gap is more than an inconvenience - it's a real question about who has had access to confidential records and when, with no way to answer it.
What we put in its place
We installed a badge and fob-based access control system on the office's exterior entry and the file room door, replacing the physical keys entirely. Every staff member was issued a credential tied to their identity, with permissions set per door and per schedule - so an associate might have access to the main office during business hours, while only partners have access to the file room, and cleaning staff have a narrow after-hours window limited to common areas. Every entry is logged automatically, giving the firm a real audit trail of who accessed which door and when.
The biggest change is what happens when someone leaves the firm now. Instead of re-keying locks and hoping every copy of the old key gets accounted for, a departing employee's credential is deactivated instantly in the system. There's nothing to collect, no lock to swap, and no lingering uncertainty about who might still be able to get in. The firm also no longer depends on the landlord's shared building entry for any meaningful accountability - the doors that matter are controlled and logged by a system the firm actually owns.