Product Overview

Summary: This Restricted Key Systems Safe Operating Procedure sets out a clear, defensible framework for controlling physical access to buildings, plant, and critical assets. It helps Australian businesses manage security risks, protect workers and property, and demonstrate due diligence in line with WHS and security obligations.

Restricted key systems are a critical control for managing who can access work areas, hazardous zones, plant rooms, medications, records, and other sensitive spaces. Poorly managed keys expose organisations to theft, sabotage, unauthorised access to hazardous substances or equipment, and increased risk of harm to workers, visitors, and the public. This Safe Operating Procedure provides a structured, step-by-step method for planning, issuing, tracking, and reviewing restricted keys so that only authorised people can access the right areas at the right time.

Developed for the Australian context, this SOP helps you integrate restricted key management into your broader WHS, security, and risk management systems. It covers the full lifecycle of restricted keys—from system design and engagement with licensed locksmiths, through authorisation workflows and recordkeeping, to lost key response and periodic audits. By implementing this procedure, organisations can reduce the likelihood and consequences of security breaches, demonstrate compliance with duty of care obligations, and give workers confidence that their workplace is secure and well managed.

Key Benefits

• Strengthen physical security controls around hazardous areas, critical infrastructure, and sensitive information.
• Ensure only authorised and competent personnel can access high-risk plant, chemicals, medications, and restricted work zones.
• Reduce the risk of theft, vandalism, sabotage, and unauthorised after-hours access to workplaces.
• Streamline key issuing, return, and auditing processes with clear documentation and accountability.
• Support compliance with WHS duties, privacy requirements, and insurance conditions through robust access control records.

Who is this for?

• Business Owners and Directors
• Facility Managers
• WHS Managers and Advisors
• Security Managers
• Office and Practice Managers
• Site Supervisors
• School and Campus Administrators
• Aged Care and Healthcare Managers
• Strata and Property Managers
• Local Government Asset Managers

Hazards Addressed

• Unauthorised access to hazardous plant and machinery
• Unauthorised access to chemicals, medications, or restricted substances
• Security breaches leading to theft, vandalism, or sabotage
• Violence and aggression arising from uncontrolled public access to staff-only areas
• Exposure of confidential or sensitive information due to poor physical access control
• After-hours lone worker risks due to uncontrolled key distribution
• Emergency response delays caused by unclear access arrangements to critical areas

Included Sections

• 1.0 Purpose and Scope
• 2.0 Definitions (Restricted Key, Master Key, Key Holder, Access Zone, Locksmith)
• 3.0 Roles and Responsibilities
• 4.0 Overview of Restricted Key System Design and Hierarchy
• 5.0 Authorisation and Approval for Key Issuing
• 6.0 Key Issuing, Handover and Induction Process
• 7.0 Key Holder Responsibilities and Conditions of Use
• 8.0 Key Register, Recordkeeping and Data Protection
• 9.0 Storage, Transport and Security of Keys
• 10.0 Managing Lost, Stolen or Damaged Keys
• 11.0 Access Changes, Revocation and End-of-Employment Procedures
• 12.0 Integration with WHS, Emergency and Security Procedures
• 13.0 Audit, Inspection and Compliance Monitoring
• 14.0 Training, Communication and Competency Requirements
• 15.0 Incident Reporting, Investigation and Corrective Actions
• 16.0 Review, Continuous Improvement and Document Control

Legislation & References

• Work Health and Safety Act 2011 (Cth) and harmonised state and territory WHS Acts
• Work Health and Safety Regulations 2011 and equivalent state and territory regulations
• Safe Work Australia – Managing the Work Environment and Facilities Code of Practice
• AS/NZS ISO 31000:2018 Risk management – Guidelines
• AS 3745:2010 Planning for emergencies in facilities
• AS 4485.1–2: Security for healthcare facilities (as guidance for access control principles)
• Privacy Act 1988 (Cth) and Australian Privacy Principles (for physical protection of personal information)