Overview
A record of keys and combinations issued to an office associate is required to be maintained by the Lead Teller and Client Experience Manager (CXM/CXMII). When the door has a combination lock only, dual control must be maintained by splitting the combination into two parts so that no one associate has the complete combination. Where dual control is mandatory, no single associate should ever have access or knowledge to both the keys and/or combinations with the exception for authorized single control vault custodians.
Key and combination assignments are recorded on a Key/Combination Distribution List for each associate and vendors. This is an ongoing record; however, a new Key / Combination Distribution List may need to be created at the beginning of each calendar year based on usage. Contact your Internal Control Specialist (ICS) team member for guidance. If a new form is created, issuance dates must match the original date of issue. Records must be kept 2 years.
Dual associates will indicate on the appropriate Entrance Log the removal and/or return of any keys or combinations to the Dual Control Key Box. If the Key Box is not located in the Vault, a separate log may be used.
Associates are required to secure at all times any keys and combinations assigned to them. This includes the inability to allow anyone other than themselves to have access to their assigned keys and/or combinations.
Dual control is a required security procedure and is defined as requiring 2 associates to carry-out a task together.
Compromise is when an associate is assigned 2 key/combinations to a Dual Control device/location or an associate gains access to another key/combination to a dual or single (not assigned to the associate) control device/location. If Compromise occurs, contact your ICS.
If requested by General Services to provide a key and/or combination to any approved vendor for office maintenance, the Lead Teller and/or CXM/CXMII is responsible for proper recording of this assignment.
Dual Control Key Box
All unassigned keys and combinations are housed in the office’s dual control key box. The expectation is for the key box to be maintained in a neat and orderly fashion. Returned keys must be secured in the box timely and placed on the correct tag. Returned combinations must be secured in the correct envelope with date and dual associate initials. Your Internal Control Specialist (ICS) team member may inspect the Dual Control Key box at any time to review its condition.
Master Key & Combination List
Each office will maintain a Master Key and Combo list. Any changes to this list must be approved by your Internal Control Specialist (ICS). Each office will maintain a binder containing Key/Combination Distribution List for each associate/vendor. These records are for the associates/vendors who receive permanent or temporary assigned keys and/or combinations.
Key Distribution
Acknowledgment
Each person assigned keys/combinations will be required to acknowledge their understanding of key/combination responsibilities. An acknowledgment signature is required each time a new Key/Combination Distribution List is established. After the acknowledgment has been read, obtain the recipient’s signature.
NOTE: If an associate has a name change, a new Key/Combination Distribution List is required to be completed and signed.
Complete a Key/Combination Distribution list for each associate/vendor by following the procedures listed below. The following information at the top of the original form can be completed electronically, however you must have an original signature once completed:
- Office Name
- Print Name
- Title or Vendor Company Vendor
Assigned Keys
When assigning keys to an associate/vendor, complete the distribution list as follows:
- Key Tag #: Enter the key tag number assigned to the key using the Master Key/Combination Distribution List
- Description: Enter the description of key access using the Master Key/Combination Distribution List (use two lines if necessary, write clearly and legibly)
-
Date Issued: Enter the date issued to associate (MM/DD/YY)
- Existing associates use the date you gave the keys/combo in old key /combo log to them.
- New associates write the date you handed them the key.
- Initials for Receiving: Obtain initials (first initial, full last name). Initialing the form, confirms device description (as listed on the Master Key/Combination Distribution List) access permissions.
Returning/Termination of Keys
When keys are returned by the associate/vendor, complete the Key/Combination Distribution LIst on the issuing line as follows:
- Date Returned: Enter the date the key is being returned which equals date of access termination (MM/DD/YY)
- Sign for Returning: Obtain first initial, full last name
-
Indicate What Happened with the Key
-
Disposition Code
- K = Dual Control Key Box: Follow procedures for “Returning Key to the Office Dual Control Key Box.”
- D = Drop+Go
- R = Reassigned: key is being reassigned to another individual.
- L = Lost
-
Note: If the key is re-assigned, complete a new entry on the reassigned associate’s Key/Combination Distribution List following the steps above.
- If the Key/Combination Distribution List is full, move that list to Inactive and start a new Key/Combination Distribution list for the associate. Be sure to add the existing key/combinations that associate already has.
- If the key is lost, it may require notification to Retail Support, depending on the access point.
-
Disposition Code
Absence of Key Holder at Return
If the individual who was assigned the keys fails to sign the Key/Combination Distribution List at the time of separation/transfer, two associates must sign indicating the keys were returned.
Building Keys
Office should only have two outside door keys that are assigned to two on-call associates. Key assignments must be documented on the Key/Combination Distribution List following the steps above. These keys are not to be used for building entry unless the automatic door lock or key card pad is out of service or the building is out of power.
Dual Control Short Term Key Use
If it is required for a key to be used under dual control for a short-term access to a location and/or device (for example: audit, Capital City Bank Safe Deposit Box, removing or adding cash to a drawer), these short-term uses are logged on the appropriate Entrance Log for that specific day.
Logging Short Term Key Use
The dual control associates will indicate on the appropriate Entrance Log the removal of the key from the Dual Control Key Box or Dual Control Area. If the Key Box is not located in the Vault, a separate log may be used.
- Place an X in the column indicating Dual Control Key Box or Other.
- The Dual Control associates will sign in the column Associate 1 and Associate 2.
The comments field is to be completed specifying which number key tag is being removed.
Returning Keys to the Dual Control Key Box
Any keys returned MUST be secured in the Dual Control Key Box in a timely manner after being returned. Dual associates will indicate on the appropriate Entrance Log the return of any keys or combinations to the Dual Control Key Box. If the Key Box is not located in the Vault, a separate log may be used.
- Place an X in the column indicating Dual Control Key Box or Other.
- The Dual Control associates will sign in the column Associate 1 and Associate 2.
- The comments field is to be completed specifying which number key tag is being removed.
If it is required for an associate to temporarily be assigned combinations, these assignments must be logged on the Key/Combination Distribution List following procedures referenced above.
Lost Device Keys
Retail Support must be contacted when an office determines a key has been lost. Retail Support determines the resolution and advises the office accordingly.
Key Change
If a key is replaced or updated, it requires documenting the change on the Key/Combination Distribution List by indicating the date and reason for replacement/update or a new key log can be entered on the list.
All associates/vendors being assigned this new key are required to sign the Key/Combination Distribution List indicating the date received after the date of change.
Combination Distribution
Acknowledgment
Each person assigned combinations will be required to acknowledge their understanding of combination responsibilities. An acknowledgment signature is required each time a new Key/Combination Distribution List is established. After the acknowledgment has been read, obtain the recipient’s signature.
NOTE: If an associate has a name change, a new Key/Combination Distribution List is required to be completed and signed.
Assigning Combinations
- Env#: Enter the envelope number assigned to the combo using the Master Key/Combination Distribution List
- Description: Enter the description of combo access using the Master Key/Combination Distribution List (use two lines if necessary, write clearly and legibly).
- Date Issued: Enter the date issued to associate (MM/DD/YY)
- Sign for Receiving: Obtain the first initial, full last name
- Date Access Terminated: Enter the date the combination/code(s) is being returned which equals date of access termination (MM/DD/YY)
- Comments: enter reason for lock combination change with date of change (MM/DD/YY)
Note: Teller Station Coin Locker combos are not required to be kept in the dual control key box. This access code/combination may be kept in the individual teller cash drawer. Each associate will be required to change the current code/combo at time of assignment. Associates will print new access numbers legibly on notecard and place in designated envelope kept within the cash drawer. By signing the Key/Combination Distribution List, the associate acknowledges access (if applicable) by way of teller drawer assignment. Your Internal Control Specialist (ICS) team member may, at any time, ask for verification that the correct combo is in the teller drawer.
Absence of Combination Holder
If the individual who was assigned the combination fails to sign the Key/Combination Distribution List at the time of separation/transfer, two associates must sign indicating the combo was either returned in an envelope or was not returned.
Universal Locks
Universal Lock combination assignments must be logged on the Key/Combination Distribution List. When an associate leaves employment, the combination may be reassigned. Should an associate transfer, access may remain based on office needs, or it may be required to be changed.
Returning Combinations to the Dual Control Key Box
Any combinations returned MUST be secured in the Dual Control Key Box in a timely manner after being returned. Dual associates will indicate on the appropriate Entrance Log the return of any keys or combinations to the Dual Control Key Box. If the Key Box is not located in the Vault, a separate log may be used.
- Place an X in the column indicating Dual Control Key Box or Other.
- The Dual Control associates will sign in the column Associate 1 and Associate 2.
- The comments field is to be completed specifying which combination envelope was returned.
If it is required for an associate to temporarily be assigned combinations, these assignments must be logged on the Key/Combination Distribution List following procedures referenced above.
Lost or Compromised Combination
When an office suspects that a combination requires updating on a device (for example: coin locker, vault, cash safe) due to compromise or loss, the request is to be reported to your Internal Control Specialist (ICS) and General Services via Landport.
When reporting, provide a detailed description of the location and devise for which the combination requires updating along with a reason for the update. General Services will confer with the Retail Support to determine if changing the combination is necessary. If deemed necessary, a vendor will be scheduled to perform this function. The office will be notified accordingly.
Combination Change
If a Universal combination is replaced or updated, it requires documenting the change on the Key/Combination Distribution List by indicating date and reason for replacement/update.
All associates/vendors being assigned this new combination are required to sign the Key/Combination Distribution List indicating the date received after the date of change.
Saturday ONLY
When a drawer and keys have been secured in the Drop+Go for Saturday use, completing the Key and Combination Distribution List is not required.
NOTE: This procedure assumes that the drawer and keys have already been removed under dual control from the vault and placed in the Drop+Go with appropriate documentation.
Returning Keys and Drawer to Drop+ Go
When the Saturday associate(s) have balanced, the keys and teller drawer(s) must be returned to the Drop+Go under dual control. Log the entry on the Drop+Go form. Follow the procedures above for returning the keys on the Key and Combination Distribution List. Use the Disposition Code of D.
NOTE: On the Monday or Tuesday (after a holiday) when the Saturday keys and drawer(s) are removed from the Night Drop under dual control, log the drawer removal on the Drop+Go Log Form. The drawer and keys must be returned within a reasonable time to the vault/key box under dual control with appropriate documentation.
For Emergency Use ONLY
For emergency use only, a spare set of keys to the dual control key box may be kept in the Night Depository/Drop+Go receptacle in a security/sealed safety envelope. Should these keys ever be removed, removal must be documented on the Drop+Go log per procedure with the requirement for these keys to be re-secured in a new security/sealed envelope and placed back in the Night Drop (Drop+Go) receptacle in a timely manner.
Note the following:
- These envelopes should ONLY be opened to use in the event you need to access the Dual Control Key Box and do not have associates in the office with offsetting keys.
- It is required to document on the Night Drop (Drop+Go) Log if the office removes one of the envelopes by checking the “Other-Explain” box and noting that a Dual Control Key was removed.
- You will also document on the Night Drop (Drop+Go) Log when the envelope with key is returned in the same method above.
- Document entering the Dual Control Key Box on the appropriate Entrance Log as usual.
- It is imperative associates remain under dual control when accessing and using the Night Drop (Drop+Go) Dual Control Key Box keys and return keys immediately after use.
- The Night Drop (Drop+Go) Dual Control Key Box keys should never be kept out all day and then returned to the Night Drop (Drop+Go) at the end of the day.
- The white, one-time use envelopes tear when opening and must be replaced with a new white locking envelope after opening.
- To obtain additional white dual control locking envelopes, email _General Services with your request.
Fill out all applicable areas of the below envelope.
