A person can answer the phone without holding a key, and hold a key without being the person authorized to decide. A roster should make those differences obvious.
The idea in view · Planning diagram
Three different questions about a contact
- Can be reached
- Can decide
- Can access site
- Current duty accepted
- Fallback identified
- Review recorded
Separate roles and capabilities
The person who answers a phone may not hold keys or be able to attend. Record access capability, decision authority and availability separately. Confirm any responder arrangement rather than assuming that a nearby employee will travel to site.
Handle predictable absences
Document handovers for leave, holidays and shift changes. Have a process for removing departed staff promptly. Ask the roster owner to confirm updates with the monitoring team so two systems do not carry conflicting versions.
Review through safe exercises
Check the contact and acknowledgement path during a planned test. Do not ask anyone to approach a dangerous scene as a demonstration. Record who owns corrections and when the roster was last actually checked.
Review the role under real availability conditions
Ask about leave, travel and the parts of the site the role can access. Do not assume the closest employee is an appropriate responder. Safety, training and local requirements need their own assessment. CFPA’s guidance separates keyholder selection and duties from the mere possession of keys; use it as context for a locally agreed plan.
Keep the public planning worksheet free of personal phone numbers and access details. Maintain the operational directory in its approved restricted system, with a named owner. After an update, confirm that the monitoring team received the current version. Two correct rosters in different systems can still conflict if only one reflects tonight’s duty assignment.
Check authority, access and availability separately
A keyholder roster is useful only when each listed role can perform the duty assigned to it. Holding a key does not establish decision authority, and answering a phone does not establish safe or practical access to the location. Record which role can confirm activity, authorize a response, provide access or arrange another accepted action. Those responsibilities may belong to different people.
Review the locations and periods each role covers. A person authorized for one building may not have access to another, and ordinary working hours may not match the after-hours duty. Keep the roster grounded in the actual accepted arrangement. The organization should assess local requirements and safety responsibilities for physical attendance rather than inferring them from a generic keyholder title.
Reference context: CFPA Europe: Keyholder selections and duties (2024)
Maintain one controlled contact source
Store personal numbers and other necessary details in the approved operational system, with access limited to the relevant roles. A general review sheet can record an alias, duty, review date and restricted reference. Avoid sending complete personal contact lists in ordinary project updates or keeping several uncontrolled versions in different spreadsheets.
Name the owner who updates the record when people join, leave, change role or go on leave. A roster review should confirm the duty with the people or organizations assigned to it, not simply check that the cells are filled. If a role is temporarily replaced, record the effective period and how the change reaches the monitoring team. Temporary substitutions should expire or be reviewed rather than becoming an indefinite hidden arrangement.
Test the decision path with the roster
Use an announced exercise to check the appropriate contact path and acknowledgement. The test should establish that the current role receives the request and understands the duty. It should not create an unnecessary real attendance or emergency call. Record whether the recipient could accept the relevant decision and where a different role was needed.
Review no-answer and access limitations as part of the same process. A roster that works only when the first person answers is incomplete. If a key or access right changes, update the associated procedure and assess whether the fallback still works. Do not assume a successful test months earlier proves current availability. Keep the review evidence proportionate and avoid storing unnecessary personal commentary.
A fictional roster review after a staff departure
A facilities employee leaves the business. Their name remains the primary contact for a yard because they once held the keys. The new duty manager can answer operational questions but has not been assigned physical access. Replacing the phone number alone would preserve an inaccurate duty description.
The roster owner separates the decision and access roles, confirms their acceptance and updates the controlled record. The team tests the revised contact path and records who owns a no-answer case. Access removal for the departing employee is handled through the authorized system process, not merely by deleting a spreadsheet row. The example shows why personnel changes require a duty review as well as administrative editing.
Make the call
Which capability does the role have?
| Situation | Decision to make | What to ask for |
|---|---|---|
| Can answer but cannot attend | Whether another role handles physical access | A separate agreed attendance arrangement |
| Can attend but cannot authorize action | Where the decision comes from | An available decision owner |
| Is away or has left the business | How cover and revocation are handled | An updated controlled roster and acknowledgement |
Before you move on
- Map duties to primary and backup role aliases.
- Maintain real details in the approved restricted directory.
- Confirm changes and run a safe contact test.
A worksheet you can actually use
Start with the blank sheet. Add one row per item, assign an owner and mark anything unresolved as pending. The completed example shows the level of detail to aim for.
Keep completed security plans private. Use aliases; keep passwords, access codes, personal contacts and footage links in your approved systems.
How to fill the worksheet
- Role alias
- Use a role alias in the planning sheet and keep necessary personal details in the approved controlled contact system.
- Decision authority
- State which decisions the role may accept, separating confirmation of activity from authorization of other actions.
- Attendance capability
- Record the actually agreed physical-access or attendance duty and limits; holding a key does not establish every response obligation.
- Coverage window
- Identify the relevant periods and locations, including temporary substitutions or known availability limits that affect the accepted plan.
- Backup
- Confirm a realistic fallback with the appropriate authority and access rather than listing names without accepted duties.
- Review owner
- Assign the person who checks changes, obtains acceptance and communicates the current roster to the monitoring team.
A worked example
Fictional roster: the night duty manager can authorize action but cannot attend. A separately agreed responder holds access, and both responsibilities are visible in the site plan.
| Role alias | Decision authority | Attendance capability | Coverage window | Backup | Review owner |
|---|---|---|---|---|---|
| Duty-A | Site decisions | No attendance | Night rota | Duty-B | Facilities |
Questions readers bring to this task
What else should you know?
How often should the roster be checked?
At role changes and whenever availability changes, with a recurring review suited to the site. The meaningful evidence is a confirmed current assignment and an exercised contact path. This guide does not prescribe a universal review interval or attendance target.
Link to this answer ↗Is a keyholder always expected to attend alone?
Do not assume that. Attendance, safety arrangements and any limits must follow the organization's accepted procedure and local requirements. The roster should identify the agreed duty and authorized response path rather than create an obligation from the fact that someone has a key.
Link to this answer ↗What should the public worksheet contain?
Use role aliases, locations, coverage periods, approval and review references. Keep real personal numbers, access codes and sensitive attendance information in the approved controlled system. A blank template can be shared; the completed operational roster should be treated appropriately.
Link to this answer ↗When should the roster be reviewed?
Use an agreed recurring interval and review promptly after personnel, role, leave, access or site changes. A scheduled review does not justify leaving a known obsolete contact active. Confirm that assigned people or organizations accept the current duty.
Link to this answer ↗Notes & sources
Attendance, safety and legal obligations require local arrangements. The public worksheet should never contain keys, codes or personal contact details.
Reviewed October 27, 2026. The examples and worksheets are planning aids, not customer results or a statement of contracted service.
- MonitorCrew: service scope and pricing factors
Provider description of staffing, hours, handovers and scope. No comparative testing is claimed.
- CFPA Europe: Keyholder selections and duties (2024)
Role selection and response planning context. Local requirements and safety arrangements take precedence.