Keys and access devices need an owner
Every set of keys issued to a contractor should be recorded, numbered and tied to a named person, and there should be a process for returning them when that person leaves. Ask each provider how they do this. A company with a register and a sign-out process is managing a real risk. A provider who keeps keys loose in a vehicle is not, and the consequences of that fall on your building rather than on them.
Ask also what happens at the end of the arrangement. Keys, cards and fobs should come back within a stated time, and the agreement should say so. Buildings routinely discover after a change of provider that nobody can account for two access cards, which then means a rekey or a reprogramming exercise nobody budgeted for. Settling the return process during the comparison costs nothing and prevents exactly that outcome.
