Our internal auditor suggested that we add the time of entry onto our signature cards. Do we also need to add the time of exit? Does the customer need to sign when they enter as well as when they exit?

This is all a matter of your bank's procedures, however, if you're looking for best practices, and liability limitation, then I would recommend -
Yes, the customer ALWAYS signs when accessing their case (how else is their signature verified to the contract?), and you hit the access ticket with a date/time stamp.
Yes, the time of exit should always be noted, and initialed by the bank employee who cleared the viewing booth and assisted the customer with returning their case to the vault. Having the customer sign is also a good idea.

I would re-iterate to anyone who has access - that David McGuinn's Safe Deposit Box manuals are a pretty invaluable tool and if BOL ever does a webcast with him, I would certainly sign up for it if your bank has safe deposit boxes.

I agree with R Banker's suggestions.

It's certainly a "best practice," but there are a lot of "best practices" that can be implemented in safe deposit operations. A good program is like a spider's web, a single strand is never the key to success.

The questions are 1) what other procedures do you already have and 2) how much "value added" is on the table? For example, if your facility has more than one coupon booth and you note which coupon booth the renter used, then the access times could be of more value in the event of a "mysterious dissappearance." On the other hand, if you have no coupon booth and only one customer is allowed in the vault at the time, then their potential value is pretty limited.

Auditors should be able to give reasons in support of recommendations that cost justify their adoption.