In an audit, it was discovered that the employee only gave the client 1 key when he opened the box last year. That employee is no longer with the bank. The contract states on it, one key issued but of course we do not know why. What should we do with the spare key? I will write it up in the audit of course but am at a loss as to what should be done with the key. My thought is to destroy under dual control and notate on the card that the box was audited. This branch is open only by appointment and drive through. Thank you.

You need to be talking to your legal counsel. If this customer makes a claim that something is missing, your liability could be substantial.