Audit Objective
Did Eldred Central School District (District) officials properly manage and monitor building access accounts and devices?
Audit Period
July 1, 2024 – November 30, 2025
We extended our audit period to December 17, 2025, to review access activity logs during our fieldwork.
Understanding the Audit Area
Building access controls are essential for enhancing security and enabling school officials to manage and monitor entry points within educational institutions. These systems authenticate a user through devices such as key fobs, keycards, badges, or similar technologies, helping to ensure only authorized individuals can enter school buildings. By limiting access in this way, schools can better safeguard their facilities and maintain a safe and secure environment for students, teachers, staff and visitors.
The District utilizes a building access management system (system) with 252 active building access accounts (accounts), including 196 devices issued to current employees and 56 issued to non-employees, of which 14 are shared devices.1 Each of the District’s three school buildings has a single public point of entry. Employees and staff may also access the buildings through additional secured entry points, which require a badge for entry.
Audit Summary
District officials did not properly manage and monitor building access accounts and devices (badges). As a result, there was a potential risk for unauthorized access to District school buildings, compromising building security and safety for students, teachers, staff and visitors. Specifically, the District had active, but unneeded, accounts with assigned badges in the system:
- 14 District employees had two or more active badges, including four employees who were assigned as many as four active badges, one of these employees, the Superintendent of Schools (Superintendent), was assigned seven active badges at the time of our fieldwork in December 2025.
- Seven non-employee badges including five shared badges that were not tracked or disabled when no longer needed and two active badges assigned without a business need to a Board of Education (Board) member and a retired bus driver.
- District officials could not locate 14 active badges, including 13 duplicate employee badges and one shared badge.
Although District officials had a process for adding accounts in the system for employees and non-employees, no one periodically reviewed active accounts to determine whether they were needed. Furthermore, these issues occurred because District officials did not clearly assign responsibility for managing and monitoring accounts or develop written policies and procedures for issuing and monitoring badges.
This report includes four recommendations that, if implemented, will help District officials improve management and monitoring of building access accounts and badges. District officials generally agreed with our recommendations, and their response is included in Appendix B.
We conducted this audit pursuant to Article V, Section 1 of the State Constitution and the State Comptroller’s authority as set forth in Article 3 of New York State General Municipal Law (GML). Our methodology and standards are included in Appendix C.
The Board of Education has the responsibility to initiate corrective action. A written corrective action plan (CAP) that addresses the findings and recommendations in this report must be prepared and provided to our office within 90 days, pursuant to Section 35 of GML, Section 2116-a (3)(c) of the New York State Education Law and Section 170.12 of the Regulations of the Commissioner of Education. To the extent practicable, implementation of the CAP must begin by the end of the next fiscal year. For more information on preparing and filing your CAP, please refer to our brochure, Responding to an OSC Audit Report, which you received with the draft audit report. The CAP should be posted on the District’s website for public review.
1 A shared account or device is assigned to a user for a specific role or function but not assigned to a specific individual (e.g., vendors or first responders).