Audit Objective 

Determine whether the Erie 2-Chautauqua-Cattaraugus Board of Cooperative Educational Services (BOCES) officials properly managed and monitored building access badge accounts. 

Key Findings 

BOCES officials did not properly manage and monitor badge accounts used to access BOCES buildings. Badges that are not properly managed and remain active without a purpose can be lost, stolen or misused, potentially resulting in unauthorized building access. 

BOCES officials: 

• Did not deactivate 48 badges (55 percent) that were no longer needed out of the 87 active non-employee individual badge accounts. 
• Created 25 duplicate accounts in the building access system and physical badges for current BOCES employees who already had badges. 
• Did not deactivate and could not physically locate the badges for 15 of 25 shared accounts we selected for testing. 
• Discovered and deactivated, because of our audit inquiry, an additional 48 shared accounts since the badges were lost.

Key Recommendations 

• Deactivate badge accounts as soon as they are no longer needed. 
• Periodically review accounts for necessity and appropriateness of access. 

BOCES officials agreed with our recommendations and have initiated or indicated they planned to initiate corrective action.