Wayland-Cohocton Central School District – Building Access Accounts and Badges (2024M-113)

Issued Date
December 20, 2024

Audit Objective 

Determine whether Wayland-Cohocton Central School District (District) officials properly managed and monitored building access accounts and badges.

Key Findings 

District officials did not properly manage and monitor building access accounts and badges used to access District buildings. Accounts and badges that are not properly managed and remain active can potentially result in unauthorized building access. District officials: 

  • Did not establish written procedures that define who is responsible for managing and monitoring building access accounts. Although we determined that the District had a process for granting access and adding information into the Building Access System (BAS) for employees during the hiring process, including background checks, the District did not have an adequate process for granting access to non-employees. Almost half of the active building access accounts and badges were for non-employees. 
  • Did not establish a Service Level Agreement (SLA) with the third-party contractor that issued and managed 209 building access accounts and badges.
  • Granted access to 39 individuals participating in continuing education programs without conducting any background checks.
  • Issued 14 building access accounts and badges without verification from District administrators that these individuals were approved to receive access.
  • Did not deactivate the building access account of, and could not locate the badge for, one non-employee. The account and badge were no longer needed as of December 1, 2023 but still active as of July 15, 2024. 

Recommendations 

The audit report includes six recommendations to help the Board and District officials improve the management and monitoring of building badge access accounts and badges. District officials generally agreed with our recommendations and indicated they will take corrective action.