Text · page 3 of 12
Audit Results North Collins Central School District Audit Objective Did North Collins Central School District (District) officials properly manage and monitor building access accounts and devices? Audit Period July 1, 2024 – November 30, 2025 We extended our audit period to February 3, 2026 to review access activity logs. Understanding the Audit Area Building access controls are essential for enhancing security and enabling school officials to manage and monitor entry points within educational institutions. These systems authenticate a user through devices such as key fobs, keycards, badges, or similar technologies, helping to ensure only authorized individuals can enter school buildings. By limiting access in this way, schools can better safeguard their facilities and maintain a safe and secure environment for students, teachers, staff and visitors. The District uses a building access management system (system) which included 280 active building access accounts (accounts) associated with 167 devices issued to current employees, and 113 issued to non- employees including 23 shared devices. 1 Each of the District’s two school buildings have one public point of entry. Employees can also use other points of entry, which require a device to enter the building. Audit Summary District officials did not properly manage and monitor building access accounts and devices (badges). As a result, there was a potential risk for unauthorized access to District school buildings, compromising building security and safety for students, teachers, staff and visitors. Specifically, of the accounts we reviewed, the District had 17 active, but unneeded, non-employee accounts with assigned badges in the system, including: • 11 badges issued to individual non-employees, and • Six shared badges. Although District officials had a process for adding accounts in the system for employees and non-employees, there was no process for promptly disabling or deleting accounts when no longer needed. Furthermore, these issues occurred because no one periodically reviewed active accounts to determine whether they were needed. This report includes three recommendations that, if implemented, will help District officials improve management and monitoring of building access accounts and badges. District officials generally agreed with our recommendations and their response is included in Appendix B. 1 A shared account or device is assigned to a user for a specific role or function but not assigned to a specific individual (e.g., vendors or first responders). 1