Text · page 6 of 12
When we brought these issues to District officials’ attention, the Director deactivated the accounts and badges, which we observed. However, District officials should have deactivated the accounts as soon as they were no longer needed, such as when a vendor’s contract or an individual’s employment with the District ended. Because the District did not have adequate procedures to routinely review and deactivate badge accounts, these accounts remained active and could potentially have been used for unauthorized access. The 23 active shared badges included 17 that were necessary and for District purposes, including first responders, substitute employees and student teachers. However, we determined the remaining six shared badges were no longer needed and should have been deactivated: • Four badges were assigned to contractors who were involved with the District’s 2022 capital project, • One badge was assigned to a parent-teacher association president, and • One account and badge that District officials could not explain why it was created. Because the District did not have a clear communication of responsibilities or documented procedures for managing and monitoring building access, there remains a risk that access devices are not collected. Also, there was no reconciliation of accounts and badges, which increased the risk of unauthorized entry. Account Management and Monitoring Procedures – Although the District Clerk maintained checklists to add, modify and revoke badge accounts for District employees, District officials did not have any written procedures outlining roles and responsibilities for managing and monitoring badge accounts. Specifically, District officials did not define who is authorized to create accounts, who is responsible for monitoring active accounts, and the process to revoke access, by deactivating unneeded accounts and collecting badges. At the time of our fieldwork, requests to add, modify or revoke badge accounts for District employees were initiated by the District Clerk and communicated to the technology department. Similarly, requests for shared badge accounts, such as those used by substitute employees and contracted vendors, were initiated by the responsible department heads and communicated to the technology department. Technology department employees made the requested additions or modifications in the system. However, there were no written procedures or documentation outlining how these accounts should be managed and monitored. As a result, account updates were not always made in a timely manner and there was a potential for unauthorized access to District buildings due to untimely account deactivation. Recommendations District officials should: 1. Deactivate accounts and collect the associated badges as soon as they are no longer needed. 2. Develop written procedures that define who is responsible for managing and monitoring accounts including shared badges and periodically evaluate and adjust these procedures to ensure all processes are working as intended. 3. Develop a reconciliation process utilizing system reports, and review active accounts for necessity and appropriateness of access. 4