Waterloo Central School District officials could not locate nearly half the access badges state auditors asked to see, including lost credentials that had been left active in case they turned up.
The district could not account for 37 of 78 requested badges, or 47%, and auditors identified 56 unnecessary nonemployee credentials. Waterloo said it disabled the unnecessary and unaccounted-for devices and was strengthening its tracking procedures.
The Aug. 28 audit by the state comptroller’s office found weaknesses in how the district managed access across five buildings. It covered July 2024 through November 2025, with access logs reviewed through April 20, 2026.
Auditors warned of a potential for unauthorized access. The report did not identify an unauthorized entry involving the credentials examined.
Lost badges were left active
Waterloo had 1,170 active access accounts during April fieldwork: 491 devices issued to 390 employees and 679 issued to nonemployees.
Eighty-six employees, or 22%, had at least two active badges. Eight had three or more. Auditors asked to see the 31 badges assigned to those eight employees, but officials could not locate 12.
The network analyst said employees in certain positions, including custodians and administrators, routinely received two credentials for convenience. The eight employees also had lost badges and received replacements, while the originals remained active in case they were found.
Auditors said lost devices should be disabled promptly. Leaving them active, while issuing replacements, increased the risk that an unauthorized person could use one to enter a school.
Twenty individual nonemployees also had multiple badges. Two had three apiece; officials could not locate three of those six devices.
The report’s overall finding that 37 of 78 badges were unaccounted for came from selected groups examined by auditors. It was not a count of every missing badge districtwide.
Dozens of nonemployee credentials were unnecessary
Auditors identified 56 unnecessary active nonemployee badges, or 8% of that category.
Thirty-three were shared credentials with little or no activity. Twenty had gone unused for at least six months, and 13 had never been used.
Another 23 belonged to individual nonemployees: 17 former vendors, four former employees and two community members who had received access to school facilities. Nine of those badges had never been used.
Waterloo’s shared credentials had different access levels. Of 491 shared badges, 310 could open only a single interior classroom door or the bus gate; they did not open exterior doors.
The district also said it maintained more than 100 credentials for fire departments, emergency medical services and law enforcement to support rapid emergency access. Officials agreed those devices needed periodic review to confirm they remained authorized and appropriately assigned.
The network analyst reviewed active accounts and disabled unnecessary individual, shared and duplicate badges after auditors raised the findings. He also told auditors he planned a procedure to deactivate nonemployee accounts after 30 days of inactivity.
Daily monitoring missed inactive accounts
The district had written procedures for issuing, changing and deactivating employee badges, but lacked comparable procedures for monitoring and deactivating nonemployee credentials.
Its procedures also did not require regular checks of all active accounts or clearly assign responsibility for reviewing shared badges and comparing access lists with supporting records.
The network analyst reviewed a daily events report for suspicious entry activity. Auditors said that was useful, but additional reports showing inactivity and last-use dates were needed to identify credentials that should no longer work.
Access requests generally arrived by email from human resources or district administrators. The network analyst and a computer support specialist could create, change and deactivate access.
District defends some duplicate devices
Waterloo partially disagreed with the concern about multiple credentials. In its written response, the district said some jobs required both an identification badge and a key fob for operational, safety and security reasons.
Officials also said normal wear could require replacement badges. They acknowledged that replacements and duplicates needed stronger documentation, monitoring and deactivation when no longer necessary.
Waterloo agreed with the findings on unnecessary nonemployee badges and the 37 devices that could not be located. It said those credentials had been disabled and that inventory and recovery procedures were being improved.
The comptroller made four recommendations: reconsider multiple employee devices, promptly disable unnecessary access and recover badges, establish written monitoring responsibilities and regularly reconcile active accounts using system reports.
FL1 previously reported on the Waterloo and Groton audits in September. Waterloo submitted a corrective action plan with its response, according to the audit.
FingerLakes1.com is the region’s leading all-digital news publication. The company was founded in 1998 and has been keeping residents informed for more than two decades. Have a lead? Send it to news@fingerlakes1.com.
