Two missing key fobs remained capable of opening Groton school buildings even though they had never been used, part of a state audit that found the district lacked a reliable process for ending access when it was no longer needed.
Auditors identified eight unnecessary nonemployee credentials, representing 40% of the district’s 20 active nonemployee accounts. The maintenance supervisor disabled all eight after auditors raised the issue.
The Aug. 21 report from the state comptroller’s office examined Groton Central School District’s building access practices from July 1, 2024, through Nov. 30, 2025, with access logs reviewed through Feb. 13, 2026. It warned that unneeded active credentials created a potential for unauthorized entry, but did not identify an incident in which one was used that way.
Superintendent Margo Martin said the district was moving to quarterly reviews and would complete written procedures before the 2026-27 school year.
Unused credentials remained active
Groton had 179 active access accounts during February fieldwork. Those included 159 key fobs issued to 157 employees and 20 issued to nonemployees. Eight of the nonemployee fobs were shared credentials associated with a role or organization rather than one person.
Auditors examined all 20 nonemployee accounts.
Five unnecessary fobs had been assigned to vendors and never used. A sixth belonged to a project manager and had gone unused for at least two years.
The two missing devices were shared fobs assigned to BOCES and an accounting firm. Neither had been used, and district officials could not locate them.
The district had a process for granting access but no comparable procedure for revoking nonemployee access. No one periodically reviewed the active account list using reports already available in the system, auditors found.
That left officials unaware that the missing shared devices remained active and other credentials were no longer necessary.
Auditors demonstrated how system reports could help identify those problems. They recommended regularly comparing active credentials with current authorized users and collecting and disabling devices promptly when access ended.
Access management depended on one supervisor
Groton used an onboarding form for employees that identified their name, department and job title, along with the building access needed. The maintenance supervisor recorded the assigned fob number, issuance date and approval.
The supervisor created employee accounts after the district clerk processed hiring paperwork, added nonemployee users and changed access when building leaders requested it.
For departing employees, he relied on administrators and school secretaries to notify him when access should be revoked. He told auditors the elementary and high school secretaries were responsible for collecting fobs on an employee’s last day.
But those practices were not supported by written procedures clearly defining who could create accounts, who monitored active credentials or how unnecessary access should be ended.
Although other officials had administrative rights, no one served as a backup to activate, change or disable accounts when the maintenance supervisor was unavailable.
The supervisor also was the only employee with multiple active fobs, holding three. Officials said his emergency responsibilities justified the additional devices. Auditors recommended considering a limit of one per employee because additional active devices increased the risk of loss or theft.
District commits to regular reviews
In an Aug. 12 corrective action plan included with the report, Martin agreed that unnecessary fobs should be disabled and collected promptly. She said the district had been disabling identified credentials during the audit.
The district agreed to written procedures assigning responsibility for access management and monitoring. Martin said reviews would occur quarterly, while maintaining that some positions required multiple fobs.
Operating procedures included with the response call for the district clerk to send personnel changes to the facilities supervisor following school board meetings. They also require immediate deactivation of lost or stolen badges and documentation before replacements are issued.
The comptroller made four recommendations covering duplicate devices, prompt deactivation, written responsibilities and regular reconciliation. The report required a corrective action plan within 90 days and said it should be available on the district website.
FL1 previously covered Groton’s findings alongside Waterloo’s access audit. Groton operates two school buildings and serves portions of Cayuga, Cortland and Tompkins counties.
FingerLakes1.com is the region’s leading all-digital news publication. The company was founded in 1998 and has been keeping residents informed for more than two decades. Have a lead? Send it to news@fingerlakes1.com.
