Former contractors, coaches and other users retained active access badges in the Auburn Enlarged City School District because departments did not consistently tell technology staff when to shut them off, a state audit found.
The review also found shared badges that violated district procedures, replacement badges issued without disabling older credentials and no periodic check of whether all active users still needed access.
The audit from state Comptroller Thomas DiNapoli’s office, issued July 10, examined July 2024 through November 2025 and extended its review of access logs through Jan. 29, 2026. It identified a potential for unauthorized entry; the report did not identify an unauthorized entry using the badges examined.
Auburn generally agreed with the findings. Superintendent Misty Slavic said the district disabled unnecessary credentials, adopted a building access policy and established reviews twice a year.
Former users retained access
During February fieldwork, auditors identified 1,276 active access accounts across the district’s eight school buildings. Those included 828 badges assigned to 802 current employees, 311 accounts assigned to individual nonemployees and 137 shared badges.
Auditors examined 25 individual nonemployee accounts and found eight, or 32%, belonged to people who no longer provided services to the district. The technology director said department heads had not submitted the notifications needed to deactivate them.
All eight were disabled during the audit.
The same communication problem affected shared credentials. Athletics and Facilities officials did not know which coaches or contractors under their supervision still had active badges until auditors supplied a list.
Of the district’s 137 shared badges, officials said 60 were needed for first responders. The remaining 77, used for coaches, contractors, substitutes, interns and others, did not comply with district procedures requiring individually assigned credentials. Seven had never been used, and 16 had gone unused for at least three years.
Auditors reviewed 13 shared badges more closely and found 11 were unnecessary. Those results applied to the selected badges, rather than an estimate of how many unnecessary credentials existed throughout the system.
Six of the unnecessary shared badges were overseen by Athletics. An assistant could not locate four. Another had been issued to a coach who already had an employee badge and used both. A nonemployee coach had kept the sixth after the season ended.
Other unnecessary badges belonged to former contractors, a former intern, a substitute secretary and a mail service vendor whose access officials acknowledged was provided for convenience. Auditors verified that all 11 were disabled.
Duplicate badges and unfinished procedures
Twenty-six employees and one nonemployee had two active badges each.
In a closer review of four employee accounts, auditors found damaged badges had remained active after replacements were issued. A technology employee also held a testing badge the technology director did not know existed and said was unnecessary.
Slavic had a second badge for building lockdown emergencies. She considered it necessary for her role, but auditors said multiple active credentials increased the risk of loss, theft and unauthorized use.
The technology director, a nonemployee, also had a damaged original badge that remained active after its replacement was issued. That duplicate was disabled after auditors raised the issue.
Auburn already had written procedures covering approval, issuance, access limits and revocation. The problem was implementation: the technology director said procedures developed in August or September 2025 following a cybersecurity audit had not reached all key staff because officials were still finalizing them.
Technology staff also were not periodically checking the active account list against current needs.
District describes changes
In her July 6 response, Slavic said the district reviewed access for coaches, contractors, service providers and other third parties and removed credentials without a valid purpose.
She said the school board adopted a Building and Door Access Control Policy in May 2026. A companion administrative regulation covers new users, special requests, nonemployee access, employee departures, monitoring and reporting.
The district also introduced an electronic request form to document approvals, changes and removals. Its twice-yearly reconciliation process involves technology staff and designated contacts in Athletics, Facilities, Food Service, Student Services and other departments.
The report made five recommendations addressing unnecessary credentials, duplicates, individual assignment, staff access to procedures and regular system reviews. It required a written corrective action plan within 90 days and said the plan should be posted publicly.
FL1 previously reported on the Auburn findings in July. The district’s boundaries include Auburn and portions of Aurelius, Fleming, Owasco and Sennett.
FingerLakes1.com is the region’s leading all-digital news publication. The company was founded in 1998 and has been keeping residents informed for more than two decades. Have a lead? Send it to news@fingerlakes1.com.
