The state Comptroller’s Office thinks Erie-2-Chautauqua-Cattaraugus BOCES can do a better job securing its building.

The Comptroller’s Office recently audited whether BOCES officials properly managed and monitored building access badge accounts. BOCES has a Building Access System in place to assist officials to manage and monitor building entry points and regulate people allowed to enter the school premises. This system uses ID badges that are connected to badge accounts stored in a computer program that authenticates the approved badge holder before they are allowed to enter any specific BOCES building.

According to the audit, BOCES provides educational and support services to 27 component school districts in Erie, Chautauqua and Cattaraugus counties. BOCES is governed by a 13-member Board of Education. The Board is responsible for the general management and oversight of financial and educational affairs. The District Superintendent is the chief executive officer responsible, along with other administrative staff, for day-to-day management. The Executive Director of Human Resources, who is assisted by two personnel secretaries, along with a network specialist who reports to the Associate Director of Technology, and various department heads are responsible for managing and monitoring the use of badge accounts.

The audit says that BOCES has not properly managed these badge accounts.

“We determined the BOCES had a process for adding access badges for employees, after completing its hiring process that includes background checks,” the audit said. “For new employees, approved non-employees and for specific requested purposes, the personnel secretaries add the badge account to the system and the network specialist updates access limits on existing badges. However, BOCES officials did not actively manage badge accounts and did not have written procedures for granting, changing and deactivating accounts for temporary BOCES employees and non-BOCES employees Furthermore, BOCES officials did not properly monitor the use of badge accounts to determine whether the accounts were needed. As a result, the BOCES had unneeded badge accounts still active in the BAS.”

BOCES officials were found to not have deactivated 48 badges — 55 percent of them — that were no longer needed out of the 87 active non-employee individual badges. 25 duplicate accounts were made in the building access system, along with physical badges for current employees who already had badges. 15 of 25 shared accounts that were selected for testing were not deactivated and could not be located, and an additional 48 shared accounts were discovered and deactivated because of the audit.

The recommendations from the Comptroller’s Office were that BOCES should: develop written procedures for adding, modifying and deactivating individuals and shared badge accounts, and evaluate and adjust these procedures, as needed, to ensure all processes are working as intended, deactivate unneeded badge accounts as soon as they are no longer needed, develop periodic review process, and periodically review active accounts for necessity and appropriateness of access, have additional procedures in place for necessary shared badge accounts to monitor who uses the accounts and when and how they are used, and ensure employees do not have duplicate badge accounts.

For the active badge accounts at BOCES, 797 are for employees and board members, 87 for non-employees with 153 shared accounts, totaling 1037. 240 badges were reviewed.

“BOCES officials agreed with our recommendations and have initiated or indicated they planned to initiate corrective action,” the audit said.

In a response from BOCES included in the audit, BOCES said they appreciated the state Comptroller’s Office’s thorough examination.

“We are committed to enhancing our building access management process and ensuring the security of our facilities,” BOCES said in their response. “We appreciate the insights provided by the audit and are confident that the measures we are implementing will address the identified issues and prevent their recurrence.”

David O’Rourke, BOCES district superintendent, said while they were happy to see that the current badge procedure was effective they also recognize the need for additional measures.

“Our BOCES was pleased to see that the standard procedure for disabling employee badge access at the end of employment was effective,” O’Rourke said. “The report highlighted, however, the need for additional procedures for occasional staff who continued to do intermittent substitute work after retirement, as well as disabling procedures for outside contractors who needed badge access. We’ve corrected these issues, and appreciated the work of the Office of the state Comptroller in bringing these matters to our attention.”