Audit of 20 New York Schools Finds 1,564 Unneeded Keycards and Fobs Still Active, Some Tied to Former Employees and Contractors

State auditors found 1,564 building access keycards, fobs and badges that were still active but no longer needed at 20 New York school districts and regional education agencies, according to a report from State Comptroller Thomas P. DiNapoli's office announced Oct. 27.

The report, "Building Access in Schools," numbered 2026-MS-2, compiles audits done between December 2025 and May 2026 at 18 school districts and two Boards of Cooperative Educational Services, or BOCES. Of 17,195 active access devices, 9% were unneeded, and every one of the 20 had at least some, the report says.

According to the report, improper management of building access "can compromise security by allowing unauthorized individuals, including those without appropriate background checks, to gain access to school buildings and students."

School Building Access Audit Findings

Most of the unneeded devices, 65%, belonged to people who were not school employees, including shared devices. Auditors counted 632 individual non-employee devices and 377 shared devices that were no longer needed. Those were tied to former employees, first responders who no longer worked for the agency serving the school, and former vendors or contractors, the report says. Shared devices issued to substitute staff, first responders or vendors were often not tracked, and some "were often missing without officials' knowledge." Some had not been used since 2020 or 2022.

Eighteen of the 20 had employees with two or more active devices, 555 duplicate devices issued to 498 employees in all. At one school, a single employee had seven active devices. The report says duplicates were mainly caused by issuing replacements for lost or damaged cards without turning off the old ones.

East Rochester Union Free School District had the most unneeded devices, 239, or 24% of its active devices, followed by Onondaga-Cortland-Madison BOCES with 228 and Union-Endicott Central School District with 181, according to a table in the report. At Eldred Central School District, 65 of 252 active devices, or 26%, were unneeded.

Reports That Went Unused

All 20 used systems that could produce reports showing last use, inactive cards and people with multiple devices, but only two ran such reviews regularly, the report says. Most did not use features that turn off cards automatically on a set date.

At one school where the automatic shutoff was in place, officials did not know it applied to first responders' devices, and those devices were deactivated, according to the report. None of the 20 ran exercises to make sure first responders' devices worked.

Twelve of the 20 had no written policies on who manages building access, and none had adequate monitoring procedures, the report says. Auditors listed practices they saw work at some schools, including turning off all access at the end of each school year, setting expiration dates for non-employee access and linking access systems to human resources records so departing staff lose access automatically.

Individual reports for each district were issued along with the statewide summary.

Sources: New York State Comptroller, "Building Access in Schools," Report 2026-MS-2, October 2026 (https://www.osc.ny.gov/files/local-government/audits/2026/pdf/building-access-in-school-2026-ms-2.pdf); Comptroller DiNapoli release on local government and school audits, Oct. 27, 2026 (https://www.osc.ny.gov/press/releases/2026/10/state-comptroller-dinapoli-releases-municipal-school-audits-0); Cover photo: Niskayuna High School, Niskayuna, N.Y., one of the districts audited (Tyler A. McNeil, CC BY-SA 4.0, via Wikimedia Commons).