State Audit Flags Building Access Issues In Brentwood Schools; District Responds

BRENTWOOD, NY — A state audit of the Brentwood Union Free School District found that several building-access badges remained active despite meeting criteria for deactivation under district procedures.

The audit, released by New York State Comptroller Thomas DiNapoli, found three current employees had duplicate active badges and five accounts categorized by auditors as belonging to non-employees remained active despite exceeding the district's inactivity threshold.

Auditors said the unnecessary active credentials created a potential risk of unauthorized access to district buildings.

At the time of the audit, Brentwood had 2,839 active building-access accounts, including badges assigned to 2,632 current employees and 187 individual non-employees.

The district operates 17 school buildings, according to the audit.

Auditors found three employees had duplicate active badges after replacement cards were issued because two originals were damaged and another contained a printing error.

The district's director of safety told auditors that Safety Office personnel had forgotten to deactivate the original badges. The three unnecessary badges were disabled during the audit.

Auditors also reviewed 19 non-employee badge accounts and found five that had not been disabled in accordance with district procedures.

Under the district's procedures, officials are supposed to review badge activity every four months and contact people whose badges have not been used during that period. If the badge is not used within five school days after notification, it is supposed to be disabled.

The five badges identified by auditors had last been used between October and November 2025 and remained active after the holders failed to use them within those five days.

The district's director of safety told auditors the badges remained active because the individuals requested that they not be disabled. Auditors said the district's procedures did not allow extending access solely at a badge holder's request.

District Provides Additional Context

After the audit was published, Brentwood Director of Safety Byron McCray provided additional context to the school community about the credentials cited in the report.

McCray said the five active identification cards at issue were assigned to current district employees who were temporarily away from their regular duties because of maternity leave or an approved medical leave of absence.

"These employees remain members of our school district staff while they are on approved leave," McCray said.

He said the district continued to monitor activity associated with the identification cards and retained the ability to identify and address unauthorized or inappropriate use.

"An employee being temporarily away from their regular duties does not mean that the district loses oversight or control of their access credentials," McCray said.

The Comptroller's audit categorized the five flagged accounts as belonging to non-employees. The district's July 28 written response included with the final audit, however, referred to the credentials as "inactive employees' badges" and said the individuals continued to have legitimate operational relationships with the district.

McCray also provided additional context regarding the three duplicate IDs, saying they were associated with the implementation of a new classroom card-swipe system at the district's high school campuses.

"Because the new system utilizes a different type of card technology, duplicate IDs were temporarily created for testing and validation purposes as part of the installation process," McCray said. "We want to make this point very clear: The Brentwood School District does not have staff members with two active identification cards that can be used to access our school buildings."

The Comptroller's report states that the three duplicate badges auditors identified were replacement cards issued because two original cards were damaged and another contained a printing error. Auditors said the original badges had not been deactivated when the replacements were issued.

The Comptroller's Office recommended that the district ensure employees do not retain unnecessary duplicate badges, disable inactive accounts in accordance with district procedures and consider revising its rules if legitimate operational needs require certain accounts to remain active beyond the four-month threshold.

In a July 28 response included as part of the Comptroller's final audit report, Superintendent Wanda Ortiz-Rivera said the eight exceptions represented a small portion of the district's 2,839 active accounts and characterized the findings as administrative issues rather than broader failures in the district's security system.

The district also said the five badge holders continued to have legitimate operational relationships with the district.

The district said it was strengthening its procedures, including reinforcing requirements to immediately deactivate replaced badges, creating a formal approval process for access extensions and adding administrative oversight of badge-management decisions.

In its written response, the district also said the audit had not identified unauthorized access, misuse of credentials or security breaches.

The Comptroller's Office responded that determining whether any security breach occurred was not an objective of the audit and said the audit results therefore could not be used to conclude that no unauthorized access occurred.

McCray said the district takes the safety and security of students, staff and facilities seriously and remains committed to maintaining oversight of building access.

The Brentwood Board of Education is required to prepare a corrective action plan addressing the audit's recommendations and submit it to the Comptroller's Office within 90 days.