TUSD School Safety Audit: Three Years Later, Have the Risks Really Been Corrected?

John C. Blackshire, Jr. The Accountware Group | November 2026

The 2023 Internal Audit Identified 12 Safety and Internal Control Weaknesses. The October 2026 Follow-Up Reports Progress—But Provides Limited Assurance That the Problems Have Actually Been Resolved.

In July 2023, the Tucson Unified School District's Office of Internal Audit issued a report examining the district's School Safety Department.

The audit, conducted by then-Internal Auditor Martha Smith, identified 12 findings involving student safety, physical security, emergency preparedness, access controls, records management, and operational effectiveness.

Some findings concerned administrative procedures. Others involved potentially serious threats to the safety of students, teachers, employees, and visitors.

On October 9, 2026, more than three years after the original report, TUSD issued a follow-up assessment of management's corrective actions.

The follow-up reports meaningful progress.

The district deserves recognition for corrective actions that have been undertaken, including the reported acquisition of protective vests, improved emergency planning, restoration of incident-record access, and changes in key-control supervision.

However, the follow-up also raises an important governance question:

How can TUSD's Governing Board and Audit Committee determine whether significant safety risks have actually been reduced when Internal Audit did not independently test the effectiveness of the corrective actions?

That is the central issue in comparing these two reports.

1. The Original 2023 Audit Identified Significant Safety Risks

The original audit examined operations from April 1, 2022, through March 31, 2023.

Its objectives included evaluating internal controls, emergency preparedness, employee training, physical security, incident reporting, asset protection, and records retention.

The 12 findings were presented in order of perceived risk.

They included disabled classroom locking mechanisms, inadequate emergency planning for administrative employees, missing protective equipment for armed officers, unavailable incident records, weak key controls, inaccurate access records, incomplete asset inventories, and deficiencies in documentation and coordination.

These were not all equally serious.

An incomplete administrative file presents a different risk from a classroom door that cannot be locked quickly during an emergency.

An effective follow-up should therefore consider not only whether management has taken action, but also whether the highest-consequence risks have been adequately mitigated.

2. Classroom Door Locks: The Most Serious Finding Deserves Stronger Verification

The first finding in the 2023 audit concerned classroom door security.

The auditor reported that magnets had been placed on automatic locking mechanisms, preventing affected classroom doors from locking as designed.

The report explained that, to lock an affected door, an individual would first need to open it, remove the magnet, and close it again.

During a security emergency, those additional steps could create serious exposure.

The original audit identified the risk that unauthorized individuals could gain access to classrooms and their occupants.

The 2026 follow-up reports an important change in management's position.

For the 2026–2027 school year, the Director of School Safety advised principals that the department no longer supported magnetic devices that interfere with classroom door locks and strongly encouraged their removal.

This represents a positive policy and communication change.

But the follow-up does not establish that every affected classroom door was inspected or that the interfering devices were actually removed.

It does not report the number of doors examined, the number of deficiencies corrected, or whether physical functionality was independently tested.

The remaining question: Are all affected classroom doors now capable of locking as intended, and does management have documented evidence supporting that conclusion?

Communicating a safety expectation is not the same as verifying compliance.

For a finding involving student and employee safety, a district-wide inspection and documented corrective-action process would provide substantially stronger assurance.

3. Emergency Preparedness: Plans Reportedly Exist, but Have They Been Tested?

The 2023 audit identified limited emergency preparedness guidance for employees working in administrative offices or away from school campuses.

The concern was that employees outside traditional school settings might not have sufficiently documented emergency procedures.

The 2026 follow-up reports that district Emergency Operations Plans are available through SharePoint and that schools maintain site-specific protocols and evacuation locations.

This is a meaningful improvement.

However, emergency preparedness involves more than publishing documents.

An effective emergency management program should include employee awareness, training, periodic exercises, testing, and corrective action following identified weaknesses.

The follow-up does not provide substantive testing results establishing whether employees at administrative and off-site facilities understand and can execute their emergency procedures.

The appropriate question is whether management has verified preparedness across all applicable facilities, not merely whether the plans exist.

4. Officer Protective Equipment: A Positive Corrective Action

The 2023 audit reported that armed School Safety Officers were not equipped with body armor or protective vests.

The auditor identified the potential for officers to encounter threats without appropriate protective equipment.

The October 2026 follow-up classifies this issue as resolved.

According to the report, a committee reviewed the officer uniform program and implemented changes that included ballistic vests.

This is one of the clearer examples of reported corrective action.

The department also described ergonomic benefits associated with distributing equipment weight through an exterior carrier.

Nevertheless, the follow-up did not substantively verify individual equipment assignments, condition, maintenance, or employee training.

The reported purchase and deployment of vests is significant progress, but management should continue ensuring that equipment remains available, serviceable, and appropriate for assigned responsibilities.

5. Incident Reports and Call Logs: The Cybersecurity Connection

The original audit identified an inability to provide certain incident reports, supporting documentation, and call logs.

The report associated the problem with the January 2023 cyberattack affecting district records.

This finding illustrates the relationship between cybersecurity, operational resilience, and student safety.

Incident records may be necessary to investigate threats, reconstruct events, support legal proceedings, evaluate response times, and identify recurring safety problems.

The 2026 follow-up states that the department stabilized its records systems and can now retrieve incident reports, dispatch records, and related documentation.

That is a positive development.

However, the report does not describe a test of record completeness, backup restoration, retention compliance, or recovery capabilities.

The important question is whether the district can demonstrate that critical safety records remain available and recoverable during another system disruption.

A system functioning under normal conditions is not necessarily evidence that disaster recovery controls are effective.

6. Key Control: A Major Access-Security Risk Remains

Two of the original findings addressed the district's Key Control Program.

The first concerned inadequate supervision, guidance, training, and internal controls.

The second concerned inaccurate inventory records.

These findings are closely related because keys and electronic access credentials determine who can enter district facilities.

The 2026 follow-up reports organizational improvements.

Key-control and lock-shop functions have reportedly been consolidated under School Safety, with increased supervision and training.

The district is also modernizing electronic access management through Verkada.

However, the follow-up identifies a significant unresolved issue:

A district-wide inventory found that historical key-control information was only 70% accurate.

The report also acknowledges that unauthorized key management by individual schools continues.

Management attributes delays in full reconciliation to staffing and competing priorities.

This deserves particular attention.

An inaccurate key-control database can undermine management's ability to determine which individuals possess access credentials, whether credentials have been returned, and whether access rights remain appropriate.

The existence of a new technology platform does not automatically correct inaccurate historical records.

Migrating unreliable information into a new system can simply transfer the problem.

Management should establish a verified inventory, resolve discrepancies, review access authorizations, and periodically reconcile issued keys and credentials to authorized personnel.

The follow-up describes future work, but does not establish that the underlying access-control risk has been fully mitigated.

7. Asset Inventory: Better Tracking, but Limited Independent Evidence

The 2023 audit found that the School Safety Department did not maintain a complete list of taggable assets and had only limited records of assigned equipment.

The risk involved the potential loss, misuse, or inability to account for district property.

The follow-up reports that equipment such as radios is now tracked through the Alliance system.

It also describes procedures for recovering equipment when employees leave, transfer, or no longer require assigned items.

These are appropriate control activities.

However, the report acknowledges delays in equipment audits following staff turnover.

It does not include independently tested inventory counts or reconciliation results.

Management should be able to demonstrate that recorded assets exist, are properly assigned, and are recovered when appropriate.

Without periodic physical verification, an electronic asset database may be incomplete or inaccurate.

8. Transportation Testing: Operational Improvements Are Still Underway

The 2023 audit questioned the use of Traffic Safety resources in administering tests for bus-driver trainees.

The concern involved efficiency, testing outcomes, and the allocation of district personnel.

The 2026 follow-up reports closer collaboration between School Safety and Transportation.

It also states that the department has two certified third-party testers, with additional personnel undergoing certification.

This indicates progress in staffing and coordination.

However, the follow-up does not provide quantitative evidence demonstrating improved trainee passing rates, reduced testing delays, or lower costs.

Those measures would help determine whether the corrective actions actually improved operational effectiveness.

A follow-up should distinguish between implementing new procedures and achieving the intended results.

9. Records and Documentation: Several Findings Are Reported Resolved

The original audit identified additional weaknesses involving video-pull documentation, supervisor employee files, interdepartmental communication, and records retention.

The follow-up describes progress in these areas.

Video-pull records reportedly now include relevant information within the Alliance system, including timestamps associated with footage retrieval.

Supervisor employee documentation is reportedly maintained through centralized Human

Resources and Legal systems rather than duplicating records within the department.

Management also describes improved coordination with Technology, Facilities, Procurement, Legal, Risk Management, Human Resources, and Transportation.

These changes may reduce duplication and strengthen accountability.

However, the follow-up's video-pull finding is classified as resolved while also stating that there have been no material changes since July 2023. That combination deserves clarification because the original finding concerned missing information.

The records-retention finding presents another question.

The follow-up states that records are being stored electronically in established systems and that all records are currently retained indefinitely.

Indefinite retention is not necessarily equivalent to compliance with approved records-retention schedules.

Management should demonstrate that its retention and disposition practices meet applicable requirements, including the proper handling of records that must be preserved and those eligible for lawful disposition.

10. The 12 Original Findings Compared With the 2026 Follow-Up

The following table summarizes the reported progress and the principal remaining assurance questions.

Original finding	2026 reported status	Remaining question
1. Disabled classroom door locks	Improved / ongoing	Were affected locks physically inspected and restored?
2. Emergency preparedness	Resolved / ongoing compliance	Have administrative and off-site emergency procedures been tested?
3. Officer protective gear	Resolved	Are equipment assignments and readiness periodically verified?
4. Incident reports and call logs	Resolved	Have completeness, retention, and recovery controls been tested?
5. Key-control supervision	Substantially resolved / ongoing	Are revised supervision and access controls operating effectively?
6. Inaccurate key-control records	Partially resolved / ongoing	When will historical inaccuracies and unauthorized key management be corrected?
7. Asset and equipment inventory	Mostly resolved / ongoing	Do physical inventories agree with system records?
8. Utilization of resources	Improved / ongoing	Have efficiency and testing outcomes measurably improved?
9. Missing video-pull information	Resolved / ongoing	Has the completeness of current records been independently verified?
10. Supervisor employee files	Resolved / alternative process	Are centralized records complete and accessible to authorized personnel?
11. Limited collaboration	Resolved / ongoing practice	Is coordination consistently documented and effective?
12. Records retention	Substantially addressed / ongoing	Do actual retention and disposition practices meet approved schedules?

Source: July 2023 School Safety Internal Audit Report and October 9, 2026 follow-up, pages 2–6. Status descriptions follow the individual finding narratives; the report's overall 6/6

classification does not map every narrative status to a specific category.

The comparison demonstrates that the district reports corrective activity across all 12 areas.

It also demonstrates that several important questions remain unanswered.

11. The Most Important Disclosure Appears on the Last Page

Perhaps the most consequential part of the October 2026 follow-up is its methodology disclaimer on page 7.

The report states that the review was based on management inquiries, discussions, and visual demonstrations.

It expressly discloses that no substantive testing, sampling, or verification of underlying transactions, electronic records, or physical controls was performed.

The report also states that no overall rating is expressed.

This is a significant limitation.

The reported implementation statuses reflect a limited assessment of management's progress, not comprehensive independent validation of control effectiveness.

Consider the difference:

A manager states that classroom door magnets have been discouraged.

That is evidence of management communication.

An auditor examines a sample of affected doors, observes their locking operation, and verifies documented corrections.

That provides stronger evidence of control implementation and operation.

Similarly, a manager states that key-control records are being corrected.

That demonstrates management's reported intentions and activities.

An auditor independently selects issued keys, traces them to authorized employees,

investigates discrepancies, and evaluates the reconciliation process.

That provides evidence about whether the access-control system is functioning effectively.

The distinction is fundamental to internal auditing.

Management's assertion that a problem has been corrected is not equivalent to independent assurance that the associated risk has been adequately mitigated.

The follow-up appropriately discloses its limited procedures. The concern is whether its results might nevertheless be interpreted by readers as stronger assurance than the work supports.

12. The Follow-Up Also Ends Further Review Until the Next Audit Cycle

The final page contains another important statement.

Internal Audit indicates that no additional follow-up reviews or audit procedures for these findings will occur until the department's next scheduled audit cycle.

Management is expected to continue monitoring corrective actions independently.

Management should indeed own its corrective actions.

But the decision to defer further independent follow-up deserves careful consideration when significant risks remain unresolved.

The accuracy of key-control records, unauthorized key management, classroom door security, and records recovery are not merely administrative matters.

They can affect the district's ability to protect students, employees, facilities, and sensitive information.

A risk-based follow-up program should consider the severity of unresolved conditions, management's implementation deadlines, and the strength of the evidence supporting closure.

The next scheduled audit cycle may be appropriate for lower-risk matters.

Higher-consequence unresolved risks may warrant earlier verification.

The Governing Board and Audit Committee should understand the rationale for deferring further independent testing.

13. What Should the Governing Board and Audit Committee Require?

The district has documented management progress, but its governance bodies need sufficient evidence to distinguish reported corrective action from verified risk reduction.

Five actions would materially strengthen accountability.

First, require a risk-based corrective action register. Each of the 12 original findings should have a clearly assigned management owner, current risk assessment, corrective action, completion date, and supporting evidence.

Second, prioritize physical safety and access-control risks. Classroom door security and key-control accuracy deserve particular attention because deficiencies could expose students, employees, and facilities to unauthorized access.

Third, establish measurable completion criteria. For example, a key-control finding should not be considered fully corrected merely because a new software platform is being implemented. Management should demonstrate that access records have been reconciled and exceptions resolved.

Fourth, obtain independent validation of significant corrective actions. Internal Audit should perform risk-based testing when sufficient resources are available, or the Governing Board should consider another appropriately independent review mechanism.

Fifth, require periodic management reporting on unresolved findings. Management should report progress to the Audit Committee until significant risks have been addressed and the effectiveness of corrective controls has been established.

These steps preserve the proper division of responsibilities.

Management owns the controls and corrective actions.

Internal Audit provides independent assurance.

The Audit Committee and Governing Board provide oversight.

14. Give Management Credit for Progress—But Do Not Confuse Progress With Assurance

The October 2026 follow-up contains evidence of reported improvements.

The addition of protective vests, stabilization of incident records, expanded emergency planning, increased collaboration, and changes in key-control supervision are meaningful developments.

Those actions should be recognized.

At the same time, the district's own report identifies continuing challenges.

Historical key-control data remains inaccurate.

Unauthorized key management reportedly continues.

Some operational improvements remain underway.

And the follow-up did not perform substantive testing to establish that the corrective controls are operating effectively.

These facts support a balanced conclusion.

TUSD management reports progress on the 2023 findings.

The October 2026 follow-up provides limited assurance about that progress.

It does not establish that all significant safety and internal control risks have been fully mitigated.

Conclusion: Three Years Later, TUSD Still Needs to Demonstrate That Its Safety Controls Work

The July 2023 School Safety audit identified 12 weaknesses involving important district operations.

More than three years later, the October 2026 follow-up reports that half of the findings have been implemented and half are partially implemented.

That represents reported progress.

But the follow-up also expressly acknowledges that it did not independently test the underlying controls.

For TUSD's Governing Board and Audit Committee, this distinction is critical.

School safety is not an area where governance oversight should depend exclusively on management descriptions of corrective actions.

The district should be able to demonstrate that classroom doors function as intended, access credentials are accurately controlled, emergency procedures are effective, safety records are protected, and significant deficiencies are corrected.

The 2023 audit identified the risks.

The 2026 follow-up documented management's reported response.

The remaining governance responsibility is to obtain sufficient evidence that the highest-consequence risks have actually been reduced.

That is how internal auditing creates value.

And that is how a school district demonstrates accountability for the safety of its students, employees, and community.

The Accountware Group (TAG) provides independent commentary on organizational governance, internal auditing, internal controls, risk management, and public-sector accountability.

Source documents: TUSD Office of Internal Audit, School Safety Department Internal Audit Report, Report No. 005_FY2022-2023, dated July 3, 2023, prepared by Martha Smith; and TUSD School Safety Internal Audit Follow-up Report, dated October 9, 2026.

Editorial qualification: The article distinguishes the original auditor's findings, management's reported corrective actions, and the limited procedures performed in the follow-up. It does not conclude that untested controls are necessarily ineffective or that reported improvements did not occur.