Audit of the Massachusetts Bay Transportation Authority (MBTA)

This is a state performance audit of the MBTA covering January 1, 2017 through March 15, 2019, with some security-access testing extending later into 2019.

“This report details the audit objectives, scope, methodology, finding, and recommendations for the audit period, January 1, 2017 through March 15, 2019.”

Auditors wanted to know whether the MBTA had enough physical security to keep unauthorized people out of vehicle maintenance and storage facilities.

“The objective of this audit was to determine whether the MBTA had sufficient physical security measures in place to prevent unauthorized access to its vehicle maintenance and storage facilities.”

These facilities hold and service MBTA vehicles, so weak security can put riders, workers, and public property at risk.

“Effective physical security controls at these facilities are essential to the MBTA’s ability to protect its customers and employees and to safeguard its most critical assets.”

If you ride the MBTA or pay taxes in Massachusetts, this matters because the audit is about protecting transit facilities, employees, passengers, and public resources.

“As a result, the facilities were vulnerable to unauthorized access, placing the security and safety of MBTA property, passengers, and employees at risk.”

The main problems were that access cards were not consistently recovered or destroyed, and former employees’ access was sometimes left active for long periods.

“The delays gave individuals continued access to MBTA facilities and properties for months and even years after separation.”

The auditor recommended that the MBTA immediately review access, create clear rules for handling departing employees, and monitor whether access is shut off promptly.

“The MBTA should perform an immediate review of the status of all employees and deactivate security access for those who no longer require access and/or are not authorized to have it.”

Auditors found real evidence that some former employees used MBTA facilities after leaving the agency, showing the weakness was not just theoretical.

“As a result of this issue and the issue discussed in Finding 1a, we found 85 instances (involving 35 individuals) where former MBTA employees physically accessed MBTA facilities after their effective termination dates.”

An employee access ID card is the MBTA badge workers use to prove they work there and, where card readers exist, to enter restricted areas.

“These cards confirm employees’ affiliation with the MBTA and are used by the MBTA to control access to restricted areas of facilities and buildings equipped with card readers.”