A Former DC Employee Kept System Access for 606 Days After Leaving

A District of Columbia Inspector General audit⧉ published July 16, 2026 found the Department of Youth Rehabilitation Services (DYRS) left four former employees with active access to its computer systems for 158, 217, 536, and 606 days after they left the agency.▸ DYRS did not catch any of the four on its own -- all four accounts were disabled on August 19, 2025, the same day the agency answered the OIG's records request. DYRS is the District agency that runs DC's juvenile justice system.

OIG requested documentation on August 14, 2025 verifying that DYRS had disabled system access for nine separated employees, as required no later than the employee's last working day by the DC Office of the Chief Technology Officer's personnel security policy.▸ Five of the nine accounts checked out -- disabled on or before the employee's last working day. The other four had been left open for months, in one case nearly two years. DYRS told OIG the condition stemmed from three related failures: no monitoring controls to verify deactivation, no policy enforcing the 24-hour deadline, and no formal coordination between the agency's HR and IT functions. "Without OIG's intervention," the audit states, "those accounts may have remained accessible indefinitely."

At the Office of Police Complaints (OPC), OIG couldn't get an answer at all.▸ Asked on August 14, 2025 to verify timely deactivation for two separated employees, OPC couldn't produce system logs, deactivation notices, or account-setting confirmations for either one. Days later OPC reported that "the user accounts for a large number of our separated employees inexplicably do not appear at all in the dashboard" of its account-management software; when it escalated to the Office of the Chief Technology Officer (OCTO), OCTO "cannot seem [to] provide dates or verify the deactivation dates" either. OPC and DYRS both agreed to OIG's recommendations to fix the underlying process -- OPC by December 31, 2026, DYRS on a rolling schedule through September 2026.

The access lapses sit inside a wider gap.▸ OIG surveyed all 77 District government agencies on their human capital practices and got 31 responses -- about a 40 percent return. Twenty-five of those 31 agencies said they have no formal succession plan; of the six that said yes, most pointed to their Continuity of Operations Plan, built for emergencies, not the long-term, skills-based succession planning the GAO Green Book calls for.

The DC Department of Human Resources (DCHR), the District's central personnel authority, is required under the Electronic District Personnel Manual to run a workforce-planning process district-wide; OIG found it hasn't built one.▸ DCHR disagreed with the finding, pointing to an HR working group formed in October 2025 and a draft planning template still being finalized -- initiatives OIG says weren't in place during the audit period and don't yet amount to the standardized framework the rules require. The workforce those policies are supposed to protect is not small: DC employs more than 30,000 people across over 70 agencies, and personnel costs -- salaries, wages, and benefits -- run about $5.1 billion, 24 percent of the District's $21.2 billion FY2025 budget.

Two more findings involve hiring, not offboarding.▸ At the Office of the Chief Medical Examiner (OCME), two job candidates scored an identical 90 on their initial screening -- a tie the District's hiring rules say should go to whichever candidate applied earliest, absent a residency or veterans' preference. Neither candidate had one, and the earlier applicant, who applied July 28, 2023, should have won the tie over the candidate who was hired, who applied August 10, 2023. OCME told OIG the earlier applicant had actually been disqualified for lacking required experience but that the disqualification was never recorded -- a "clerical error," the agency says, not a process failure; OIG counters that without the documentation, it cannot verify the hire was made on merit rather than a departing official's personal recommendation.

Separately, OPC hired a candidate who had claimed the District's 10-point residency hiring preference without ever obtaining proof of residency, a written seven-year residency commitment, or a hardship waiver -- OPC's own written response confirmed there were "no supporting documents to obtain, verify, or maintain" because the candidate wasn't living in DC when hired.▸ And both ABCA and OPC confirmed to OIG that neither prepares the annual employee-training plan District rules require.