A new state audit alleges that the MBTA has fallen short in its oversight of the company that operates the commuter rail, putting passengers at risk of injury and missing out on millions of dollars that could have been used to improve service.

The report conducted by Massachusetts State Auditor Diana DiZoglio’s office investigated the MBTA’s contract with Keolis – the private company that has operated the commuter rail since 2014 – over a three year period. It found that the T did not properly maintain logs surrounding station repairs and the removal of snow and ice, failed to properly document Americans with Disabilities Act (ADA) inspections and did not properly penalize Keolis over performance issues.

According to the audit, from 2020 through 2023, the MBTA should have charged Keolis $3,324,126 in penalties and overpayments. The auditor’s office says those funds could have been used for sorely needed improvements to the transit system.

The audit also identified a number of other problems, including a failure to require Keolis employees to complete cybersecurity awareness training and improper oversight of fair collection revenue and train maintenance.

“Our report revealed significant issues that need to be remedied around the MBTA’s contract with Keolis,” State Auditor Diana DiZoglio said in a statement. “The MBTA must increase coordination and communication among departments to address inefficiencies.”

The MBTA and Keolis strongly disputed the state’s findings, particularly the audit’s multi-million dollar estimate of losses, claiming that the financial discrepancies are significantly smaller.

“Keolis fully rejects the summary findings of the audit report,” spokesman Jake O’Neill said in a statement. “The documentation that the MBTA provided proves that the actual discrepancy for incentives and penalties from 2020 to 2023 is just over $100,000 rather than the $3.3 million that appears in the executive summary of the report.”

As part of the report, the MBTA responded to each of the audit’s allegations. The agency rejected many of the audit’s claims – particularly surrounding penalties and payments – but did acknowledge it fell short on ADA compliance oversight and cybersecurity training.

The agency said it has “already begun to make improvements based on some of the [audit’s] recommendations.”

The auditor’s office plans to conduct a follow-up review of the MBTA in six months to assess the agency’s compliance with the audit’s recommendations.