HOA Management Company Financial Controls and Fraud Prevention Questionnaire

An HOA management company can administer millions of dollars without owning any of them. That distinction should shape the board's due diligence. Association accounts should remain association assets, board authority should remain visible, and the manager's convenience should not displace independent oversight.

The strongest financial-control process is not the one with the most approvals on a sales slide. It is the one the candidate can demonstrate from bank account to owner ledger, invoice, payment, reconciliation, board report, exception log, and transition file. Every sensitive step should have a named operator, separate reviewer, evidence, backup, escalation path, and association-controlled access.

The Foundation for Community Association Research's guidance on preventing fraud and embezzlement recommends association-titled bank accounts, no commingling, multiple-person controls, independent access to bank statements, and careful control of reserve funds. FBI business-email-compromise guidance emphasizes verifying changes to account information through a secondary channel and acting quickly with the bank and law enforcement when fraud occurs. FDIC authentication guidance discusses dual control, transaction logs, administrative-privilege controls, and anomaly monitoring. These are useful control principles, but the board must adapt them with its bank, CPA, attorney, insurer, and governing documents.

This questionnaire is general board education, not legal, accounting, audit, banking, insurance, cybersecurity, tax, employment, investment, debt-collection, or law-enforcement advice. Controls, bank services, contracts, software, crimes, and state laws vary. Use qualified community-association counsel, a CPA, the association's bank and insurer, and other appropriate advisers for the actual community.

1. Map every account and custodian

Ask the candidate to inventory every place association value or financial data can be held:

• operating bank accounts;
• reserve accounts;
• money-market, certificate, and investment accounts;
• lockbox and payment-processor balances;
• merchant reserves or holds;
• checks awaiting deposit;
• credit and purchasing cards;
• petty cash;
• owner-ledger credits;
• vendor credits and deposits;
• insurance proceeds;
• utility deposits;
• tax refunds;
• escrowed or restricted funds;
• accounting software;
• bank portals;
• payment applications;
• document storage; and
• archived records.

For each item, request the legal owner, title, taxpayer identification number, financial institution, account ending, authorized signers, online administrators, read-only users, transaction users, approval rules, statement destination, reconciliation owner, board access, insurance or protection limits, renewal or maturity date, and transition process.

Red flag: the candidate cannot produce an association-level account map or says all communities use a pooled account without a clear legal, banking, accounting, and contractual explanation reviewed by the association's professionals.

2. Confirm association ownership and no commingling

Ask:

1. In whose legal name is each bank, processor, and investment account opened?
2. Which taxpayer identification number appears on the account?
3. Can the association obtain statements and balances directly from the institution?
4. Can the board recover administrator access without the manager's cooperation?
5. Are association funds ever deposited into an operating account owned by the management company or another community?
6. How are processing settlements, returned payments, merchant reserves, and unidentified deposits separated by association?
7. How do staff prevent a payment, vendor, invoice, bank transfer, or journal entry from being assigned to the wrong community?
8. What happens to bank and processor access when the contract ends?

Request a redacted bank-title page, signature-card workflow, online-role map, sample direct statement, and contract language on account ownership and successor access. A ledger entry saying money belongs to the HOA is not the same as an account titled to the HOA.

3. Separate duties instead of adding decorative approvals

Have the candidate identify who can:

• create or change a vendor;
• enter an invoice;
• code an invoice;
• approve an invoice;
• change payment instructions;
• release an ACH or wire;
• print or sign a check;
• use a card;
• add a bank user;
• reset another user's credentials;
• record a deposit;
• enter a journal entry;
• reconcile a bank account;
• review the reconciliation;
• close or reopen a period;
• edit owner balances;
• waive charges;
• issue refunds; and
• export or delete financial records.

Then ask for the system report that proves the answer. An employee handbook or verbal promise is not enough when the software gives one administrator all powers.

For a small management company, perfect separation may be impractical. The candidate should explain compensating controls, such as board approval, bank positive pay, payment limits, independent statement review, owner notification, daily exception reports, CPA review, or direct board access. The board should understand the residual risk rather than accept the phrase "dual control" without evidence.

4. Test vendor creation and bank-detail changes

Vendor master records are a high-risk point because a legitimate invoice can be redirected to a fraudulent account. Ask the candidate to demonstrate:

• how a new vendor is requested;
• required W-9 and identity information;
• contract and insurance verification;
• duplicate-vendor search;
• conflict-of-interest disclosure;
• sanctions or licensing checks when appropriate;
• who enters the vendor;
• who independently approves it;
• who can change address or bank data;
• how the prior information is retained;
• whether the system alerts reviewers; and
• how dormant vendors are disabled.

The FBI recommends verifying changes to account information through a secondary channel. Ask whether staff call a known, independently sourced number rather than the number in the change email. Test a message that appears to come from a familiar contractor, board president, attorney, or executive asking for an urgent bank change.

Request a redacted change log showing requester, old value, new value, verifier, verification channel, approval, timestamp, and first payment after the change.

5. Walk an invoice from receipt to payment

Give each finalist the same sample invoice and ask it to demonstrate:

1. controlled receipt;
2. duplicate search;
3. vendor validation;
4. contract, work-order, or purchase match;
5. association and fund selection;
6. general-ledger coding;
7. budget check;
8. supporting document attachment;
9. approval routing;
10. conflict handling;
11. payment release;
12. bank confirmation;
13. remittance;
14. posting date;
15. reconciliation; and
16. board-report presentation.

Repeat the test with a credit memo, recurring invoice, partial payment, disputed charge, emergency expense, reserve-funded project, change order, invoice just below an approval threshold, and invoice from a company connected to a director, employee, or management-company owner.

Ask who can override the normal workflow, what reason is required, who receives the alert, and where the exception appears in the next board packet.

6. Examine money-movement controls

For checks, ACH, wires, internal transfers, reserve transfers, refunds, card transactions, and cash withdrawals, ask:

• What limits apply by user, account, method, and day?
• Which payments require two independent approvals?
• Is the second approver meaningfully independent?
• Does approval occur in the accounting system, bank, or both?
• Can the preparer approve or release the same transaction?
• Can payment details change after approval?
• Does the bank support positive pay, ACH blocks, filters, callbacks, or transaction alerts?
• Who receives bank alerts directly?
• How are urgent payments verified?
• How are reserve withdrawals authorized and documented?
• How are rejected, returned, stopped, or voided payments handled?
• What report lists manual and out-of-policy transactions?

Do not assume two clicks equal dual control. If the same person controls both credentials or can change the approver, the board does not have independent authorization.

7. Review check controls

Ask where check stock is kept, who can access it, how unused numbers are inventoried, how signatures are applied, whether signature images are protected, how positive pay works, who reviews exceptions, and how voided or spoiled checks are retained.

Request the policy for manual checks, online bill-pay checks, emergency checks, checks payable to staff or directors, stale checks, stop payments, returned checks, and replacement checks. Test whether the accounting system, bank, and board report all show the same payee, amount, date, and status.

Red flag: blank signed checks, shared signature images, or one employee who can create a vendor, print a check, release it, and reconcile the account without an independent review.

8. Review cards and employee spending

Ask which people can receive a card, whether the card is in the association's or management company's name, individual limits, merchant-category restrictions, cash access, receipt deadlines, coding, supervisor review, board visibility, disputed-charge procedure, card return, and cancellation.

Test fuel, online purchases, subscriptions, restaurant charges, split transactions, missing receipts, personal charges, refunds, tips, international transactions, and a card used during an emergency. Determine whether the manager earns rebates or points, who owns them, and how that arrangement is disclosed.

Request a redacted monthly card reconciliation and exception report. A statement balance paid on time is not proof that each transaction was authorized and supported.

9. Trace owner payments and deposits

Ask the candidate to trace an online payment, lockbox check, office check, returned payment, chargeback, unidentified deposit, and wrong-unit payment from owner authorization through processor, batch, bank statement, owner ledger, general ledger, reconciliation, and owner communication.

Questions should include:

• Who is merchant or processor of record?
• How often are deposits settled?
• Are fees netted or posted separately?
• Who can issue refunds?
• Who can change settlement accounts?
• How are merchant holds or reserves reported?
• How are checks endorsed, scanned, stored, and destroyed?
• Can staff accept cash, and if so, under what controls?
• How quickly are unidentified receipts investigated?
• What happens to payments during a management transition?

Request a sample deposit-reconciliation package. Owner-payment convenience does not replace cash control.

10. Demand complete bank reconciliations

The candidate should demonstrate a reconciliation package containing:

• independent bank statement;
• book balance;
• bank balance;
• cleared activity;
• deposits in transit;
• outstanding payments;
• adjustments;
• stale items;
• preparer;
• reviewer;
• completion date; and
• explanation and owner for every exception.

Test a disconnected feed, duplicate import, stale check, reversed deposit, merchant timing difference, bank fee, one-sided transfer, incorrect opening balance, and transaction posted after the period was closed.

Ask whether the reviewer receives the statement independently from the bank and whether the board has direct read-only access. Imported or matched transactions are not a completed reconciliation.

11. Protect reserves and investments

Ask how reserve accounts are titled, separated, invested, transferred, reconciled, and reported. Identify who can initiate and approve a reserve withdrawal, what board evidence is required, whether the bank enforces a separate approval, and who receives alerts.

For certificates or investment accounts, ask about maturity calendars, early-withdrawal terms, insurance limits, institution exposure, authorized investment policy, interest posting, reinvestment authority, statements, tax reporting, and transition access.

Request a sample reserve-transfer file with board authorization, invoice or purpose, bank evidence, accounting entry, reconciliation, and board-packet presentation.

12. Control journal entries and owner-ledger adjustments

Ask who can enter, approve, post, backdate, reverse, or delete a journal entry. Request reports for manual entries, entries posted directly to cash or receivables, round-dollar entries, weekend entries, late-night entries, entries by administrators, reopened periods, and entries lacking support.

Owner-ledger controls should cover charges, credits, waivers, late fees, interest, write-offs, transfers between units, refunds, starting balances, ownership changes, payment plans, legal accounts, and corrections after closing.

Require a durable audit trail showing original entry, reason, supporting evidence, actor, reviewer, timestamps, and resulting reports. A correction should fix the books without erasing the history.

13. Evaluate monthly board oversight

Ask for a sample monthly package containing:

• balance sheet;
• income and expense statement;
• budget comparison;
• cash by bank account;
• bank reconciliations and statements;
• owner-receivables aging;
• prepaid assessments or credits;
• open bills;
• reserve activity;
• capital-project tracking;
• management fees and reimbursable expenses;
• manual journal entries;
• vendor and bank-detail changes;
• payment exceptions;
• card exceptions;
• stale items;
• unresolved deposits; and
• a concise action list.

Ask a director to trace a material number to the transaction and original document. Determine how the board asks questions, how corrections are tracked, whether prior packets remain available, and what personal or privileged information is restricted.

14. Inspect system access and audit logs

Create a role matrix for board directors, treasurer, manager, portfolio supervisor, accountant, accounts-payable employee, on-site staff, auditor, vendor, and owner. Include viewing, creating, editing, approving, releasing, exporting, deleting, adding users, changing roles, managing integrations, accessing bank data, and account recovery.

Ask for evidence of:

• individual accounts;
• appropriate multifactor authentication;
• password and session controls;
• administrator limits;
• quarterly access reviews;
• prompt offboarding;
• log retention;
• alerts for privileged changes;
• failed-login monitoring;
• device or location controls where used;
• service-account ownership; and
• association-controlled recovery.

FDIC guidance discusses administrative privilege controls, transaction logs, anomaly monitoring, and layered security. The association should assess these principles across the manager, software, bank, processor, email, document storage, and connected applications.

15. Test business email compromise response

Use a tabletop scenario: a director's email appears to request an urgent wire to a new closing account. Ask the candidate to show the exact steps, people, phone numbers, logs, and decision points.

A response plan should address:

• stop and independent verification;
• known-number callback;
• account and user containment;
• bank notification;
• recall or reversal request;
• evidence preservation;
• email and forwarding-rule review;
• software and credential review;
• insurer notice;
• counsel and law-enforcement coordination;
• board escalation;
• resident or vendor communication where appropriate;
• accounting correction; and
• lessons learned.

The FBI advises victims to contact the financial institution immediately and provides reporting through IC3. Ask the candidate whether staff know the bank's fraud number and the association's insurance-notice requirements before an incident occurs.

16. Review insurance and fidelity coverage

Ask for evidence of the management company's crime, fidelity, cyber, professional-liability, general-liability, workers' compensation, and other relevant coverage. Determine whether the association is named or protected as required by contract, which employees and subcontractors are covered, limits, deductibles, exclusions, prior acts, notification deadlines, cancellation notice, and how claims involving association funds are handled.

The association should separately review its own fidelity or crime coverage with its broker. Management-company insurance is not a substitute for association coverage, contractual controls, or bank controls.

17. Examine related parties and conflicts

Ask the candidate to disclose ownership, family, referral, rebate, commission, revenue-share, affiliate, banking, insurance, investment, software, collection, maintenance, and vendor relationships that can affect association spending.

Request the process for:

• annual staff and executive disclosures;
• transaction-specific disclosures;
• director and committee conflicts;
• competitive bids;
• affiliate pricing;
• rebates and purchasing programs;
• management-company markups;
• gifts and entertainment;
• subcontractors; and
• board approval and minutes.

The question is not only whether a relationship exists. It is whether the association can see the economics, alternatives, decision authority, service evidence, and exit rights.

18. Ask about complaints, whistleblowing, and investigations

How can an employee, director, owner, vendor, or auditor report a concern without routing it to the person involved? Ask about confidential reporting, anti-retaliation rules, triage, evidence preservation, conflict-free investigators, counsel, insurer and law-enforcement escalation, board notification, corrective action, and record retention.

Request anonymized examples of how the company handled a suspected duplicate vendor, altered payment instruction, unauthorized card charge, missing deposit, administrator misuse, or accounting manipulation. The board is evaluating the process, not asking for private client details.

Red flag: the candidate says fraud cannot happen because employees are trusted.

19. Verify CPA and auditor access

Ask whether the association can give its independent CPA direct read-only access to accounting records, statements, reconciliations, invoices, approvals, ledgers, journal-entry reports, audit logs, contracts, and requested confirmations. Determine who controls the data request, how quickly records are produced, and whether the manager charges extra.

Ask how proposed adjustments are approved, posted, documented, and reflected in later reports. A management company should not limit the auditor to selected screenshots or require all questions to pass through the employee whose work is under review.

20. Protect the transition

Before selecting the company, ask it to demonstrate a hypothetical exit. The transition package should include:

• association-titled account and signer map;
• bank and processor access;
• statements and reconciliations;
• chart of accounts and full general ledger;
• owner and unit records;
• charges, payments, credits, and aging;
• vendors, bills, approvals, and W-9 records;
• budgets and financial statements;
• journal entries and audit logs;
• reserve and investment records;
• cards and check controls;
• tax and insurance records;
• contracts and related-party disclosures;
• open fraud or dispute matters;
• administrator and service-account inventory;
• original documents and attachments;
• structured exports; and
• final-close and credential-removal evidence.

Request sample exports and import them into a test environment. A PDF archive is useful evidence but is not a substitute for structured records a successor can operate.

21. Score evidence, not confidence

Use a weighted scorecard. One reasonable starting allocation is:

• 15 percent: association ownership, account separation, and direct access;
• 15 percent: accounts payable, vendor changes, and money movement;
• 15 percent: reconciliations, journal entries, and monthly reporting;
• 10 percent: owner payments, deposits, refunds, and receivables;
• 10 percent: reserve and investment controls;
• 10 percent: access security, logs, and account recovery;
• 10 percent: fraud response, insurance, and complaints;
• 5 percent: conflicts and related-party transparency;
• 5 percent: CPA access and independent review; and
• 5 percent: transition, exports, and successor cooperation.

Score each item from zero to four:

• 0 — absent: no defined control;
• 1 — promised: verbal assurance only;
• 2 — documented: policy or contract language exists;
• 3 — demonstrated: candidate shows a working example and evidence; or
• 4 — verified: demonstration, client reference, bank or system evidence, and contract all align.

Add a risk note and required contract term beside every score below three. A polished proposal should not outweigh missing access, unverifiable controls, or an exit process that depends on goodwill.

22. Ask references about the control environment

Ask reference boards:

• Do directors receive bank information independently?
• Are reconciliations complete and timely?
• Can you trace a payment to approval and bank evidence?
• Have vendor bank changes been verified correctly?
• Are financial corrections transparent?
• Does the board have direct report and document access?
• Have you experienced unauthorized, duplicate, late, or misapplied transactions?
• How did the company respond to a suspected fraud or payment issue?
• Are reserve transfers clearly approved and reported?
• Does the CPA receive complete records promptly?
• Were management fees and affiliates transparent?
• Did former employees lose access promptly?
• Could you recover every account without one manager?
• Have you completed a transition, and was the financial handoff usable?

Ask for references with a similar unit count, banking complexity, staffing model, and portfolio structure. A community that has never used electronic payments or reserve projects may not test the controls your association needs.

23. Put the controls in the contract

The final agreement and exhibits should address:

• association ownership of funds, accounts, records, and data;
• prohibited commingling;
• authorized institutions and account types;
• board and CPA direct access;
• signer and administrator changes;
• invoice and payment approval thresholds;
• vendor-detail verification;
• reserve-transfer authority;
• cards, checks, ACH, and wires;
• reconciliation and reporting deadlines;
• exception and incident reporting;
• related-party disclosure;
• confidentiality and cybersecurity;
• insurance and fidelity evidence;
• audit and examination rights;
• subcontractor controls;
• records retention;
• complaint and fraud cooperation;
• structured exports;
• final close;
• transition timetable;
• credential removal; and
• survival of records and cooperation duties after termination.

Ask counsel to reconcile these terms with the bank resolutions, governing documents, board delegations, insurance requirements, software terms, and actual operating demonstration.

Bottom line

A management company does not become trustworthy because it handles many communities or uses well-known software. Trustworthy financial administration is observable: association-titled accounts, independent access, separated duties, verified vendor changes, controlled money movement, complete reconciliations, useful board reports, durable audit trails, tested incident response, and a transition the association can complete without losing control.

Require evidence before selection, contract to the demonstrated process, and retest the controls after implementation. The board remains responsible for oversight even when the manager performs the work.

Sources

• FBI Internet Crime Complaint Center — Business Email Compromise
• FBI IC3 PSA (April 6, 2020) — Cyber Criminals Conduct Business Email Compromise through Exploitation of Cloud-Based Email Services
• FDIC — Authentication and Access to Financial Institution Services and Systems
• Federal Trade Commission — Scams and Your Small Business
• Foundation for Community Association Research — Preventing Fraud and Embezzlement
• CAI HOAresources — Preventing Fraud and Embezzlement in Your HOA
• CAI HOAresources — Guarding Your Association's Finances
• CAI Blog — Avoiding Financial Fraud

Related ManageMatch guides

• HOA management contract clauses checklist
• HOA management company reference check
• HOA management company cybersecurity questionnaire
• HOA management company vendor procurement and conflict-of-interest questionnaire
• HOA management transition checklist