Common Compliance Deficiencies in HUD Multifamily Audits

HUD issued a memorandum on July 23, 2026, reminding multifamily housing owners and management agents of their audit fraud risk responsibilities, and naming embezzlement, theft, and false certifications as the specific dangers it was written to counter. That memo did not introduce a new rule. HUD's Consolidated Audit Guide has long governed independent audits of profit-motivated program participants across HUD Housing and Ginnie Mae programs, under the uniform financial reporting standards set out in 24 CFR Part 5, Subpart H, and 24 CFR Part 202.5(g). A regulator does not reissue a reminder about a standard everyone already follows. The act of reissuing it is itself evidence that compliance with a mandatory, long-standing rule has been slipping in a way that is systemic rather than accidental.

What would cause a well-documented, mandatory standard to erode in practice rather than on paper? The sources point to a workload problem. In the Section 232 subsector, the average number of properties each ORCF staff member managed grew from 60–80 to 165–200. Oversight capacity did not expand to match the portfolio it was meant to monitor, and the deficiencies that keep surfacing in audits are largely what happens when review capacity falls behind the volume of activity it has to check. That distinction matters for how the rest of this piece is framed. Every category examined below, financial reporting, reserve accounts, income certification, HOTMA, NSPIRE, traces back to the same structural condition: rules that are clear on paper but under-monitored in practice, which makes the failure points predictable rather than random.

The financial reporting failures that produce findings most often

The financial reporting requirement itself is not simple. REAC filings for multifamily housing must include audited financial statements, supplemental schedules, surplus cash computations, footnotes and certifications, and internal control and compliance reports, all built to HUD's Uniform Financial Reporting Standards and all due within 90 days of calendar year-end. A late submission can trigger a referral to HUD's Departmental Enforcement Center. That volume of required documentation, produced annually under a fixed deadline, is exactly the kind of pipeline where a gap in internal review becomes a predictable finding rather than a surprising one.

Across HUD OIG audits, three findings recur more than any others: surplus cash miscalculation, unauthorized distributions, and inadequate corrective action plans. The Surplus Cash Report sits at the center of the first two. A mismatch between the audited financial statement and the surplus cash calculation produces a "Financial Management" finding automatically, regardless of how the mismatch happened. Owners sometimes argue that a surplus cash discrepancy is a calculation dispute rather than a compliance failure, but HUD does not weigh intent when the numbers do not reconcile. That is precisely why the mismatch is preventable: it is a documentation and reconciliation problem, not a legal ambiguity, and it can be caught before the audit rather than during it.

The owner is not a bystander in this process, and selects the auditor, produces the underlying records, certifies the information submitted, and responds to whatever findings result. A reconciliation process that runs continuously through the year, rather than being assembled in the 90 days before the deadline, closes the exact gap that produces a surplus cash mismatch in the first place.

Section 232 subsector concentrates and amplifies financial deficiencies

Section 232, HUD's mortgage insurance program for skilled nursing and residential care facilities, insures thousands of loans with an unpaid principal balance exceeding $32 billion. That scale means the same financial reporting deficiencies visible across multifamily broadly produce a heavier consequence here: default. The audited financial statements disclosed three systemic deficiencies in the defaulted portfolio: borrowers withdrew funds when properties did not have available surplus cash, properties had cash deficiencies, and properties did not generate sufficient cash flow to pay current debts. That is the same finding cluster covered in the previous section, surplus cash problems and unauthorized withdrawals, but playing out where the stakes are loan default rather than an audit citation.

The oversight side of the equation looked no better. HUD ORCF did not receive audited financial statements from all borrowers as required, did not ensure borrowers fully developed action plans to address risks threatening property viability, and did not notify the Departmental Enforcement Center before borrowers defaulted.

One might ask whether this pattern has already been addressed, given how well-documented it now is. It has not, since HUD OIG has an ongoing audit of HUD's oversight of Section 232 nursing home portfolios, and the deficiency pattern described here is still active, with scrutiny increasing rather than winding down. For a borrower operating in this subsector, the conclusion is straightforward: general multifamily compliance practices are not sufficient. Section 232 properties need reporting discipline calibrated to a program where the same errors that produce a finding elsewhere can produce a default here.

Reserve account misuse and unauthorized distributions as enforcement triggers

Among all the deficiency types discussed so far, one carries a shorter path from finding to enforcement than the rest. Withdrawing funds without available surplus cash is the single deficiency most likely to escalate from an audit finding to a Departmental Enforcement Center referral. In the Section 232 subsector, unauthorized fund withdrawals stood as one of three primary findings and functioned as a leading indicator of default itself.

Distributions may only be made from surplus cash, a rule that is simple to state and easy to violate without noticing. A distribution made when surplus cash is not actually available is not treated by HUD as a minor procedural slip. The July 2026 memo names this exact category, alongside embezzlement and false certification, as one of the fraud risks it is written to guard against, placing it in the same enforcement conversation as fraud rather than alongside routine paperwork errors. It is not filed alongside routine paperwork errors; it sits in the same enforcement conversation as fraud.

HUD's own monitoring reflects that weight. Post-submission statements are reviewed specifically for cash deficiencies and for distributions made without surplus cash on hand; this is a standing target of ongoing review. The practical implication for an owner considering any distribution is narrow and specific: confirm, before the money moves, that the surplus cash computation is current, reconciled against the audited financials, and documented. The same mismatch that produces an automatic "Financial Management" finding under the previous section is the mismatch that makes an unauthorized distribution nearly impossible to defend after the fact. Reconciliation timing decides whether a finding is one an owner can explain or one that HUD escalates.

EIV data security and income certification errors as the highest-frequency MOR findings

Moving away from the financial statement audit and into the routine Management and Occupancy Review changes the leading deficiency completely. EIV errors account for roughly half of all MOR findings, making income verification and data security the highest-frequency compliance failure in day-to-day operations. No other single area comes close. EIV is the most scrutinized area in management and occupancy reviews because it involves sensitive data security alongside income accuracy.

Those two risks do not overlap in how they fail. Data security failures come from lapses in access controls, use policies, or employee training around who can view EIV data and how. Income discrepancies come from a separate source: a failure to reconcile what EIV reports against what the tenant certification actually says. A property can have airtight access controls and still generate an EIV finding because certification files were never checked against the system's income data, or the reverse: certifications may be accurate while the access log shows staff viewing records without a documented reason. Both failure types point to the same underlying issue. EIV compliance is not a control an owner sets up once and files away. It requires an ongoing, documented process, checked repeatedly rather than confirmed at intake and left alone.

Enterprise Income Verification has been a fixture of HUD compliance for years. The high finding rate is a process story: reconciliation between two systems (EIV data and tenant certification files) is a recurring task, not a one-time event, and a program that treats it as the latter will keep generating findings no matter how familiar staff are with the underlying requirement. That distinction, between knowing a rule and operationalizing it continuously, is the same one running through every section of this piece, and it becomes especially important heading into the next compliance layer.

HOTMA's 2027 deadline and the 2026 preparation window

HUD extended the mandatory compliance deadline for HOTMA under Multifamily Housing programs to January 1, 2027, through Notice H 2025-07, published December 17, 2025, and confirmed that Management and Occupancy Reviews will not issue HOTMA findings before that date. On its face, that reads as relief. It is not: HUD has been explicit that 2026 should be used for preparation, updating policies and procedures, training site staff, reviewing forms and workflows, and preparing for related updates, not as additional runway to defer action. The deadline moved. The volume of work required to meet it did not shrink at all, and every deficiency already covered in this piece, especially the EIV reconciliation habits from the previous section, still has to be fixed on top of whatever new HOTMA requirements are layered in.

One of HOTMA's clarifications shows how easy it is to get this wrong even with a year of notice. Adding or removing a household member generally triggers a required interim reexamination, regardless of whether the household's income changed at all. Many sites have handled interim reexams for years as an income-driven event only, triggered when a tenant's earnings go up or down. Under HOTMA, a household composition change alone is enough to require the reexamination, and sites that keep applying the old logic will generate a procedural finding even in cases where the income figures on file are completely accurate.

What if an owner simply waits, treating the extension as a full year of breathing room before doing anything? That is precisely the trap the extension creates. Sites that delay implementation into late 2026 will run into compressed timelines to update software, retrain staff, and rebuild forms, layered on top of the same documentation gaps that already drive today's EIV findings. Some owners read the deadline extension as a signal that HUD's enforcement posture is loosening as well, but that reading does not hold up. MOR reviewers will assess compliance against January 1, 2027 as a firm date, and file audits will reveal preparation gaps well before any formal enforcement action follows. The safest way to read the 2026 window is as the last full year to close the gaps that already exist before a new rule set starts measuring them.

Scoring under NSPIRE's full-enforcement environment

Physical inspection has undergone its own structural shift. HUD replaced the older UPCS standard for multifamily and public housing, and the HQS standard for vouchers, with a single unified model called NSPIRE. NSPIRE has applied to HUD-assisted multifamily properties since October 2023, and the phase-in period that gave certain new requirements a grace period from scoring ends October 1, 2026, when HUD begins scoring affirmative requirements in full. The grace window is closed. Every deficiency now found during inspection carries points and a repair deadline, so understanding how that weight is assigned matters for avoiding failure.

Every deficiency is rated Life-Threatening, Severe, Moderate, or Low. That tier controls two things at once, how many points a property loses and how fast it has to fix the problem. For Life-Threatening and Severe deficiencies, a 24-hour correction clock starts the moment the inspector hands over the Health and Safety Report at the end of an inspection day, and multi-day inspections generate a fresh report and a fresh clock each day. Scoring itself now runs against two separate thresholds rather than one. A property fails if its overall score drops below the minimum, and it also fails if enough points get deducted specifically from in-unit deficiencies, regardless of how well the rest of the property scores. A property with immaculate grounds and common areas can still fail purely on findings inside occupied units, which is a sharp departure from how UPCS scoring behaved.

The consequence for a low score is not abstract. A result in the lowest scoring range triggers an automatic referral to HUD's Departmental Enforcement Center. A February 2024 report found HUD did not issue a substantial share of notices of violation or default to owners in a timely manner for failure to maintain properties in decent, safe, and sanitary condition, and did not always receive or maintain required EHS certifications or owners' surveys confirming deficiencies were corrected. NSPIRE's stricter scoring arrives on top of a monitoring system that OIG has already flagged for gaps in enforcement follow-through, signaling that the deficiency pattern is not yet resolved and that scrutiny is actively increasing.

A handful of specific items deserve direct attention because they behave differently than the rest of the scoring model. HUD delayed scoring on several affirmative requirements, fire-labeled doors, GFCI protection, guardrails, HVAC performance, and permanent lighting, through October 1, 2026, but the underlying correction obligation for these items never went away even while scoring was paused. Smoke alarm defects do not subtract points directly; they appear as an asterisk next to the overall score. Carbon monoxide alarm defects get a plus-sign flag instead of a direct score penalty and must be corrected immediately. Neither symbol tanks a score the way a Severe in-unit deduction does, but both function as a flare sent up to HUD that a property's basic life-safety systems are not holding, and that kind of flag invites exactly the scrutiny an owner wants to avoid.

None of this is knowable only on inspection day. Properties are already required to run annual self-inspections of every unit, and the preparation window that actually matters is the 90 days before an inspection, not the short formal notice period HUD provides. Used correctly, that annual self-inspection is a dry run against NSPIRE's own severity tiers rather than a paperwork exercise, and it is the one tool available to catch a Severe in-unit deficiency before an inspector does, at a point when the fix is still routine maintenance rather than an enforcement referral.