HUD Multifamily Audit Requirements

Ownership structure is the primary sorting mechanism. That single variable, whether the entity is for-profit or nonprofit and governmental, determines which audit track applies, which guidance document the CPA works from, and how findings are categorized and reported. HUD's oversight architecture was built around the nature of the federal relationship, not merely program size, and that design choice has real consequences for how participants prepare.

For-profit entities, including FHA multifamily housing programs, FHA-approved lenders, and Ginnie Mae issuers, fall under HUD's uniform financial reporting standards at 24 CFR Part 5, Subpart H and 24 CFR Part 202.5(g). The operative guidance document is HUD Handbook 2000.04, the HUD Consolidated Audit Guide, issued by the HUD Office of Inspector General. That guide governs how the CPA scopes the engagement, applies audit procedures, and structures the report.

Nonprofit and governmental entities follow a different track entirely. Their audits are governed by the Single Audit Act and the OMB Uniform Grant Guidance at 2 CFR Part 200.500. The HUD Consolidated Audit Guide does not apply to them. The two tracks test different compliance areas, require different report formats, and feed into different oversight channels. Conflating them produces a fundamentally misdirected engagement, not a clerical error.

Both tracks share certain baseline requirements: an independent certified public auditor, adherence to generally accepted auditing standards (GAAS), and compliance with generally accepted government auditing standards (GAGAS). The shared floor is high; the divergence above it is significant.

Two participant categories deserve particular attention because their audit triggers are categorical rather than threshold-based. Any Ginnie Mae issuer carrying a remaining principal balance in its Ginnie Mae program at the end of the audit period is subject to audit regardless of expenditure level. Any FHA-approved lender that originated or serviced loans during the audit period is similarly subject to audit without reference to a dollar threshold. Federal exposure creates the requirement.

The Expenditure Thresholds That Trigger a Full Audit, and the 2024 Change That Shifted Them

For for-profit multifamily projects, the threshold has two triggers: annual expenditures of $500,000 or more, or HUD-insured and HUD-guaranteed loan balances of $500,000 or more. The loan balance trigger is the one that catches people off guard. An entity can operate with modest annual expenditures and still carry a full audit obligation if the outstanding insured or guaranteed loan balance reaches $500,000. But what if an owner is focused entirely on the operating statement rather than the balance sheet? That is precisely the scenario where this trigger goes unnoticed, and the resulting compliance gap is not theoretical.

For nonprofit multifamily projects, the threshold recently shifted. For fiscal years beginning before October 1, 2024, the trigger was $750,000 in federal expenditures, consistent with the prior Single Audit threshold under 2 CFR Part 200.501. For fiscal years beginning on or after October 1, 2024, that threshold rises to $1,000,000, following OMB's April 2024 revision to the Uniform Guidance at 2 CFR Part 200. Some smaller nonprofit-owned properties that previously required a full Single Audit may no longer meet the new threshold. That raises an important question: does that mean the obligation has simply disappeared? It does not, and that assumption warrants a direct conversation with the entity's CPA before anyone acts on it.

The for-profit and nonprofit thresholds now sit at materially different levels: $500,000 and $1,000,000, respectively. For entities navigating mixed ownership structures or an ownership conversion mid-fiscal year, this gap warrants attention early, not at year-end.

There is also a carve-out on the for-profit side worth understanding on its own terms. HUD Housing Notice H 2013-23 allows owners of projects receiving less than $500,000 in federal financial assistance to submit an owner-certified GAAP-basis financial statement with notes to REAC in lieu of a full audit. This is a deliberate policy accommodation calibrated for smaller properties where the cost of a full audit is disproportionate to the federal exposure. Qualifying for it requires an accurate accounting of total federal financial assistance, not just operating subsidy.

What a HUD Multifamily Audit Actually Consists of: The Two-Component Structure

HUD does not require one audit. It requires two distinct components, conducted by the same independent CPA under the same engagement, serving different functions and producing different outputs. This is where experienced owners often carry an incomplete picture.

The first component is a financial statement audit. It tests whether the entity's financial statements are fairly presented in accordance with GAAP, which is what most property owners picture when they hear the word "audit."

The second component is a compliance audit. It tests whether the entity is managing HUD programs in accordance with applicable laws, regulations, and the terms of federal awards and guarantees. This component reaches into operational practices that a standard financial statement audit would never touch. One might argue that an owner who has sailed through financial statement audits for years without difficulty is well prepared for this component — but that conclusion does not hold. The two engagements are asking fundamentally different questions.

The HUD Consolidated Audit Guide frames three objectives for the compliance component: whether financial data and reports can be relied upon; whether internal controls provide reasonable assurance that programs are being managed in compliance; and whether federal funds were expended properly and with adequate supporting documentation. These map directly to what HUD needs to assess ongoing portfolio risk.

For FHA multifamily housing programs, Chapter 3 of the Consolidated Audit Guide is the operative chapter. It applies to both for-profit and nonprofit entities in those programs and provides the suggested audit procedures CPAs follow. Chapter 1 covers general requirements; Chapter 2 covers reporting. Participants who want to understand what their auditor is actually doing should read Chapter 3 before the engagement begins, not after the fieldwork is complete and the findings letter is drafted.

The Specific Compliance Areas Auditors Test Inside a Multifamily Property Audit

Chapter 3 testing relies on attribute sampling throughout, a statistical sampling methodology the guide specifies to ensure consistency and adequate coverage across the engagement.

Tenant file and eligibility testing involves selecting a sample of current and former residents and verifying that each tenant was eligible for assistance and that rental amounts were calculated in accordance with HUD guidelines. Incomplete or poorly documented files are among the most common sources of compliance findings. Why exactly does this happen? The reason is fairly predictable: files assembled reactively at audit time reflect the chaos of the year rather than the discipline of an ongoing process. The files do not improve during fieldwork.

Rental income procedures verify that rental income and tenant assistance payments are neither overstated nor understated. Auditors review a sample of cash receipts against supporting documentation. The concern runs in both directions: overstatement raises questions about phantom income or improper subsidy claims; understatement raises questions about unrecorded cash or identity-of-interest transactions.

Cash disbursements testing is where equity skimming surfaces. Rent, assets, proceeds, and income derived from the project must be used only for actual and necessary project expenses. Unauthorized distributions, unauthorized loans of project funds, and payments to related parties that cannot be documented as legitimate project expenses can all trigger equity skimming findings under Section 537 of the National Housing Act. The consequences extend well beyond the administrative.

Surplus cash and distribution testing is one of the more technically complex areas. Many governing documents restrict distributions to once or twice annually, and only after calculating surplus cash using HUD's specific formula. Related-party payments, including advances, loan repayments, and capital distributions to identity-of-interest entities, are treated as distributions for this purpose. It is also worth considering a practical tension that produces genuine surprises: HUD's surplus cash calculation and a partnership or operating agreement's definition of distributable cash flow can produce materially different numbers. The more restrictive figure governs. Owners who believe they are operating within their partnership agreement while inadvertently violating HUD's surplus cash rules typically discover this distinction during fieldwork, not during planning.

Reserve for Replacement testing verifies that required deposits are being made and that any withdrawals are HUD-authorized. Straightforward when records are current; complicated when they are not.

Cash receipts testing confirms that all cash received, including amounts collected by a management agent on the project's behalf, is deposited into a federally insured account held in the project's name. The obligation runs to the owner. The management agent's handling is the owner's exposure.

Federal financial reports must contain reliable data and conform to the terms of the agreements between the project and HUD. Auditors verify this directly.

How Audited Results Are Submitted Through REAC and the FASSUB System

HUD's Real Estate Assessment Center (REAC) is the receiving body for electronic financial submissions. Multifamily housing entities submit through the Financial Assessment Subsystem, known as FASSUB. Public housing entities use a separate system, FASS-PHA. These are distinct platforms, and participants who operate across both program types need to track that distinction explicitly, as UFRS reporting requirements differ between them.

A complete FASSUB submission includes audited financial statements, supplemental schedules, surplus cash computations, footnotes and certifications, and internal control and compliance reports. Submission must align with HUD's Uniform Financial Reporting Standards (UFRS) and be validated against the hard copy documents the auditor has produced.

The responsibility split matters. The property owner, or public housing agency where applicable, is responsible for the electronic submission through REAC. The auditor produces the materials being submitted. These are distinct responsibilities and distinct processes. Assuming the auditor handles submission is a mistake that creates deadline exposure, and it happens more often than it should.

Selected FASSUB documents were revised as of January 18, 2024. Participants and their CPAs should verify they are working from current forms before beginning the submission process. Using outdated forms is an avoidable source of rejection.

Filing Deadlines, Grace Periods, and What Happens When Submissions Are Late

Multifamily housing entities must submit within 90 days of calendar year-end. For the Single Audit track applicable to nonprofits, submission to the Federal Audit Clearinghouse must be completed within 30 days of receiving the auditor's report, or nine months after fiscal year-end, whichever is earlier.

The grace period structure has two steps. REAC allows a 10-day grace period beyond the original due date. If the audited financial statement has not been received by the tenth day of the month following the due date, HUD issues a formal notification, at which point the property owner has an additional 30 days to submit.

Missing the grace period initiates an escalating sequence: referral to HUD's Departmental Enforcement Center (DEC), a negative impact on the property's FASS score, financial penalties for repeated failures, and ultimately restrictions on program participation or reductions in funding.

The FASS score consequence, where FASS stands for Financial Assessment Subsystem, is not merely bureaucratic. It shapes the property's standing within HUD's broader assessment system and influences funding and program eligibility in ways that compound over time. A late filing is not a minor administrative matter. An owner who accepts a FASS score hit without understanding what that score affects downstream has misjudged the cost.

How the Audit Framework Protects Owners as Much as It Monitors Them

Years of working through these engagements have made me more skeptical of the framing that treats HUD audits primarily as a monitoring mechanism. But how does this reframing affect how owners should approach the process? The audit produces a documented record that the owner operated the property in compliance with HUD's requirements. If a dispute arises later, whether from a former resident, a regulatory inquiry, or a program review, that record is the owner's most defensible asset. The absence of audit documentation is not a neutral condition.

The surplus cash formula, restrictive as it sometimes feels in practice, shields owners from inadvertent equity skimming violations. A defined formula applied consistently and documented annually is far more defensible than a vague contractual standard open to interpretive disagreement.

Tenant eligibility testing, conducted annually, surfaces problems while remediation is still possible. An eligibility error caught during audit fieldwork is a finding. The same error surfaced during a HUD program review or an OIG investigation is a materially different problem, carrying materially different consequences.

The internal control findings component identifies operational weaknesses before they become enforcement matters. A management agent that is not depositing cash receipts into a project-name account is a problem the auditor will find. The question is whether the owner learns about it from a findings letter or from a DEC referral.

The HUD Consolidated Audit Guide's suggested audit procedures in Chapter 3 are publicly available and written with enough specificity to function as a compliance preparation roadmap. The test questions, in effect, are published in advance. Reading Chapter 3 at the beginning of the year tells an owner or management agent exactly what documentation needs to be in place and what operational practices need to hold. Choosing not to read them is a choice with a cost.

The threshold rules, including the 2024 changes for nonprofits and the small-project exception under Housing Notice H 2013-23, exist to calibrate compliance effort to federal exposure. A small property owner spending significant resources on a full audit when a certified financial statement would satisfy HUD's requirements is over-invested. A larger owner who misreads the loan balance trigger and concludes no audit obligation exists is under-invested in a more consequential direction. Calibration requires reading the rules carefully. A thorough audit conducted by a qualified CPA, submitted through the wrong system or filed past the grace period, produces the same enforcement exposure as no audit at all. The components are interdependent, and a weakness in any one creates risk across the others.