Common Compliance Deficiencies in HUD 232 Healthcare Facility Audits

HUD 232 healthcare facility audits carry a recognizable, repeating set of compliance failures, from late financial submissions to unauthorized cash distributions to reserve accounts that don't reconcile. Knowing these failure patterns in detail is now a practical necessity, not background reading, with defaults rising and OIG scrutiny intensifying. The program itself is large and getting larger: ORCF administers more than 3,600 insured loans carrying an unpaid principal balance north of $32 billion, all under the regulatory architecture of 24 CFR Part 232 HUD's Oversight of Section 232 Nursing Home Portfolios | Office of In… Oversight.gov. Loan volume is accelerating too. In the first 26 weeks of fiscal year 2025, lenders closed 130 loans under the program, versus 85 in the same stretch of FY 2024, a jump of roughly 53 percent ORCF Final 232 Documents | HUD.gov / U.S. Department of Housing and U….

More loans closing means more borrowers stepping into compliance obligations they may not fully grasp on day one, and the timing could hardly be less forgiving. As of June 2024, 167 of the program's 3,670 insured borrowers, close to 5 percent, had already defaulted, and those loans alone carried an unpaid balance exceeding $1.1 billion Oversight.gov. The OIG's sample wasn't small either. Auditors reviewed four portfolios spanning 70 properties and 84 loans, a collective balance north of $410.6 million, and every single one of those 84 loans was rated troubled as of June 2024 Oversight.gov. By July 2025, lenders were already in position to file insurance claims on 58 of those 84 loans, totaling more than $329.5 million Oversight.gov.

That is the backdrop against which an updated Section 232 Handbook took effect on January 5, 2026, applying to all new loan applications and transactional requests. The regulatory bar has just been reset, in other words, right as the portfolio it governs is showing more stress than it has in years. What follows is not a random inventory of paperwork problems. A handful of deficiencies recur in troubled loans, each one feeding the next, and understanding that chain is the clearest route to staying out of it.

What the regulatory framework requires borrowers and operators to do

Borrowers and operators are not the same legal or accounting entity under Section 232, and conflating the two is where a surprising number of problems start. For-profit borrowers must submit audited annual financial statements prepared under GAAP within 90 calendar days of their fiscal year end HUD 232 Refinancing: Audit and Financial Statement Essentials – Pease…. Non-profit borrowers get a slightly different path: a borrower-certified unaudited statement within that same 90-day window, followed by the full audited version no later than nine months after fiscal year end HUD 232 Refinancing: Audit and Financial Statement Essentials – Pease….

Operators live under a separate clock. Quarterly financial statements are due within 60 calendar days of each quarter's end, except for the fiscal year-end quarter, which gets the same 90-day runway as the annual borrower statement HUD 232 Refinancing: Audit and Financial Statement Essentials – Pease…. Operator statements can be operator-certified rather than independently audited, unless the operator also happens to be the borrower, in which case the full audit requirement applies regardless HUD 232 Refinancing: Audit and Financial Statement Essentials – Pease…. FASS performs the first assessment of financial condition and compliance once statements land, and anything flagged there, or flagged by the project's own auditor, can get referred either to ORCF directly or to the Departmental Enforcement Center.

Financial statements aren't the only input HUD is watching. The Loan Management Branch also reviews state inspection surveys and CMS ratings alongside FASS submissions, which means a facility's clinical survey results can independently trigger ORCF scrutiny even when the numbers on the balance sheet look fine. The initial audit period for a new loan begins on the closing date and runs through December 31 of that same year, unless closing falls on or after September 1, in which case an automatic deferral pushes the initial period out through the following December 31. Because the federal government is insuring the debt, the reporting demands sit well above what a comparable conventional healthcare real estate loan would require, and that gap holds through every section that follows.

Late and missing financial statement submissions: the deficiency that enables every other problem

Start with the deficiency that makes every other deficiency harder to catch. The April 2026 OIG report found that ORCF did not receive audited financial statements from all borrowers as required, so the program's first and most basic layer of oversight simply wasn't functioning for a meaningful slice of the troubled portfolio. Without those statements arriving on time, account executives had no way to flag cash deficiencies, unauthorized distributions, or going-concern language before a loan actually defaulted.

Why exactly does this happen at scale? Part of the answer is staffing, and the numbers are stark. ORCF's staff fell from 61 employees in October 2024 to 38 by May 2025, which pushed the average number of properties per staff member from 60–80 up to 165–200. That is not a marginal shift in workload; it's a near tripling. A workforce stretched that thin has far less capacity to chase down a missing submission, follow up on a partial filing, or notice that one borrower entity within a larger portfolio has quietly gone dark on reporting.

None of that changes what the borrower owes, though. The instinct to treat a reporting deadline as soft, on the theory that a stretched-thin oversight body won't catch it right away, gets the incentive backward. Reduced ORCF capacity doesn't lower the bar; it delays when the consequence occurs HUD's Oversight of Section 232 Nursing Home Portfolios | Office of In… Oversight.gov.

The practical root causes tend to be mundane. A disorganized closing binder, an auditor engaged too late in the cycle, confusion over which audit period actually applies (especially on a first-year loan), and thin records supporting the opening trial balance all recur repeatedly. Submission itself runs through FASS electronically, so the real planning problem is backward scheduling: fieldwork and report issuance both take time, and records need to be complete in the auditor's hands well before the 90-day deadline, not on it. Reduced ORCF capacity does not reduce compliance obligations, since a borrower who misses the 90-day window is still in default of their regulatory agreement and still subject to referral to DEC HUD 232 Refinancing: Audit and Financial Statement Essentials – Pease….

Unauthorized distributions: the most prevalent substantive deficiency in Section 232 audits

If late filings are the deficiency that hides everything else, unauthorized distributions are the deficiency most often found once someone actually looks. It is consistently cited as the single most prevalent compliance failure category across Section 232 audits. The mechanic behind it is not complicated on paper: surplus cash equals total project cash minus total current liabilities, calculated twice a year, on June 30 and December 31, using Form HUD-93486-ORCF. If that number comes out positive, the owner may distribute up to it. If it comes out negative, no distributions are permitted at all, and anything already taken during that period has to be repaid within 30 days. Borrowers on a non-calendar fiscal year get the same logic applied to their own year-end and the point six months after it.

The April 2026 OIG report found this playing out concretely in one portfolio of 21 properties across 35 loans, where the independent public accountant had reported unauthorized distributions right there on the borrowers' own audited financial statements. OIG's recommendation was blunt: quantify the amount, require repayment, or move toward regulatory enforcement. What makes this finding sting a bit more is ORCF's own explanation for the gap HUD's Oversight of Section 232 Nursing Home Portfolios | Office of In… Oversight.gov. Staff didn't have the manpower to analyze whether borrowers had actually pulled funds improperly, so the deficiency sat disclosed in the audited financials and nothing followed. The information was there. Nobody had the bandwidth to act on it.

So why does this keep happening at the property level, structurally? Closely held ownership is a big part of the answer. When the owner is also the operator, or a related party sits close enough to both roles, cash flow gets managed informally, on gut feel about what the property can probably support, rather than against the formal semi-annual calculation. One might argue that's just how small operators run a business day to day, and there's something to that. But the surplus cash gate doesn't bend for informal management, and distributions taken against an estimated cash position rather than the actual HUD-93486-ORCF calculation are exactly the pattern that produces a repayment demand later. The practical guardrail is almost embarrassingly simple: track the surplus cash calculation continuously, and hold off on any distribution until after the audit closes and confirms there's no overdistribution sitting on the books. A quality audit is built to catch precisely this. An auditor who isn't testing distributions against the surplus cash math isn't doing the job the regulatory framework actually expects.

The three financial statement disclosures that most reliably predict default

Across all 84 troubled loans in the OIG's sample, three disclosures recur repeatedly in the audited financial statements. Borrowers withdrew funds from properties that had no available surplus cash to distribute. Properties reported cash deficiencies. And properties weren't generating enough cash flow to cover current debts. Any one of these on its own raises a going-concern question worth asking.

With defaults rising and OIG scrutiny intensifying, knowing these failure patterns in detail is now a practical necessity, not background reading. The information existed. It just never got converted into corrective action.

Part of that traces back to a genuine gap in the regulations themselves. Borrowers and operators are required to report risks to HUD at any time they arise, but nothing in the current framework requires an action plan until after the default has already occurred. OIG pushed for a proactive action-plan requirement as a policy fix, which makes sense on its face. But until that kind of requirement actually exists, borrowers are left holding the practical implication themselves: these three conditions appearing in a facility's own AFS are a signal to act immediately, not a data point to file away. Waiting for HUD to move first stopped being a safe assumption the moment ORCF's staffing fell this thin. For auditors, the same logic applies from the other direction. Going-concern analysis, cash flow testing, and distribution review aren't boxes to check for form's sake; they are the actual substance of what ORCF and OIG are reading for when an AFS lands on someone's desk. And the risk compounds further for skilled nursing operators specifically, since ORCF also layers CMS survey results on top of the financial picture. A facility carrying deteriorating CMS ratings alongside any one of these three financial conditions sits in a considerably worse position than either factor alone would suggest. ORCF did not ensure all borrowers fully developed action plans to address these disclosed risks, and did not notify the DEC before borrowers defaulted, so the disclosures existed in the audited statements but were not converted into corrective action.

Escrow account misclassification and opening balance errors in initial audits

First-year Section 232 audits carry their own particular failure mode, occurring so often it's practically predictable: HUD escrow accounts, covering replacement reserves, property tax, and insurance, get recorded on the operating company's books instead of the property company's, which is to say the borrower's. Required escrows under the program include the mortgage insurance premium, real estate taxes, and hazard insurance, and new construction deals add a working capital escrow equal to 4 percent of the total loan amount on top of that, with still more escrows possible depending on what the property's condition looked like at underwriting How to Prepare for Your First HUD Section 232 Audit – Pease Bell.

The reason this keeps happening isn't mysterious. Facilities that run separate borrower and operator entities on paper often run all their actual accounting through the operator, because that's simpler day to day and nobody's thinking about the audit until the audit is due. But the HUD structure requires the borrower and the operator to be maintained as genuinely distinct legal and accounting entities, with their own separate books, and an escrow account sitting in the wrong entity's ledger is a reclassification finding waiting to happen.

A second recurring first-year error sits right next to it: interest paid at closing on a prior mortgage has to be accrued properly so that expense doesn't bleed into the new HUD audit period. Misallocating that single line item occurs often enough in first-time nursing home audits to count as a pattern rather than a one-off mistake. The fix for both problems traces back to the same discipline. Assemble the complete, signed HUD closing binder before fieldwork even starts. Regulatory agreements, the mortgage note, lease documents, the closing statement, and the Surplus Cash note are the source documents auditors actually use to scope the opening balance correctly, and a messy or incomplete binder is how an opening trial balance error quietly propagates through an entire audit period.

Reserve for replacement shortfalls and capital needs assessment timing

Borrowers must track when their next 10-year Project Capital Needs Assessment (PCNA) is due, because an outdated PCNA can trigger increased reserve deposit requirements that squeeze operating cash flow.

Reimbursement from the reserve fund runs through Form HUD-9250, and it depends on detailed records and receipts supporting the request; incomplete documentation is one of the single most common reasons reimbursements get delayed. That delay isn't cosmetic. Delayed reimbursements reduce available cash, which feeds directly into the cash-deficiency condition that OIG identified as a default precursor. A reserve fund with money sitting in it that a facility can't actually draw on, because the paperwork behind the request is thin, is functionally no different from a reserve fund that's underfunded to begin with.

Why do borrowers underinvest in something this consequential? Reserve accounts feel distant, a long-horizon obligation compared to the immediate pressure of payroll and vendor bills, and operators running on thin margins tend to deprioritize the recordkeeping right up until a reimbursement request gets denied. Auditors have a specific job here: verify the reserve deposit schedule lines up with the current PCNA, confirm the assessment date hasn't lapsed, and test that reimbursement requests carry adequate documentation.

Related-party transactions and disclosure failures in closely held borrower structures

A large share of Section 232 borrowers are closely held entities: partnerships, S-corporations, LLCs, controlled by an individual investor or a family group rather than a diffuse ownership base. That ownership structure isn't a problem by itself. But it creates fertile ground for management agreements, lease payments, and intercompany loans between the borrower entity and an affiliated operator or management company, and every one of those arrangements has to be fully disclosed in the audited financial statements. Failure to disclose is its own compliance deficiency, entirely separate from whether the underlying transaction was even permissible in the first place.

When the same person or family sits on both sides of a related-party arrangement, arm's-length testing becomes essential rather than optional: are management fees priced at what an unrelated party would actually charge, is the lease rate paid to an affiliate consistent with market terms? Fees running above market rate to a related entity can function as a disguised distribution, dressed up as an ordinary operating expense. Skilled nursing facilities carry an additional version of this risk.

ORCF administers a Section 232 program that insures more than 3,600 loans with unpaid principal balance exceeding $32 billion under 24 CFR Part 232 HUD's Oversight of Section 232 Nursing Home Portfolios | Office of In… Oversight.gov. Because no single ORCF team had visibility into an entire portfolio, the April 2026 report found that related-party risks spanning multiple borrower entities under common control were especially likely to slip through unnoticed. A borrower operating several properties under one family's control cannot assume HUD will spot a pattern across entities that no individual reviewer is positioned to see whole. Distributions timed around a tax event, without first running the current surplus cash calculation, aren't a tax planning decision so much as a compliance exposure wearing a tax planning costume. A skilled nursing facility that presents different financial narratives in its Medicare/Medicaid cost report versus its HUD AFS creates a red flag for both regulators and auditors, since inconsistency between filings is itself a compliance deficiency.

What reduced ORCF oversight capacity means for borrowers

Every deficiency covered so far assumes, implicitly, that someone at HUD is reading the paperwork closely enough to catch it. That assumption needs retiring. ORCF's staff dropped from 61 employees in October 2024 to 38 by May 2025, and the average properties per staff member climbed from 60–80 to 165–200. The rules did not change; what changed is that the capacity to enforce them in real time shrank sharply in under a year, and that shrinking capacity is the practical reality behind every finding in this piece.

The consequence appears directly in how OIG framed its findings. Enforcement, in other words, was reactive rather than preventive, not because the warning signs were hidden, but because nobody had the hours left in the week to act on them before the loan actually failed.

That piece sits at the center of the issue. A regulatory framework built on the premise that HUD reviews financial statements, catches problems early, and steps in before default assumes a review capacity that, as of this writing, doesn't match the size of the portfolio it's meant to cover. Borrowers who treat compliance as something HUD will flag if it becomes a real problem are operating on an assumption the agency's own inspector general has already shown doesn't hold. They're links in a single chain, and the agency that used to be the backstop at the end of that chain has considerably less capacity to hold it than it did two years ago. ORCF did not notify the DEC before borrowers defaulted, even when the AFS disclosed the three warning conditions, so enforcement was reactive.