HUD 232 Audit Requirements for Residential Care Facilities

HUD Section 232 borrowers face a specific, layered set of audit and financial reporting obligations, starting with GAAP-compliant annual statements due within 90 days of fiscal year-end and extending to specific financial signals that HUD's ORCF monitors for default risk. Each requirement builds on the last, and missing one tends to compound the risk of missing the next. The full picture matters more than any single deadline. HUD 232 Audit Requirements for Residential Care Facilities.

Section 232 and its audit obligations

This is not some peripheral corner of federal housing policy. The program currently insures more than 3,600 loans carrying an unpaid principal balance north of $32 billion, a portfolio size that puts it firmly in the category of major federal credit exposure rather than a niche lending niche HUD's Oversight of Section 232 Nursing Home Portfolios | Office of In… HUD Did Not Always Address Risks Reported in Borrowers... HUD's Oversight of Section 232 Nursing Home Portfolios.

Three distinct parties carry reporting obligations under this structure, each with different duties: the borrower, meaning the property-owning entity; the operator, meaning the licensed care provider; and the mortgagee/servicer. In many deals these are separate legal entities, sometimes related, sometimes not, and that separation (or its absence) drives much of the complexity in how audits get scoped and who signs what. Auditors and owners entering the program today also need to know that revised Section 232 Handbook provisions took effect January 5, 2026, and apply to all new loan applications and transactional requests involving existing projects. None of what follows is optional guidance. It is a condition of the federal insurance itself, and treating it as a checklist to satisfy rather than a structural feature of the loan is where borrowers start to slip. ORCF administers Section 232 under 24 CFR Part 232, which covers nursing homes, assisted living facilities, intermediate care facilities, board and care homes, and combinations thereof.

The annual financial statement audit: what GAAP compliance and the 90-day deadline require

The legal backbone here is 24 CFR 5.801 and 24 CFR 200.36, which require GAAP-compliant annual financial statements: audited for for-profit borrowers, and borrower-certified for non-profits, with an audited annual financial statement still due within nine months for the latter group. These are not documents that sit in a filing cabinet somewhere.

What does the audit itself actually have to cover? Two things, not one. Every engagement must include a financial statement audit of the entity itself, plus a compliance audit of the entity's major HUD programs, and it's the second piece that catches first-time borrowers off guard more often than the first. The compliance layer asks a different question than the financial statements do: not just whether the numbers are accurate, but whether the borrower actually followed the rules tied to the federal insurance.

Financial statements must be submitted through HUD's Financial Assessment Subsystem (FASSUB) and validated against hard copy documents, rather than a simple email or portal upload. Get the surplus cash number wrong, or submit late, and the entire audited package can trigger a flag regardless of how clean the underlying operations actually were. Auditing standards require compliance with Government Auditing Standards (Yellow Book), not just GAAS, a meaningful technical distinction for the auditor selection decision. The surplus cash calculation determines allowable owner distributions and is closely reviewed by ORCF as part of the audited package.

Borrower versus operator obligations

Under the default rule, operator financial statements can be operator-certified rather than fully audited, which meaningfully lowers cost and administrative burden for operators who are legally distinct from the property-owning borrower. But that carve-out disappears the moment the operator is also the borrower, a structure that occurs often in owner-operated facilities, and in that case a full audit is required, full stop.

HUD also retains override authority here. If the agency has reason to suspect that operator-certified statements might not be reliable, say, evidence of prohibited use of project funds, or statements that don't square with GAAP, it can require audited operator financials on a case-by-case basis. And even outside of suspicion, HUD can simply ask for more. The agency may request more frequent financial statements from either the borrower or the operator whenever circumstances warrant it, which makes clear that the standard reporting calendar is a floor and not a ceiling.

What does this mean in practice? Ownership structures that blend borrower and operator roles, or that involve related-party operators, draw more scrutiny and carry a heavier documentation load than a clean, arm's-length structure would. That should be surfaced early, at the deal-structuring stage, rather than discovered once the first audit is already underway.

The initial audit period and the opening trial balance: where first-time borrowers most often go wrong

The first audit period a borrower faces is not a full calendar year, and this trips up more first-timers than any other single feature of the program. It begins on the mortgage closing date and runs only through December 31 of that same year. There's also an automatic deferral built in: if closing happens on or after September 1, the initial audit period stretches all the way through December 31 of the following year instead. A closing on November 3, 2026, for instance, produces an audit period that doesn't end until December 31, 2027.

The opening trial balance is where the real technical risk sits. It has to reflect the property's financial position immediately after debt issuance costs from any prior mortgage were expensed, and just before the refinance transaction itself, reconciling cleanly to the closing date. That reconciliation touches cash balances tied to bank statements or confirmations as of closing, outstanding lease receivables (HUD expects timely collection, and gaps at the opening raise compliance questions on their own), and any notes receivable or payable that existed at or around closing, a category that's frequently incomplete without the full closing binder in hand.

One error recurs in initial audits: HUD escrow accounts, meaning replacement reserves, property tax escrows, and insurance escrows, recorded on the operating company's books instead of on the borrower or property company's books. It sounds like a bookkeeping technicality. It isn't treated as one. The finding triggers even when every dollar amount is correct, because the misclassification itself violates the separation HUD expects between property-level and operator-level accounts.

Timing compounds all of this. For a borrower with a December 31 fiscal year-end, auditors typically need records in hand by mid-January at the latest to complete fieldwork and get the report issued by the March 31 deadline, and missing that window can trigger HUD compliance flags of its own. So the audit clock is already running before most borrowers realize fieldwork has started.

The financial signals ORCF monitors in audited statements that precede default

ORCF doesn't treat the audited financials as an archival record. It uses them as a live monitoring tool, checking compliance with program requirements, evaluating a borrower's financial strength, and screening for risk across the entire portfolio.

A recent OIG audit, Report 2026-BO-0001, issued April 2, 2026, identified three specific conditions disclosed in the statements of borrowers who went on to run into trouble: distributions taken when no surplus cash was actually available, meaning unauthorized withdrawals, properties running outright cash deficiencies, and properties generating insufficient cash flow to service their current debt. Each one functions as a going-concern indicator, and each one is a potential violation of the borrower's regulatory agreement. The audit is the mechanism that puts these signals on paper in the first place, so the quality and timeliness of that audit affects far more than simple box-checking.

When distributions exceed the surplus cash calculation, the audit report should flag the violation, and that flag is what ORCF is supposed to act on. Whether anyone acts on that flag is a separate question, one the OIG report takes up directly. Servicers sit downstream of all this too. They receive the same annual financials and are expected to run their own examination sufficient to classify asset values and make independent risk assessments, so a single borrower's audit ends up feeding multiple layers of oversight at once.

The scale of what's at stake here is not abstract. As of June 2024, 167 of the 3,670 HUD-insured Section 232 borrowers, nearly 5 percent of the portfolio, had defaulted, carrying unpaid principal balances that exceeded $1.1 billion combined HUD OIG 2026-BO-0001. In many of these cases, the early warning signals were sitting right there in the audited statements. They just weren't acted on in time.

The gap between what audits disclose and what happens next in the April 2026 OIG report

The OIG's scope for Report 2026-BO-0001 covered four portfolios, 70 properties, and 84 loans carrying a combined unpaid balance of more than $410.6 million, and every one of those 84 loans was rated troubled as of June 2024. By July 2025, lenders were already positioned to file insurance claims on 58 of those 84 loans, representing more than $329.5 million in direct fiscal exposure that flowed straight from risk signals that went unaddressed HUD's Oversight of Section 232 Nursing Home Portfolios.

The report lays out where ORCF fell short across three specific dimensions. It did not receive audited financials from all borrowers as required. It did not ensure that borrowers fully developed action plans to address the viability risks their own statements had surfaced. And it did not notify the Departmental Enforcement Center before borrowers actually defaulted.

Why did this happen? Staffing tells much of the story. ORCF's staff decreased from 61 employees in October 2024 to 38 in May 2025, and the average number of properties per staff member grew from 60–80 to 165–200, eliminating the capacity for detailed analysis. At that ratio, the kind of detailed, case-by-case analysis the program depends on becomes close to structurally impossible.

There's a regulatory gap underneath the staffing shortage, too, and it's arguably more consequential. Current regulations require borrowers and operators to report risks as they arise, but they don't require anyone to develop or implement an action plan to address those risks until after default has already occurred. That's a genuine structural hole in the framework: it means the audit and the early reporting it produces function as the only pre-default warning mechanism the system has, with no formal requirement compelling action before the loan actually fails.

What should a borrower take from this? Not that the audit process itself is broken, but submitting complete, timely, accurate financials is essential precisely because ORCF's capacity to follow up on what those financials reveal is strained right now. Late or missing submissions don't just create a compliance problem. They remove the only chance at early intervention that exists in the current structure. The report quantified unauthorized distributions across the portfolio and found 35 loans where the independent public accountant had flagged the issue directly on the audited statements, work that fed straight into enforcement referral recommendations. The IPA's finding, in other words, was the trigger HUD's Oversight of Section 232 Nursing Home Portfolios | Office of In… HUD Did Not Always Address Risks Reported in Borrowers... HUD's Oversight of Section 232 Nursing Home Portfolios. Without it, there's no referral.

HUD's quality and submission standards for auditors and borrowers

Not just any accounting firm can take on this work. The audit has to be performed by an independent public accounting firm that's conversant with the HUD Consolidated Audit Guide and Government Auditing Standards, and HUD's own Quality Assurance Operations Division within REAC conducts quality control reviews of these firms, so the auditor's work is itself subject to a second layer of oversight. HUD's own framing of the role goes further than a compliance formality would suggest: independent public accounting firms are described as often considered the first line of defense in assessing the financial condition of multifamily ownership entities.

On the submission side, the electronic filing through FASSUB has to include the audited financial statements, supplemental schedules, the surplus cash computation, footnotes, certifications, and internal control and compliance reports, all aligned with HUD's Uniform Financial Reporting Standards and validated against hard copy backup.

What actually reduces findings before fieldwork even begins? Assembling the complete HUD closing binder ahead of time, without omitting any documents, sits at the top of the list. Reconciling every bank account, operating, replacement reserve, security deposit, to closing date statements matters just as much. So does confirming, in advance, that HUD escrow accounts sit on the borrower or property company's books rather than the operator's, preparing the surplus cash calculation early enough to catch any distribution issues, and closing out any notes receivable or payable documentation gaps before the auditor has to ask for them.

One narrow exception applies. Projects receiving less than $500,000 in federal financial assistance may, under HUD Housing Notice H 2013-23, be permitted to submit owner-certified GAAP-basis financials instead of a full audit, but that exception does not extend to Section 232-insured properties above that threshold. Choosing an auditor who knows this program specifically, rather than one who works broadly across multifamily housing or healthcare generally, cuts down meaningfully on the most common findings, including escrow misclassification, an incomplete opening trial balance, and surplus cash errors, while also supporting a submission that lands on time.

The audit obligation's place in the full financial life of a Section 232 loan

None of this is a one-time event. From the initial short-period audit through every annual filing that follows across the life of the loan, a borrower's financial reporting stays continuously visible to ORCF, to the servicer, and to the Departmental Enforcement Center. Every audit must include both a financial statement audit of the entity and a compliance audit of the entity's major HUD programs, a compliance layer that is often underestimated by first-time borrowers. On a 223(a)(7) streamlined refinance, available only to projects already carrying FHA-insured 232 debt, the financial statement obligations carry forward without interruption.

Refinancing adds another layer to understand. On a 223(a)(7) streamlined refinance, available only to projects that already carry FHA-insured 232 debt, the review process is narrower than a full 223(f) refinance would require, but the underlying financial statement obligations carry forward regardless, and a track record of clean, timely submissions genuinely strengthens the refinancing package that follows.

The regulatory gap the OIG flagged, no required action plan until after default has already occurred, puts real weight on what a borrower chooses to do before anyone forces the issue. Borrowers who get ahead of the risks their own audited statements surface, such as cash flow stress, reserve shortfalls, or a distribution that crept past the surplus cash limit, end up in a materially stronger position than those who wait for ORCF to act first. Given how thin ORCF's current capacity is, waiting is a real gamble.

That's also why the relationship between a borrower and its auditor shapes outcomes beyond a single annual filing. Firms that stay engaged across the full loan life, initial audit, ongoing annual compliance, refinancing support, and early flagging of going-concern risk, deliver something a purely transactional, year-end-only engagement simply can't. The Section 232 environment rewards that kind of continuity. And with the Handbook revision that took effect January 5, 2026 confirming that HUD's requirements keep shifting, the audit relationship is better understood as an ongoing calibration than as a fixed checklist to complete once and forget.