HUD Multifamily Audit Supplemental Schedules and Reporting Requirements

HUD multifamily audits run on more than audited financial statements. The real compliance obligation is a full electronic package, filed through a system called FASSUB, that includes supplemental schedules, a surplus cash computation, certifications, and internal control reports, all governed by HUD's Consolidated Audit Guide (Handbook IG 2000.04) and 24 CFR Part 5, Subpart H. Over 26,000 Multifamily Housing and Office of Residential Care Facilities participants file this data with HUD every year, and the gap between "audited" and "compliant" is exactly where a lot of filings go wrong. Most owners assume a clean GAAP opinion is the finish line. It isn't, and treating it that way is the single most common way a filing goes deficient.

Two separate electronic systems carry this data into HUD. Public housing entities use FASS-PHA. Multifamily housing entities, the subject of this piece, use FASSUB, the Financial Assessment Subsystem for Multifamily Housing. Who actually has to file depends on money at stake: profit-motivated multifamily projects trigger the audit requirement once annual expenditures or the HUD-insured loan balance hit $500,000. Nonprofit projects are held to a higher bar, $1,000,000 for fiscal years starting on or after October 1, 2024, up from the old $750,000 threshold. That threshold applies across the whole owning entity's HUD-assisted portfolio, not project by project, so an owner with six small properties can't dodge the requirement by keeping each one under the line individually. Ginnie Mae issuers and FHA-approved lenders that originated or serviced loans during the period get pulled in too.

Under Housing Notice H 2013-23, projects getting less than $500,000 in federal assistance can submit an owner-certified GAAP-basis statement with notes instead of a full audit. That's still due within the applicable filing deadline, and it still requires owner certification. Call it a lighter lift. It is not a free pass.

The full FASSUB submission package: what goes into a compliant filing beyond the financial statements

A compliant FASSUB filing has five moving parts: audited financial statements, supplemental schedules, the surplus cash computation, footnotes and certifications, and internal control and compliance reports. Dropping any one of those five makes the filing deficient, even if the financial statements themselves are clean GAAP work. Most owners get this backwards. They treat the audit opinion as the deliverable and the rest as paperwork trailing behind it, when HUD treats the schedules as load-bearing.

Why do the supplemental schedules carry that much weight? They're the evidentiary layer that lets HUD actually audit the audit, breaking specific balance sheet and income statement accounts down into the detail HUD needs to test compliance, detail a standard audit opinion never surfaces on its own. A clean GAAP opinion tells a reader the numbers are fairly stated. It confirms neither that specific regulatory agreement conditions were met nor that project funds were handled as HUD's rules require. That's what the schedules are for.

Two certifications sit alongside the numbers. First, the owner (and the management agent, if there is one) has to sign a certification attesting that the financial statements are accurate and complete. That's a distinct deliverable from anything the auditor produces. Second, FASSUB requires a CPA attestation confirming that the electronic submission matches the hard copy audit report line for line. If the PDF and the upload disagree, even in formatting, that's a problem HUD's system is built to catch.

All of it has to line up with HUD's Uniform Financial Reporting Standards (UFRS). The FASSUB Industry User Guide, version 7.4.0.0, lays out the account-by-account data definitions across the different entity types HUD recognizes: profit-motivated, limited distribution, and nonprofit. Each has its own reporting quirks. A filing built only on GAAP-compliant financials, missing the schedules and certifications, is structurally incomplete no matter how sound the underlying accounting is.

The surplus cash computation: the schedule that drives distribution rights and equity skimming risk

Surplus cash is whatever's left after the mortgage is paid, funded reserve accounts are fully funded, and every other required payment is made, calculated as of year-end. It sounds like a simple leftover number. It isn't, because what an owner is allowed to do with that number depends entirely on what kind of project they run, and getting that distinction wrong is where a lot of trouble starts.

Some regulatory agreements allow the calculation semiannually instead of annually. Mortgagee Letter 2022-16 went further, permitting monthly distributions from surplus cash for eligible borrowers on FHA-insured multifamily properties, as long as the property isn't under a Section 8 PBRA contract or a HUD-held mortgage.

The rules split by entity type. Profit-motivated projects can distribute all their surplus cash to owners. Nonprofit projects can't distribute any of it, full stop; everything gets deposited into the Residual Receipts account at fiscal year-end. Limited dividend projects sit in between: surplus cash pays permitted distributions first, and whatever's left goes to Residual Receipts.

This is where equity skimming enters the picture, and HUD treats it as a major noncompliance category. Rents, project assets, sale proceeds, and any other project income cannot be used for anything except actual, necessary project expenses. Auditors reviewing disbursements are, in effect, hunting for unauthorized distributions or unauthorized loans of project funds dressed up as something else.

The stakes aren't theoretical. A HUD OIG audit looked at four portfolios, 70 properties and 84 loans with a combined unpaid balance over $410.6 million, and identified significant financial risk concentrated in those portfolios. The audit findings pointed to failures in how financial risks documented in borrowers' statements had been addressed. By July 2025, lenders could file insurance claims on 58 of those 84 loans, totaling more than $329.5 million. That's what happens when a surplus cash schedule gets treated as a formality instead of the tripwire it's designed to be. The schedule is the primary mechanism for catching distributions that exceed what the regulatory agreement permits, and when it's weak, both the owner and HUD end up exposed.

The compliance areas auditors test through the supplemental schedules

Chapter 3 of the HUD Audit Guide lays out suggested procedures for for-profit entities, profit-motivated and limited-distribution alike, and the supplemental schedules are the vehicle auditors use to actually run those tests. Each schedule maps to a specific risk area HUD cares about, and the list is long for a reason: HUD is trying to catch every place project money can leak.

Auditors check that federal financial reports match the underlying records, that fair housing obligations are met, and that mortgage and escrow payments post on time. They check reserve for replacement activity and residual receipts handling against applicable HUD requirements. Distributions to owners get checked against the surplus cash computation directly, confirming that nothing paid out exceeds what the calculation actually allows.

Equity skimming sits at the top of the risk list again here, because it's the one category HUD labels major noncompliance. Cash receipts must be kept in a designated project account, and commingling with funds from other projects or entities is prohibited. Cash disbursements need to serve legitimate project purposes only.

Tenant-facing compliance gets its own scrutiny too. Auditors check tenant eligibility files and recertifications, confirm that Section 8 properties document service to extremely low-income households where required, and verify that tenant security deposits sit in a separate, federally insured account, not commingled with operating cash. Management functions get reviewed for current agent approval, active insurance and fidelity bond coverage, and timely responses to prior HUD findings.

A few categories are narrower but appear regularly in these filings. Any change of ownership or new liability against the mortgaged property requires prior HUD authorization, not after-the-fact approval. The same goes for unauthorized loans of project funds, which HUD also scrutinizes as a form of noncompliance. Section 236 properties have a hard 10-day-after-month-end deadline for reporting excess income. Leased nursing homes carry their own checklist: lease terms carry HUD-specific requirements, and any material changes to leasing arrangements warrant review for compliance with HUD's conditions.

One more report deserves its own mention because it's easy to overlook: the Schedule of Prior Audit Findings. The revised IG 2000.04 Audit Guide requires auditors to report on the status of last year's findings and on any reviews conducted by HUD OIG, HUD management, a contract administrator, or another federal agency touching the current audit period. That's a required report under the revised IG 2000.04 Audit Guide, separate from the financial statements themselves.

Section 232 skilled nursing and residential care facility audits: supplemental schedule requirements that diverge from standard multifamily

Section 232 is HUD's insurance program for nursing homes, assisted living facilities, intermediate care facilities, and board and care facilities, run through the Office of Residential Care Facilities. The program currently insures more than 3,600 loans carrying an unpaid principal balance north of $32 billion, which makes it a meaningfully large book of business sitting under a reporting regime that looks nothing like standard multifamily.

The reporting clock runs faster, and this is the detail owners moving into Section 232 from other HUD programs miss most often. Section 232 operators file quarterly financial information within 60 calendar days of each quarter's end, with annual financial statements due within 90 calendar days of the fiscal-year-end quarter. Standard multifamily properties file once a year. Nursing homes and assisted living facilities file four times, and the frequency alone changes how tightly the books need to stay current.

Whether the report needs to be a full audit or something lighter depends on a distinction between the operator and the borrower. Operator financial statements can be operator-certified rather than independently audited, but only if the operator and the borrower are different entities. If the operator is also the borrower, the full audit requirement kicks back in. A new Section 232 Handbook takes effect January 5, 2026, and applies to all new loan applications and transactional requests tied to existing Section 232 projects.

Three reclassification errors occur repeatedly in these audits, often as first-year findings for operators new to the program. The most common involves misclassifying accounts between the operating company's books and the borrower or property company's books, a distinction HUD's supplemental schedules are designed to enforce from the start. Related party balances, particularly anything tied to the operator, need thorough, current analysis, because related party transactions draw heightened scrutiny by design. And interest paid at closing on a prior mortgage should get accrued properly so the expense doesn't accidentally land inside the current HUD audit period; misallocating that interest is another recurring first-time finding.

Enforcement in this space is active. A 2025 OIG review is underway involving a New York City residential care facility, a nonprofit operator running a skilled nursing facility with an unpaid principal mortgage balance reported at more than $7 million as of December 31, 2025. The review is examining the facility's operation for compliance with its regulatory agreement and HUD's requirements. Set against the earlier 70-property, 84-loan portfolio audit, the pattern holds: the supplemental schedules that report surplus cash withdrawals and debt-service cash flow are the earliest warning system HUD and OIG have for financial trouble in this sector, and they only work if the numbers behind them are classified correctly from the start.

FASSUB submission validation and triggers for HUD review of auditors

Once a filing lands in FASSUB, it doesn't just sit in a database. HUD's REAC system runs it through validation, cross-checking the financial data templates, reviewing the surplus cash figures, assessing compliance metrics, and flagging anything that doesn't add up.

A human check backs up that automated one, run by HUD's Quality Assurance Operations Division. HUD's Quality Assurance Operations Division, staffed by career auditors and CPAs, runs quality control reviews of the independent public accounting firms doing this work. HUD describes IPA audits as the first line of defense in assessing the financial condition of a public housing agency, tribally designated housing entity, or multifamily ownership entity, which makes the auditor's own work product a subject of HUD scrutiny, not just the owner's numbers. QASS also runs financial assessments and ad hoc reviews aimed at tracing the root cause of irregularities, spotting risk in new or existing programs, and recommending fixes.

Enforcement against auditors themselves is documented and real, and this is the part firms doing HUD work tend to underestimate. HUD's Departmental Enforcement Center has issued debarments and Limited Denials of Participation against CPA firms found to have violated professional standards or HUD's requirements. State licensing boards have followed through independently: Kansas revoked licenses in two separate cases tied to HUD audit failures, Mississippi and Florida jointly revoked one CPA's licenses, and Missouri and Mississippi jointly revoked another's. Losing a license over a HUD filing has happened across at least four states. It is not a remote risk category.

A couple of adjacent regulatory shifts change what shows up in the reporting package itself. The OMB Uniform Guidance threshold for triggering a Single Audit rose to $1,000,000, which also changed auditor report titles, reporting requirements, and the format of the Schedule of Findings and Questioned Costs, a change that ripples directly into nonprofit multifamily reporting packages. Separately, as of October 1, 2023, the Federal Audit Clearinghouse moved from a federal statistical agency to the General Services Administration, so nonprofit entities receiving more than $750,000 in federal funding now upload their annual audits to the FAC under GSA's administration instead.

The REAC system slows down noticeably as filing deadlines approach. That's a capacity issue, not a compliance failure on anyone's part, but it has caused technically finished filings to get submitted late simply because the system choked at crunch time. Owners should build a buffer into the calendar rather than assume the upload will go through the moment the audit is done.

Deadlines, early engagement, and the auditor's practical role in getting submissions across the line

The deadline calendar shifts depending on entity type, and missing the wrong one by even a few days carries real consequences. Multifamily for-profit housing projects generally have 90 days after fiscal year-end to file. Hospital projects get 120 days. Ginnie Mae project audits and FHA project audits both run on roughly 90-day clocks after fiscal year close. Public housing entities get the longest runway, nine months from fiscal year-end, reflecting the larger, more complex data sets those filings usually involve.

Missing the deadline triggers consequences beyond a late notice. Failure to comply can trigger a referral to HUD's Departmental Enforcement Center, the same body that's issued debarments against CPA firms for substantive audit failures. A late filing and a bad filing can end up in the same enforcement pipeline, which is a detail owners racing the clock tend to forget.

So what does the auditor actually do in all this? Not just sign off at the end and hand over a PDF. While the owner or public housing agency carries the legal responsibility for submitting financials electronically through REAC, the auditor produces the audited financials in HUD's specific required format, helps validate and format the data for FASSUB, and makes sure the CPA certification actually gets attached correctly to the submission. Skipping that coordination leaves the owner holding a technically accurate audit that doesn't translate into a usable electronic filing, which is its own kind of failure even if every number in it is right.

Engaging an auditor at least 60 days before fiscal year-end gives enough runway to review financial statements properly and catch classification errors before they harden into findings: mortgage escrow entries booked on the wrong entity's books, related party balances that need more analysis, surplus cash calculations that don't match what the regulatory agreement allows. Waiting until the fiscal year closes to start that conversation turns a routine filing into a scramble against both the 90-day clock and a REAC system that gets slower the closer everyone gets to the deadline.