The Audit Firm Vetting Checklist Every Skilled Nursing CFO Should Apply to HUD 232 Engagements

HUD 232 audit and compliance for skilled nursing facilities requires annual owner audits, separate quarterly operator reporting, and a firm that understands the HUD Consolidated Audit Guide. This checklist helps CFOs distinguish Section 232 healthcare specialists from occasional HUD practitioners. Guide knowledge and healthcare experience are threshold qualifications, while execution, controls, reimbursement knowledge, and advisory depth determine how qualified candidates compare.

Why HUD 232 audits are structurally different from standard healthcare financial statement audits

A Section 232 engagement serves three purposes simultaneously. It is a financial statement audit, a regulatory submission, and a federal disclosure obligation tied to an active mortgage insurance contract. HUD’s Office of Healthcare Programs administers the program through the Office of Residential Care Facilities, or ORCF, whose responsibilities include asset management. The submission thus serves both federal oversight and the borrower’s financial records.

That structure changes the scope of engagement planning. Owners submit audited financial statements annually, while operators have separate quarterly financial reporting obligations. Licensed-care requirements and continuous oversight also distinguish these facilities from conventional properties. If a possible auditor treats the engagement as an ordinary healthcare audit with one more filing, how can the CFO be sure it covers both reporting tracks?

What the HUD Consolidated Audit Guide actually requires, and why general-practice CPAs routinely misapply it

The HUD Consolidated Audit Guide governs the compliance audit component for profit-motivated entities subject to HUD’s uniform financial reporting standards. GAAS/GAGAS govern the financial statement audit, and the Guide supplements those standards with HUD-specific requirements. It does not replace the underlying auditing standards. Firms must do the compliance work the Guide requires as well as the standard work of auditing GAAP financial statements.

HUD’s July 23, 2026 memorandum reinforces the mandatory, ongoing requirement to use the Guide and address established fraud risks, including embezzlement, theft, and false certifications. Firms must also know the rules for how to format and send electronic submissions through REAC and FASS. Content alone is not the whole deliverable. The borrower-operator bears the regulatory exposure from a deficient submission because owners select the auditor, provide records, certify information, and respond to findings. A firm’s technical misunderstanding thus becomes an obligation the CFO must resolve.

Criterion 1 — Whether the firm can confirm it will use the HUD Consolidated Audit Guide by name and version

The first interview question should be direct. “Which version of the HUD Consolidated Audit Guide will you apply to this engagement?” Document the answer in the audit planning records, rather than accepting a general assurance that the firm performs HUD work. A precise response establishes the foundation for further evaluation. An inability to identify the applicable Guide is grounds to stop.

The engagement partner should explain how the Guide’s compliance procedures differ from the standard steps used to audit GAAP financial statements. Marketing materials cannot answer for the assigned partner. A capable firm should also volunteer that it files through REAC and FASS and understands the electronic submission format. Those answers test whether its knowledge reaches the actual deliverable, including HUD-specific disclosures.

A strong Section 8 or Section 202 portfolio does not establish Section 232 healthcare competence. Licensed-care oversight and the operator-borrower structure require knowledge beyond general multifamily HUD auditing, particularly for leased nursing homes. Ask for a list of current or recent Section 232 healthcare clients identifying the engagement team members who worked on those files.

For multi-facility operators, that evidence should extend to related-party structures, inter-company transactions, and consolidated reporting across states. The financial statements can also reflect cash receipts assessment reconciliations, quality pool adjustments, state budget increases, OMIG audits, and pending litigation. The people who do the audit and consulting work must work together on these issues. Can the proposed team explain its role in comparable engagements, or does the relevant experience belong to people who will not work on this file? The answer separates an available capability from a credential held elsewhere in the firm.

Criterion 3 — Whether the firm understands the initial audit period, the 90-day submission deadline, and the September 1 deferral rule

Ask the firm to explain the calendar before discussing fieldwork. “How do you determine the initial audit period, and what triggers the deferral?” Its answer should address the September 1 deferral rule and correctly scope the example of a November 3, 2026 closing, which produces an audit period covering November 3, 2026, through December 31, 2027. An incorrect period can mean a mis-dated audit report and a non-compliant submission.

The firm should also explain the 90-day submission deadline. For a December 31 fiscal year-end, audited financials are due by March 31, requiring records by mid-January at the latest to complete fieldwork on time. A prospective auditor should communicate that working calendar proactively. Otherwise, the CFO is left to supply the scheduling knowledge the engagement requires.

Criterion 4 — Whether the firm can build a clean HUD opening trial balance and reconcile the full closing binder

The opening trial balance anchors the first HUD audit. Ask, “Can you walk me through how you construct the HUD opening trial balance, and what documents you request on day one of engagement?” A concrete answer should begin with cash reconciled to the transaction date, with every property bank account tied to a statement or confirmation as of closing. Outstanding lease receivables need a close look because they raise questions about whether lease payments have been made as required. Notes receivable or payable at or around closing also need documentation to verify opening balances.

The document request should encompass the complete, signed HUD closing binder. That includes borrower and operator regulatory agreements, the mortgage note and loan documents, lease documents, the closing statement, and the Surplus Cash note if applicable. Selective review leaves gaps in the foundation. A firm that requests these materials upfront demonstrates a different level of readiness from one that discovers missing agreements during fieldwork, when reconciliation problems consume submission lead time and prompt servicer questions.

Criterion 5 — Whether the firm handles SNF-specific accounting layers, including Medicaid cost reports, MDS-linked reimbursement, and prospective payment system updates

A skilled nursing auditor must understand how Medicaid cost reports, resident assessment-linked reimbursement, and value-based purchasing adjustments affect the financial statements. A technically compliant HUD submission can still leave material balance sheet risk poorly understood if the firm cannot interpret those layers. The CFO’s question is therefore not simply whether the team knows healthcare accounting, but whether it can connect skilled nursing payment requirements to the balances under audit.

Ask, “Does your team handle Medicare and Medicaid cost reports in-house, and can you identify how the FY 2027 prospective payment updates affect our reserve and revenue recognition?” The FY 2027 proposed rule covers prospective payment rates and the requirements for the SNF Quality Reporting Program and Value-Based Purchasing Program. The discussion should make clear that the rule is still proposed. The CMS FY 2027 resident assessment audit requirement is another regulatory development the auditor must understand. A useful answer connects these developments to the engagement.

Criterion 6 — Whether the firm can evaluate SOC 1 and SOC 2 reports from the EHR, billing, and payroll vendors in the operator’s control environment

Third-party platforms create the financial data that the auditor will test. So the discussion of the operator’s control environment must include vendor assurance. SOC 1 examinations look at internal controls over financial reporting, while SOC 2 examinations look more broadly at information security and operational controls. Both are relevant to billing and financial close processes, although they answer different questions.

Ask, “Can your team perform SOC 1 and SOC 2 examinations, and can you evaluate the SOC 2 Type II reports from our EHR and billing vendors as part of the engagement?” The firm needs to give specific examples along with its agreement. The firm should connect its capability to the EHR, billing, and payroll systems involved in the audit. Vendor risk management is receiving heightened scrutiny as threats change, including risks associated with AI, automation, and customer data. The practical test is whether the firm can assess the controls behind the numbers.

Criterion 7 — Whether the firm advises the closely held ownership structure on tax planning, cost segregation, and the interaction of depreciation with HUD reserve requirements

Owners of skilled nursing facilities often use closely held pass-through entities. Where the operator is also the borrower, that entity requires a full audit rather than merely operator certification, concentrating audit and tax considerations around the same financial statements. The ability to bring that advice together therefore helps show whether a firm is qualified and adds to the services it offers. The firm should know healthcare real estate cost segregation, entity-level tax planning, and how accelerated depreciation works with HUD reserve-for-replacement requirements.

Ask, “Do you advise closely held ownership structures on entity-level tax planning, and how do you document independence when the same firm performs both the HUD audit and tax advisory work?” A qualified firm should raise it proactively and document its analysis in writing. The objective is coordinated advice that respects audit independence.

Criterion 8 — Whether the firm can assess AI tools embedded in billing, clinical documentation, and financial close processes

AI tools are already entering skilled nursing workflows. Their use in billing, clinical documentation, and financial close is advancing faster than audit frameworks have adapted, creating a present control-assessment gap. Finance agents can be tested for susceptibility to manipulated invoices or payment instructions, exposure of internal data, invented financial figures, and malicious instructions embedded in uploaded files. Standard audit procedures do not cover these specific ways the tools can fail.

The AICPA and the Artificial Intelligence Underwriting Company (AIUC) have developed an assurance certification, AIUC-1, currently in a piloting phase and expected to fully launch in early 2027. The joint offering combines a SOC 2 report and an AIUC-1 certification in one CPA-led engagement. Its six principles cover data and privacy, security, safety, reliability, accountability, and society, giving the discussion a defined scope.

AIUC-1 is updated quarterly and requires annual renewal plus quarterly technical retesting. Both the certification and SOC 2 reports require annual renewal, making continuing engagement relevant to the assessment. Ask prospective firms, “Have you piloted any AIUC-1 engagements, and can you evaluate AI tools embedded in our billing or EHR environment?” Because the offering remains in pilot, participation is a differentiator.

How to use the checklist in a real evaluation, including scoring firms, structuring reference calls, and documenting the selection

Use a scored interview to turn answers into comparable evidence. Record a pass, partial, or fail for each criterion based on specific responses. Guide knowledge and Section 232 healthcare experience are threshold items, so a failure on either ends the evaluation regardless of price or relationship. Tax advisory integration and AI assurance instead help rank firms that have cleared the threshold. They should not eliminate otherwise qualified candidates.

For references, call CFOs at the firm’s current Section 232 healthcare clients. Ask, “Has this firm ever caused a submission delay, and how did they handle it?” Keep the Guide response in the audit planning records as evidence of due diligence, together with the scored evaluation supporting the selection. Before signing, confirm the assigned engagement team members by name. The defensible choice is the firm whose proposed team can substantiate the required knowledge and execution.