Make HOA fraud harder to start and easier to spot.

Volunteer treasurer guide

Start with a control map, not a suspicion

Most control failures begin as convenience: one shared administrator login, a vendor change confirmed by email alone, a payment approved without the invoice, or a reconciliation completed by the same person who entered every transaction. The board should map who can create, approve, pay, edit, reconcile, and report before deciding whether its controls are strong enough.

PayHOA documents modular read and edit permissions, separate authentication for users initiating bill pay, two-factor authentication, invoice approval workflows, bank reconciliation, and report access. Those features can support a good control environment, but the board still owns policy, access review, evidence, and exception follow-up.

1. Give every person the least access needed

Use individual accounts, require two-factor authentication, and remove access promptly when a director, employee, manager, or vendor leaves. PayHOA's permissions documentation distinguishes read and edit access across budgets, invoices, payments, people, reports, transactions, units, vendors, and other modules. Use those distinctions instead of granting full administrator access by default.

Review the permission roster quarterly and after every board election or staffing change. The reviewer should compare access with current roles, investigate dormant or unexpected accounts, and document changes. Do not share credentials or mark a public or shared computer as trusted.

2. Separate request, approval, payment, and review

A person who creates a vendor or payable should not be the only person who approves and releases it. Define dollar thresholds, required documentation, approver combinations, emergency authority, and how a conflict is handled. PayHOA Payables can route invoices through approval rules and track review status; configure those rules to reflect the board's policy.

Small associations may not have enough people for perfect segregation. Compensate with two-person approvals, direct bank alerts to more than one director, board access to statements, a monthly exception report, and periodic review by someone outside daily bookkeeping.

3. Treat vendor and bank-detail changes as high risk

Verify a new vendor, change of address, or change of payment instructions through a trusted contact method already on file. Do not rely on the phone number or link in the change request. Preserve the contract, tax form, insurance evidence, invoice, approval, callback record, and payment confirmation.

Review invoices for duplicate numbers, altered amounts, unfamiliar remit-to information, vague descriptions, split purchases below approval thresholds, and charges that do not match the contract or completed work. Related-party vendors and director conflicts should be disclosed and handled under the governing documents, applicable law, and board policy.

4. Reconcile every account to the bank statement every month

PayHOA recommends monthly reconciliation and requires the reconciliation difference to reach zero before completion. Zero is a mathematical checkpoint, not the end of the review. Examine outstanding checks, deposits in transit, old unreconciled items, deletions, manual entries, transfers, and transactions marked for review.

The board reviewer should receive the statement directly from the financial institution or have independent read-only bank access. Compare the statement, completed reconciliation, general ledger, and cash shown on the balance sheet. Investigate unexpected payees, electronic withdrawals, returned payments, round-dollar transfers, and reconciling items that persist.

5. Monitor owner ledgers, credits, and journal entries

Fraud and error can be hidden through credits, write-offs, deleted payments, misapplied receipts, or unsupported journal entries. Review a monthly report of manual owner-ledger adjustments, waived charges, refunds, reversals, deleted or re-entered transactions, and journal entries. Require a business reason, source document, preparer, approver, and date.

Reconcile the total owner balance to the financial statements and review negative balances, old credits, sudden write-offs, and changes made after statements were sent. Restrict journal-entry access and have material or unusual entries reviewed by the association's qualified accountant.

6. Put reserve transfers and projects under separate review

Keep operating and reserve cash distinguishable in both the bank and books. Require board authorization for transfers and preserve the purpose, amount, account pair, approval, bank confirmation, and related project evidence. A transfer should be recorded as a transfer, not as income in one account and expense in another.

For a reserve project, tie each payment to the approved scope, contract, invoice, progress evidence, change order, and board authorization. Compare cumulative payments with the contract and project budget. Ask counsel and the association's accountant about governing-document, statutory, investment, tax, or financial-statement requirements.

7. Review a short control report every month

Add a one-page control summary to the board packet: accounts reconciled and date completed, outstanding items over a threshold, new or changed vendors, payables outside normal approval, manual ledger changes, journal entries, reserve transfers, returned payments, past-due tax or insurance items, access changes, and unresolved exceptions.

Record that the board reviewed the report and assign follow-up owners and deadlines. Minutes need not expose protected owner or security details; the accounting file should hold the evidence. A control issue is not closed because someone explained it verbally.

Quarterly treasurer test

• Can the board identify every person with payment, vendor, transaction, journal, and administrator access?
• Does every payment have source support and approval independent of the requester?
• Are all bank accounts reconciled monthly to statements the reviewer obtains independently?
• Can reserve transfers and project disbursements be traced from board action to bank statement?
• Are manual owner-ledger changes and journal entries reported and reviewed?
• Would the board detect a changed vendor bank account before payment?
• Can the association export its current records without relying on one person?