‍What auditors actually need, and what your software should do about it

By Matt Hoskins  |  CEO, ExactEstate

‍

The short version

Property accounting systems built for affordable housing collapse audit prep from a multi-week scramble into a few days of verification. They do it by tying every transaction to a specific unit and entity, automating the compliance rules auditors test, and maintaining the audit trail regulators expect. This piece walks through the 12 capabilities that actually matter when a MOR, REAC, LIHTC monitoring visit, or LP audit lands on your calendar.

‍

Why affordable housing audits feel different

‍

A market-rate audit is an accounting exercise. An affordable housing audit is an accounting exercise plus a compliance test against HUD rules, IRS Section 42, state HFA requirements, USDA RD standards, and whichever investor documents govern your LPs. The auditor isn't just checking your books. They're checking whether the right household lives in the right unit at the right rent with the right subsidy, and whether you have the documentation to prove it.

‍

That's why general-purpose PM platforms built for market-rate multifamily fall apart during affordable audits. The data is there — somewhere — but it isn't structured the way an auditor thinks. Your compliance manager spends three weeks reconstructing what should already exist in one place.

‍

Purpose-built affordable housing accounting changes the math. Here's what it actually looks like, and what to look for when evaluating whether your current system will hold up.

‍

What auditors actually request

‍

Before talking about what software should do, it helps to name the audits we're actually preparing for:

‍

• MOR (HUD Management and Occupancy Review): tenant file review, rent calculations, 50059 submission history, HAP reconciliation, maintenance response times.
• REAC / NSPIRE inspections: physical unit condition, documented maintenance response, inspection history.
• LIHTC state agency monitoring: TIC accuracy, rent and income limit compliance, Available Unit Rule tracking, AIT designation verification if elected.
• IRS Form 8823: anything the state agency couldn't resolve becomes a potential credit recapture.
• USDA RD supervisory visits: MINC submissions, tenant eligibility, and rent calculation worksheets.
• Investor / LP audits: property-level P&L, consolidated reports, variance analysis, quarterly owner statements.
• Annual financial audit: GL integrity, period enforcement, and internal controls documentation.

‍

Each asks for different documentation at different levels of granularity. A system that's going to help you has to serve all of them from the same data.

‍

One note on timing. HUD extended the HOTMA compliance deadline to January 1, 2027, and TRACS 203A hasn't been released as of early 2026. No vendor can honestly claim full HOTMA compliance right now. What matters is whether your system is ready — whether the data model, the forms, and the workflows can absorb the changes when they land. "Ready" is the right word, not "compliant."

‍

Step 1: Centralize compliance data in one platform

‍

Audit readiness starts with one rule: everything lives in one place, and that place is the same system that runs your accounting.

‍

Tenant income certifications, lease documents, rent calculation worksheets, subsidy determinations, and financial transactions — all in one database, all searchable, all tied to the specific unit and entity they belong to.

‍

What separates a purpose-built system from a retrofit:

‍

• Every transaction is assigned to a property (LLC) at the data model level, so per-entity reports don't require rebuilding anything.
• TIC records, DocuSign envelopes, verification documents, and HAP voucher data all reference the same resident and unit records.
• Support docs — pay stubs, bank statements, benefit letters — are attached to the certification they support, not stored separately in a shared drive.

‍

When an auditor requests documentation, you pull from one location in seconds.

‍

Step 2: Turn on automated compliance tracking

‍

Manual tracking means things slip through. Automated tracking catches problems before they become findings.

‍

The compliance rules that warrant automation in affordable housing:

‍

• Income limit monitoring at move-in and recertification. The system should hard-stop move-ins that exceed set-aside limits, not flag them for later review.
• Recertification deadline tracking. Automated reminders at 120, 90, 60, and 30 days before due date, with a queue view that shows overdue, upcoming, and in-progress certifications at a glance.
• Rent ceiling enforcement. The system should prevent designation prices from exceeding rent limits minus utility allowance — not flag it after the fact. Prevent it.
• Available Unit Rule / Next Available Unit Rule (AUR/NAUR). When a recertification crosses the 140% threshold, the system should automatically flag an over-income event and notify compliance staff.
• Average Income Test (AIT) validation. For properties that elected AIT, the system should calculate the running building average and validate against the 60% cap in real time, with pre-change validation before a designation edit is saved.

‍

If any of these are manual in your current system, that's the gap.

‍

Step 3: Build reports that match audit checklists

‍

Auditors work from checklists. Your reports should match those checklists exactly.

‍

The reports an affordable housing operator actually needs on hand:

‍

• For LIHTC: TIC status, rent roll with income limits and actual rents, unit mix compliance, recertification completion, Available Unit Rule history, AIT designation by building.
• For HUD Section 8: Form 50059 submission history via TRACS, HAP voucher reconciliation, rent roll synced to ShofCorp, subsidy payment ledger, inspection compliance.
• For HOME: Income eligibility at move-in, rent reasonableness documentation, affordability period tracking, ongoing compliance verification.
• For USDA RD: MINC XML export, tenant eligibility with indicator codes, expense categorization (medical, child care, welfare shelter), imputed income calculations.

‍

A system with 93 pre-built reports across 23 categories — financial statements, rent rolls, aging, compliance, cross-property portfolio analytics — means you export, not compile. A system with 15 or 20 stock reports means you build spreadsheets for every audit request.

‍

Step 4: Build documentation into daily workflows

‍

Documentation created after the fact raises red flags. Documentation created during the workflow proves compliance.

‍

The TIC workflow is the best example. On a well-built platform, staff enter income data once, and the system generates a completed, state-compliant PDF in seconds — with 100+ fields pre-filled from the household, income, asset, and property records. The PDF goes out for e-signature. Household members sign first, then the property owner. Status is tracked per recipient. When compliance approves, the TIC is finalized, the PDF becomes immutable, and a new recertification schedule is created automatically.

‍

Certification prep drops from the 30–45 minutes of manual form-filling that legacy workflows require to something much closer to data entry plus review. More importantly, nothing gets lost between the intake appointment and the tenant file.

‍

The same principle applies to maintenance, inspections, and resident communications. Every work order timestamped. Every inspection finding documented with photos. Every notice logged with delivery status. When an auditor questions response times or habitability, you show the record, not your memory.

‍

Step 5: Control document versions

‍

Auditors verify you used the correct form and followed the current rules at the time each transaction occurred — not today.

‍

That means your system has to know which version of each form was in effect on any given date:

‍

• State-specific TIC templates with effective dates (the post-HOTMA TX form vs. the pre-HOTMA version, the 2024 DCA GA form vs. the 2006 version)
• Lease templates that reflect current program requirements
• Notice templates matching the current regulatory language
• Inspection checklists aligned to NSPIRE severity classifications

‍

When an auditor reviews an 18-month-old certification, the system should show which form was in effect at that time — not require you to prove it manually.

‍

This is where HOTMA readiness matters. As TRACS 203A finalizes and state agencies update their TIC forms, your platform needs to absorb the new versions without invalidating history. Readiness in this context means the system can hold both old and new versions in effect by date. That's table stakes, not a feature.

‍

Step 6: Audit trails for every transaction

‍

Every change to the system needs an audit trail that meets an auditor's verification standard. Not a log file an admin could edit — a structured record that can't be tampered with.

‍

What auditors expect to see:

‍

• Who made each change
• When they made it
• What the previous value was
• Why, if your workflow requires a reason code

‍

In a purpose-built system, this is enforced at the database level — not as a feature that an admin can disable. Soft-delete protection means deleted records aren't destroyed; they're marked inactive. History tables track every edit to charges and payments. Permission-gated access means only authorized users can modify compliance data.

‍

When an auditor questions a rent adjustment, you should be able to show the complete chain: who calculated the new rent, when they entered it, what certification triggered the change, who approved it, and what the prior amount was.

‍

Step 7: Connect financial and compliance data

‍

Auditors verify that your financial records match your compliance records. Disconnected systems create discrepancies. Discrepancies create findings.

‍

What integration actually looks like in a purpose-built platform:

‍

• Auto-journalization from transaction codes. A well-designed system uses a standardized transaction code library — rent, subsidy, late fees, deposits, concessions, utilities, fees, other income, credits — where every code maps to its correct GL accounts, with debit and credit pairs for both charges and payments. Staff records a charge once; the GL entries happen automatically.
• Real-time GL posting. The system should post journal entries the moment a transaction happens — not queue them for a nightly or manual batch. Platforms that require a batch posting step create a lag between when a transaction occurred and when it appears in reports, which is exactly the gap auditors exploit when reconciling compliance records against the books. Several of the largest legacy platforms still require manual batch posting.
• Subsidy tracking is split between the tenant portion and the housing authority portion. A dedicated subsidy transaction code, tied to the 50059 or voucher that authorized it, with approved vs. actual reconciliation built in.
• HAP voucher reconciliation. For Section 8 properties, the rent roll pulled from ShofCorp should sync against your PMS rent roll with fuzzy name matching, discrepancy detection between HAP amounts and contract rents, and automated ledger postings for subsidy payments.
• Utility allowance integration. When allowances change, the system recalculates affected rents and updates accounting in the same transaction.

‍

Integration eliminates the reconciliation work that consumes days during audit prep. When the books and the compliance records tell the same story, there's no story to reconcile.

‍

Step 8: Monitor exceptions proactively

‍

The best audit prep happens year-round, not in the three weeks before the auditor arrives.

‍

What a well-configured system should surface without being asked:

‍

• Units missing a current income certification or approaching expiration
• Households whose income on the last cert exceeds 140% of AMI (flagged automatically at recertification approval)
• Certifications are missing the required verification documents
• Designation edits that would push the building's AIT average over 60%
• Recertifications completed outside the required window
• Unit availability mix that threatens a program set-aside

‍

Review exception reports weekly. Fix issues as they surface, not in a sprint before the agency monitor arrives.

‍

Uncorrected Form 8823 findings can trigger credit recapture with interest. Proactive monitoring — catching the issue before the state agency does — is the difference between a note on the next monitoring report and an adverse action on your investor statement.

‍

Step 9: Run program-specific compliance modules

‍

Different funding programs mean different requirements. One system should handle all of them without cross-contamination.

‍

• LIHTC: Income hard-stop at move-in, rent ceiling enforcement per designation, AUR/NAUR automation, AIT validation, applicable fraction calculation per building, compliance period tracking from placed-in-service through 15-year initial and 30-year extended use.
• Section 8 (Project-Based): TRACS integration via ShofCorp for 50059 data transmission, HAP voucher payment processing, rent roll sync, subsidy payment posting, and embedded HDS access.
• HOME: Income hard-stop, rent ceiling enforcement, affordability period tracking — configured independently of LIHTC, so the rules don't collide.
• USDA Rural Development: MINC XML export with schema validation, mapping of income fields to USDA categories (SSI vs. Other), expense categorization, initial and recertification export support.
• HOTMA readiness: Post-HOTMA TIC forms already live for states that have published them (Texas is an example). As other states release their post-HOTMA versions, a system built for this absorbs them as new templates, not as rebuilds.

‍

Each program should be enableable per property. A property with only LIHTC shouldn't be affected by HOME rules. A mixed-finance property that layers LIHTC + Section 8 + HOME should see all three rule sets enforced simultaneously.

‍

Step 10: Prepare response packages in minutes

‍

When an auditor requests documentation, your system should assemble the package — not your compliance manager.

‍

Build standing templates for common requests:

• Tenant file review package: Current TIC, supporting income documentation, lease + addenda, recertification history, rent worksheets, resident correspondence log.
• Financial verification package: Rent roll as of audit date, subsidy payment reconciliation, security deposit ledger, utility allowance documentation, transaction detail for selected units.
• Property compliance package: Inspection records with photos, maintenance response timestamps, unit availability history, program certifications, and staff access logs.

‍

Group reporting — the ability to batch-export ~60 reports across any combination of properties in one operation — is what makes this fast for portfolios with more than a handful of properties. Without it, you're running reports one at a time. 

‍

It’s also worth considering Customized Report Configurations, which allow you to manipulate Report Generation for predefined reports. With complete financial custom reporting, you can select your own data points for any report you need and instantly access them, as well as share them with staff. 

‍

Step 11: Document your system controls

‍

Auditors evaluate internal controls, not just outputs. Your system's configuration is your control documentation.

‍

What to document:

‍

• Required fields that prevent incomplete certifications from saving
• Approval workflows that enforce segregation of duties — the site manager who enters a certification isn't the compliance officer who approves it
• Close out batches that lock finalized transactions against edits
• Period enforcement that blocks postings to closed accounting periods
• Permission-gated access that limits who can modify compliance data
• Validation rules that catch data entry errors before they save
• Database-level isolation between clients — each tenant on a separate database, not row-level filtering inside a shared database. When an auditor asks how data is segregated between entities or between management companies, the answer is architectural, not procedural.

‍

Build a procedures manual that maps each audit control to the system configuration that enforces it. "Our site managers don't have permission to approve TICs" is a claim. A screenshot of the role permission matrix is proof.

‍

Step 12: Run internal audits quarterly

‍

Run your own audits every quarter, using the same reports the external auditor will use.

‍

A quarterly internal audit should pull:

• Compliance exception reports (over-income events, overdue recertifications, missing verification documents)
• Sample tenant file review, randomly selected, reviewed for completeness
• Financial reconciliation against compliance data
• Inspection schedule verification
• Required notice delivery verification

‍

Fix what you find. Document the corrections with timestamps and reason notes. When the external auditor arrives, you have a record of proactive correction — findings identified internally, documented, and resolved before the audit began.

‍

What audits look like when this is in place

‍

The auditor arrives. You hand them organized documentation that matches their request list.

‍

They want the income certification, the rent roll, and the delinquency history for Unit 204. You pull it up in seconds. Complete certification, supporting documents, approval workflow, and calculation history. All there, all linked, all immutable once approved.

‍

They question a rent increase in Unit 312. You display the recertification that triggered it, the worksheet showing the new rent calculation, the resident notice, the accounting entry posted on the effective date, and one-click drills from the Income Statement line item back to the source journal entry.

‍

They want to verify prompt maintenance response. You show timestamped work orders with before-and-after photos, completion records, and resident confirmations.

‍

The two-week audit becomes three days. You spend those days answering questions and providing clarification — not frantically hunting documents across three systems and a filing cabinet.

‍

What you get beyond audit survival

‍

Purpose-built affordable housing accounting pays off outside audit season, too:

‍

• Staff time recovered from manual compliance tracking
• Fewer compliance findings jeopardizing funding or credits
• Real-time visibility into portfolio compliance status
• Institutional knowledge that survives turnover — new hires follow system workflows instead of relying on veteran memory

‍

Implementation is measured in days, not months. MAT file imports and exports, Excel bulk imports for the chart of accounts and units, and CSV imports for portfolio migrations load data fast. Ongoing audit readiness is then an operational practice — weekly exception review, quarterly internal audits — not a six-month rollout.

‍

Frequently asked questions

‍

What property accounting capabilities matter most for affordable housing audits?

‍

Unit-level transaction assignment, auto-journalization from a standardized transaction code library, period enforcement with close-out batches, drill-down from financial statements to source journal entries, and native TRACS integration for Section 8 portfolios. These capabilities let you answer auditor questions without manual reconstruction.

‍

What compliance data should be centralized in the system?

‍

All tenant income certifications (Initial, Interim, and Recertifications) for TICs, 50058s, and 50059s with supporting documentation, lease agreements and addenda, rent calculation worksheets, recertification schedules and completion records, subsidy payment tracking, maintenance and inspection records, and every financial transaction tied to its specific unit and entity. Everything an auditor can request should live in one searchable database.

‍

How does automated compliance tracking prevent audit findings?

‍

Automation catches issues before they become findings. Income limit hard-stops prevent non-qualifying move-ins at the source. Rent ceiling enforcement prevents rents that exceed program caps. Recertification reminders at 120/90/60/30 days keep deadlines from slipping. AUR/NAUR automation flags over-income events at recertification approval. The gap between detection and correction shrinks from months to minutes.

‍

Do purpose-built systems work for multiple funding program types at once?

‍

Yes. A system built for affordable housing should handle LIHTC, HOME, Section 8, and USDA RD simultaneously, with each program enableable per property. Mixed-finance properties that layer multiple programs should see all rule sets enforced without collision.

‍

What audit trail information do auditors expect to see?

‍

Who made each change, when, what the previous value was, and — where your workflow requires it — why. Audit trails should be structured records protected by soft-delete and permission-gated access, not log files that an admin can edit.

‍

How do you reconcile HAP payments for a Section 8 audit?

‍

Through TRACS integration. On a purpose-built platform, this means a direct connection to the HDS (HUD Data System), 50059 data string generation for TRACS transmission, HAP voucher payment preview and automated posting, and rent roll CSV sync with automatic discrepancy detection between HAP amounts and contract rents.

‍

How does HOTMA affect audit readiness?

‍

HUD extended the HOTMA compliance deadline to January 1, 2027, and TRACS 203A hasn't been released as of early 2026. No vendor can claim full HOTMA compliance yet. What matters is readiness: a system that can absorb new TIC forms, updated asset exclusion rules, and the post-HOTMA 50059 format without a data rebuild.

‍

How often should we run internal audits using system reports?

‍

Quarterly, using the same reports, the external auditor will review. Quarterly frequency keeps findings fresh enough to correct and the workload manageable for compliance staff.

‍

How long does implementation take?

‍

Days, not months. A purpose-built affordable housing platform imports MAT files from HUD systems, Excel templates for the chart of accounts and unit data, and CSVs for portfolio migrations. Your team is live and issuing TICs within days. Ongoing audit readiness — weekly exception review, quarterly internal audits — is an operational practice, not an implementation timeline.

‍

Key takeaways

‍

• Purpose-built affordable housing accounting ties every transaction to a specific unit and entity, which is what makes audit documentation recoverable in seconds instead of weeks.
• Automation catches compliance issues — income limits, rent ceilings, AUR/NAUR, AIT — at the point of transaction, not after the fact.
• Pre-built reports that match state and federal audit checklists turn a week of documentation gathering into a batch export.
• Audit trails protected by soft-delete and permission-gated access prove internal controls work, which is what auditors actually test.
• Auto-journalization from a standardized transaction code library, with real-time GL posting, eliminates the reconciliation gap between compliance records and financial records.
• HOTMA readiness matters more than HOTMA claims. As TRACS 203A lands and state forms update, a well-built system absorbs the new versions as templates rather than rebuilds.
• Implementation is measured in days. Audit readiness is an operational practice.

‍

Matt Hoskins is the CEO and co-founder of ExactEstate. Before building the platform, he spent years in property management, which is where most of what's in this article came from. 

‍