Many PHAs and property owners struggle with a basic question: which parts of this guide actually apply to them? Between compliance audits, financial statement audits, and shifting federal thresholds, it's easy to misjudge what documentation auditors expect or where a finding might surface.
This guide breaks down the Consolidated Audit Guide's purpose, the two required audit components, the documentation auditors request most often, and practical steps to stay audit-ready throughout the year, not just when the auditor calls.
Key Takeaways
- HUD Handbook 2000.04 sets the compliance and financial reporting rules for HUD program audits
- Every HUD audit requires two parts: a compliance audit and a financial statement audit
- Entities expending $1,000,000+ in federal awards annually must comply with Single Audit requirements
- Organized, digital recordkeeping strongly predicts a clean audit result
What Is the HUD Consolidated Audit Guide?
HUD's Office of Inspector General publishes the Consolidated Audit Guide for Audits of HUD Programs, Handbook 2000.04, to standardize how independent auditors examine profit-motivated participants in HUD housing and Ginnie Mae programs. Think of it as the shared playbook that keeps audits consistent from one CPA firm to the next.
The guide isn't a single static document. It's revised chapter by chapter over time, which means different sections carry different update dates depending on when HUD last touched them.
Important distinction: the Consolidated Audit Guide supplements, rather than replaces, Generally Accepted Auditing Standards (GAAS) and Government Auditing Standards (GAGAS). Auditors still apply professional judgment; the guide simply adds HUD-specific procedures on top of the baseline standards.
Internal Controls Require Active Testing
A common misconception is that auditors can just assume the worst about internal controls and skip testing them. Not under this guide.
For major HUD-assisted programs, auditors must:
- Understand and document the entity's internal control structure
- Test whether controls actually operate as designed
- Report any control deficiencies as findings, even when risk was initially assessed as low
Auditors also carry a reporting duty when they uncover material noncompliance, fraud, or illegal acts. Depending on the circumstances, GAGAS or Handbook paragraph 2-5 may require direct written reporting to HUD's Office of Inspector General through the Single Audit Coordinator, separate from the standard audit package.
The HUD OIG's Consolidated Audit Guide page outlines the full scope of programs and participants covered.
The guide's Chapter 3 specifically governs HUD-insured or HUD-held multifamily projects and project-based Section 8 rental assistance, applying to nonprofit owners, private owners/agents, and their management agents. PHA-administered Housing Choice Voucher operations fall under a separate governmental audit framework, which we cover next.
Who Must Comply: Audit Thresholds and Applicable Entities
Not every HUD-funded entity triggers a Single Audit requirement. The determining factor is spending, not program type alone.
Under 2 CFR Part 200, Subpart F, a non-federal entity that expends $1,000,000 or more in federal awards during its fiscal year must obtain a Single Audit or, where eligible, a program-specific audit.
| Requirement | Prior Rule | Current Rule |
|---|---|---|
| Expenditure threshold | $750,000 | $1,000,000 |
| Effective date | N/A | FY beginning on/after Oct 1, 2024 |
| Audit type required | Single Audit or program-specific audit | Same |
This increase took effect under a final rule published in the Federal Register on April 22, 2024.
Entities below that threshold aren't off the hook entirely. They're exempt from the federal audit mandate for that year but still must make records available for review if HUD or a pass-through entity requests them.
Who typically falls under these rules:
- Public Housing Agencies (PHAs) administering public housing and HCV programs
- CoC and ESG grantees, whether governmental or nonprofit
- Section 8 project-based property owners and management agents
- Participants in HUD-insured multifamily mortgage programs
These entities share one rule that often causes confusion: a Single Audit is entity-wide, not project-by-project.
Organizations with multiple HUD projects don't need separate audits for each property. Instead, the entity prepares consolidated financial statements and a single schedule of expenditures of federal awards covering all programs together.
A program-specific audit is only an option when an entity's federal awards come from a single federal program.
The Two-Part HUD Audit Process
Every HUD-required audit consists of two components performed as part of the same engagement: a compliance audit of major HUD programs and a financial statement audit of the entity as a whole. Neither one substitutes for the other, and both get delivered together in the final report package.
Compliance Audit
This is where auditors verify that your agency is actually following program rules, not just reporting numbers correctly.
Testing typically covers:
- Tenant eligibility and income recertification — applications, waiting-list files, HUD-50059 certifications, and income verification documents
- Affirmative Fair Housing Marketing (AFHM) plans — whether marketing and tenant selection followed the approved plan
- HAP voucher accuracy — tracing calculated tenant assistance amounts to what was actually billed to HUD on the monthly voucher
- Rent reasonableness — confirming Section 8 rents don't exceed HUD-approved contract rents
- Replacement reserve withdrawals — verifying HUD authorization, sampling funded repairs, and tracing reimbursements to invoices
The Chapter 3 audit procedures for HUD multifamily programs lay out these testing steps in detail, including how auditors sample tenant files and cross-reference them against recertification records.
Financial Statement Audit
This component reviews whether the entity's financial statements fairly represent its financial position. It comes with supplemental schedules unique to HUD programs, including a listing of identity-of-interest transactions and a schedule of funds held in financial institutions.
On auditor independence: performing bookkeeping doesn't automatically disqualify a CPA firm from also auditing an entity. Independence is impaired only when the auditor authorizes transactions or changes entries, codes, or source documents without management approval.
Preparing complete financial statements from scratch creates a significant threat that generally requires declining the engagement. Posting management-approved entries or reconciliations may still be acceptable, provided the firm documents proper safeguards.
One more wrinkle: when auditors perform substantial fieldwork outside their home state, they need to confirm compliance with that state's licensing rules. Mobility provisions under NASBA's Uniform Accountancy Act generally allow this, but destination states can impose their own registration or notice requirements.
Essential Documentation and Required Audit Reports
Auditors don't show up and improvise. They request a predictable set of documents, and having them ready in advance saves everyone time.
Documents auditors typically request:
- Regulatory Agreement and any amendments
- Approved AFHM Marketing Plan and Tenant Selection Plan
- Most recent Management Certification (Forms HUD-9839-A/B/C)
- Cash receipts and disbursements ledgers
- Insurance and fidelity bond documentation
- REAC/NSPIRE inspection reports
- Replacement reserve withdrawal approvals and supporting invoices
Once fieldwork wraps up, HUD requires a standard package of reports:
- Opinion on financial statements and supplementary information
- Report on internal control over financial reporting and compliance
- Compliance opinion for each major HUD program, including internal control over compliance
- Schedule of findings and questioned costs — required even when there are zero findings, in which case it simply states none were disclosed
- Status of prior findings, when applicable
Current guidance eliminated separate compliance reporting for nonmajor programs and standalone AFHM compliance reports. AFHM remains a testing area within the compliance audit, but material violations now get folded into the main findings report rather than a separate document.
When findings do surface, the entity must prepare a corrective action plan alongside its annual financial statements. This isn't optional paperwork. It documents planned actions, responsible staff, target completion dates, and repayment details if funds are in question.
The pattern that separates a smooth audit from a stressful one usually comes down to preparation. Agencies that maintain organized, retrievable records year-round consistently report fewer scramble-mode findings than those that compile documentation reactively once the auditor's request letter arrives.
Best Practices to Stay Audit-Ready Year-Round
Audit readiness works best as a daily habit, not a once-a-year scramble.
Run your own mock audits. Periodic internal self-assessments catch eligibility gaps, missed recertifications, or incomplete files before an outside auditor finds them. A quarterly spot-check on a sample of tenant files can surface issues while they're still cheap to fix.
Centralize and digitize tenant records. Paper files get misplaced or left incomplete across departments. FileVision's Electronic Tenant Records (ETR) platform closes that gap, linking documents directly to key housing lifecycle events such as Intake, Annual Recertification, and Interim Changes.
Every piece of paperwork tied to a transaction stays together and complete. The platform also supports secure, role-based external auditor access, letting auditors review specific records remotely under read-only permissions, without staff pulling paper files or scheduling site visits.
Eliminate duplicate data entry through HMS integration. Real-time syncing of tenant names, recertification dates, and assigned specialists between your housing management system and your document platform reduces the inconsistent-record risk that often triggers findings in the first place.
Track compliance metrics continuously, not just at certification time. For SEMAP-related indicators, automated scoring against CFR 985 criteria and faster HUD-52648 form generation mean your agency isn't reconstructing a year's worth of compliance data the week before submission.
Frequently Asked Questions
What is the HUD audit process?
It combines a compliance audit of major HUD programs with a financial statement audit of the entity. An independent CPA performs both under the Consolidated Audit Guide, following GAAS and Government Auditing Standards.
What are the 5 C's of audit findings?
The 5 C's are Criteria, Condition, Cause, Effect, and Recommendation. This framework helps auditors explain what went wrong, why it happened, and what corrective action should follow.
What not to say during an audit?
Avoid speculating on facts you're unsure of, presenting guesses as certainty, volunteering information beyond what's asked, or promising corrective action you don't have the authority to commit to.
What is HUD Handbook 2000.04?
It's the formal name for the Consolidated Audit Guide issued by HUD's Office of Inspector General to standardize audit procedures for HUD program participants, primarily multifamily and Section 8 property owners.
Who is required to have a HUD audit?
Entities expending $1,000,000 or more in federal awards annually, including PHAs, Section 8 property owners, and HUD-insured mortgage program participants, must undergo these audits each year.
What documents are needed for a HUD audit?
Core items include the Regulatory Agreement, tenant eligibility and recertification files, insurance documentation, cash disbursement records, and REAC/NSPIRE inspection reports, among other program-specific schedules. Centralized electronic tenant records make these documents easier to compile and share with auditors.
