HUD 232 Audit Requirements for Skilled Nursing Facilities

The annual audit obligation

Skilled nursing facilities that finance or refinance through HUD's Section 232 program take on a set of audit and reporting duties the moment the loan closes, not after some grace period to get organized. This piece walks through what those duties involve. It covers the annual audit itself, the 90-day clock, the surplus cash math that trips up more operators than anything else, and what a recent HUD OIG review found when it went looking for trouble in the portfolio.

HUD's Office of Residential Care Facilities (ORCF) runs the Section 232 mortgage insurance program, which currently backs more than 3,600 loans with an unpaid principal balance north of $32 billion. That scale is why the reporting rules aren't negotiable, and they aren't "best effort" either. Eligible properties include licensed nursing homes, assisted living facilities, intermediate care facilities, and board and care homes. The loan-to-value ceilings set real stakes for owners: up to 80% of market value for skilled nursing (85% for qualified non-profits), and 75% for assisted living and memory care. Anyone entering the program under the updated Section 232 Handbook provisions, is working under a framework built around one question: can HUD trust what your books say about your property's cash position?

Federal regulations anchor the system, including 24 CFR 5.801. Together they set the financial reporting standard every Section 232 borrower has to meet. The obligation splits into two pieces. First, a financial statement audit of the entity, prepared under GAAP. Second, a compliance audit covering the entity's major HUD programs. Both have to be done by an independent CPA working under applicable auditing standards, including Government Auditing Standards. That requirement alone should tell an operator this isn't a standard commercial audit with a HUD label slapped on it. Anyone who treats it that way tends to find out the hard way, at fieldwork, when the two frameworks don't line up cleanly.

What actually goes into the audit package runs longer than most first-time borrowers expect. There's a balance sheet, a statement of profit and loss, a statement of cash flows, and written descriptions of the entity's accounting policies. Beyond that, HUD wants year-end statements for every bank account tied to the property, including the operating account, the replacement reserve account, and the security deposit account. Then come the auditor's opinion, a report on ownership and compliance, supplemental schedules, the surplus cash computation (which gets its own treatment below, because it deserves one), footnotes, certifications, and internal control and compliance reports. That's not a checklist so much as a full financial portrait of the property, submitted once a year, with an independent CPA's name attached to it.

Submission happens electronically. Over 26,000 Multifamily Housing and ORCF participants file their annual financial statement data through FASS-FHA, using the FASSUB submission process. Here's the wrinkle that catches plenty of otherwise careful borrowers: the electronic submission needs a CPA attestation confirming it matches the hard-copy audit report, following SSAE 18 guidance the AICPA released in April 2016, formally adopted for FASS-FHA submissions. Skipping that reconciliation step means the electronic filing doesn't count as complete, even when the underlying numbers are correct.

Smaller operations get a break, and a fair number of small facility owners don't realize it applies to them. Projects with combined federal financial assistance under $500,000 can submit an owner-certified GAAP-basis financial statement instead of a full independent audit, under HUD Housing Notice H 2013-23. Plenty of smaller facility owners assume they're locked into the full audit regime by default and spend money on services they never needed. For everyone above that threshold, HUD's Consolidated Audit Guide lays out how independent auditors should approach engagements with profit-motivated program participants, and those audits still have to satisfy Government Auditing Standards on top of the Guide's specifics. HUD's own Quality Assurance Operations Division (QASS) runs quality control reviews of the independent public accounting firms doing this work. The audit functions as the primary signal HUD uses to assess a property's financial condition and decide whether it needs closer attention.

The 90-day deadline, the initial audit period, and the borrower/operator split

The core deadline is simple to state and harder to hit than it sounds: audited financial statements are due to HUD no later than 90 days after fiscal year end. A December 31 fiscal year close means a March 31 filing deadline, full stop. Auditors typically need complete records in hand by mid-January to finish fieldwork on schedule, and waiting until February or March to start pulling documents together repeatedly causes delays documented throughout the compliance record. Miss the 90-day window and HUD flags the file, which complicates the relationship with the loan servicer in ways that tend to snowball rather than resolve quietly.

New loans get a different calendar for their first audit cycle. The initial audit period starts on the closing date and runs through December 31 of that same year, with one automatic adjustment: if closing happens on or after September 1, the period stretches to cover through December 31 of the following year instead. A loan that closes November 3, 2026 has an audit period running all the way through December 31, 2027, over a year of activity rolled into the first filing. That deferral exists for a practical reason: nobody expects a borrower who closed in October to produce a meaningful three-month audit two months later.

Borrowers and operators are treated differently, and a full GAAP audit is required every year for the borrower, with no exceptions, while operators can generally submit operator-certified statements instead. The borrower, the entity holding the mortgage, needs a full GAAP audit every year, no exceptions. The operator, if it's a separate entity from the borrower, can generally submit operator-certified statements instead of a full independent audit, unless that operator also happens to be the borrower, in which case the full audit requirement kicks back in. Operators must also submit statements on a quarterly reporting cycle, with specific deadlines tied to each quarter end.

Even where the operator's statements aren't independently audited, the borrower's auditor still has work touching the operator relationship. The borrower's auditor still has work touching the operator relationship, including checking whether the operator reported required events to HUD and the lender on time and whether the operator filed its required financial statements. Fail any of that, and it counts as non-compliance with the operator's agreement with the borrower, a separate finding from anything on the borrower's own books.

Related-party arrangements, where borrower and operator share ownership or management, come up constantly in this sector. That shouldn't change the audit treatment in any dramatic way, but the relationship has to be disclosed clearly in the financial statement notes. The practical first move in any audit engagement, before anyone opens a spreadsheet, is assembling the complete signed HUD closing binder, covering regulatory agreements for both borrower and operator, the mortgage note, lease documents, the closing statement, and the Surplus Cash note if one exists. Sending that binder in full, rather than picking and choosing what seems relevant, saves weeks of back-and-forth later.

Surplus cash and why it is the central compliance risk

HUD doesn't leave owner distributions to discretion. The regulatory agreement binds every Section 232 borrower to a surplus cash calculation, and that calculation decides, mathematically, whether an owner can take a dollar out of the property. The formula is not complicated: total cash minus total current liabilities equals surplus cash. Positive result, distributions are allowed up to that amount. Negative result, distributions are prohibited entirely, and anything already taken out during that period has to be repaid promptly unless HUD grants an extension. That repayment obligation is unforgiving by design, and it's meant to be.

HUD requires this calculation twice a year, at June 30 and December 31, and borrowers have to complete Form HUD-93486-ORCF before taking any distribution. On the audit readiness side, this feeds straight into what examiners check: were mortgage and escrow payments made on time, were reserve-for-replacement deposits made as required with any withdrawals properly HUD-authorized, and were owner distributions calculated correctly and kept within the surplus cash figure.

It would be easy to file surplus cash under paperwork, one more form among many. That reading misses the point. Cash deficiencies and unauthorized distributions are exactly the conditions that appear in audited financial statements as going-concern indicators, the accounting language for an entity that may not survive. The line connecting sloppy surplus cash discipline to eventual loan default is the most direct line anywhere in this compliance structure. The next section shows what that line looks like when it plays out across an actual HUD-insured portfolio, and the numbers there are not abstract.

What the April 2026 HUD OIG audit found, and what it means for operators today

A federal inspector general's office didn't launch this review out of routine curiosity. Defaults on HUD-insured residential care facility loans had been climbing, and OIG went looking for why. As of June 2024, 167 of 3,670 HUD-insured Section 232 borrowers, close to 5% of the entire portfolio, had defaulted, and those 167 loans carried an unpaid principal balance exceeding $1.1 billion.

OIG drilled into 4 portfolios spanning 70 properties and 84 loans, with a combined unpaid balance over $410.6 million. Every one of those 84 loans carried a "troubled" rating from HUD as of June 2024, all of them, no exceptions. When OIG pulled the audited financial statements for those properties, the pattern held across the board: borrowers had withdrawn funds when the property had no available surplus cash to withdraw against, properties were running outright cash deficiencies, and several weren't generating enough cash flow to cover current debts. This is the surplus cash mechanism from the section above, documented not as a hypothetical risk but as a portfolio-wide failure.

OIG found 204 instances of unauthorized distributions spread across those 84 loans: 174 unauthorized loans made from project funds, 29 unauthorized distributions of project funds, and 1 unauthorized reserve withdrawal. Two hundred and four separate violations across just 84 loans means multiple violations per property on average, which points to a systemic pattern rather than a handful of bad actors.

Where did HUD's own oversight fall short? OIG identified three specific gaps. ORCF did not receive audited financial statements from all borrowers as required. It did not ensure borrowers fully developed action plans to address risks the audits had already disclosed. And it did not notify the Departmental Enforcement Center before borrowers actually defaulted. OIG traced the root cause to a staffing problem, and the numbers are stark: the average number of properties managed per ORCF staff member rose from a range of 60-80 up to 165-200. That's roughly a tripling of caseload per staffer, and it leaves little room for the kind of detailed financial analysis this program depends on. By July 2025, the financial exposure tied to this review had grown to lenders being eligible to file insurance claims on 58 of the 84 loans, totaling more than $329.5 million.

What should an operator take from this? Every condition OIG flagged (cash deficiencies, unauthorized distributions, going-concern risk) is exactly the kind of thing a properly executed annual audit is designed to catch early, before it compounds into a default. The enforcement record shows what happens when those signals get missed at the regulatory level: ORCF running thin on staff does not loosen the obligations sitting on the borrower's side of the ledger. If anything, a thinner regulator raises the odds that a problem festers quietly before HUD has the bandwidth to step in. Which means the operator's own internal discipline, not HUD's monitoring capacity, ends up being the real backstop. That is the uncomfortable lesson of this review: the safety net was never as tight as the paperwork implied.

How the HUD 232 audit connects to broader SNF compliance obligations

Section 232 borrowers running skilled nursing facilities are filing into two regulatory systems, and those two systems have to agree with each other. They're filing into two, and those two systems have to agree with each other. HUD wants audited GAAP financials. CMS wants an accurate cost report. Both are mandatory, both depend on the same underlying financial records, and any daylight between them creates a problem neither regulator will shrug off.

The cost reporting side changed recently in ways that matter here. Medicare-participating SNFs are required to file the updated Form CMS-2540-24, The new form adds cost centers and contract-labor columns, a direct response to how dependent the sector has become on agency staffing, and it separates Medicare Advantage and Medicaid managed-care statistics from traditional fee-for-service data rather than lumping everything together. Filing happens electronically to the facility's Medicare Administrative Contractor, and it's due by the last day of the fifth month after the reporting period closes.

Layer on top of that the FY 2026 SNF PPS final rule, which includes updates market basket increase to SNF payment rates. That's real money moving through revenue and cost structures, and it flows into both the CMS cost report and the GAAP financials HUD reviews, at the same time, from the same underlying transactions.

Accurate cost center accounting, properly classified contract labor, and cleanly segmented payer revenue aren't just CMS concerns. They're the same records that make an agency-compliant GAAP audit possible. An operator whose books blur these categories creates risk on both fronts at once, not one or the other picked at random. Medicaid rates set income estimates for 67% of SNF and intermediate care beds, while Medicare rates cover no more than 3%. Those are the same revenue streams driving the cost report that also drive the cash flow figures HUD monitors every year through the audit. Treating clean cost report data and clean GAAP books as two separate filing chores, instead of one shared discipline, raises avoidable compliance risk.

Choosing an auditor with the right depth for HUD 232 and skilled nursing work

Ask this before signing an engagement letter: does this firm actually do this work regularly, or is a HUD 232 audit an occasional add-on bolted onto a broader multifamily housing practice? The second kind of firm is the wrong choice, even if the fee quote looks better. A HUD 232 audit demands fluency in GAAP, GAAS, GAGAS, HUD's Uniform Financial Reporting Standards, FASSUB attestation mechanics, surplus cash calculations, and the specific terms of the regulatory agreement, all at once. That's a lot of specialized ground for a generalist accounting firm to cover well, and the gap becomes visible exactly when it matters most: at fieldwork, three weeks before a filing deadline, when there's no time left to backfill what the firm didn't already know.

What should an operator actually look for? Active, current experience with ORCF submission requirements and FASSUB electronic filing matters far more than a firm that filed one HUD audit five years ago and remembers the broad strokes. Real familiarity with the HUD Consolidated Audit Guide and Government Auditing Standards is non-negotiable. So is a working understanding of skilled nursing accounting specifically, including how CMS-2540-24 handles contract labor and Medicaid/Medicare revenue classification, since that data has to reconcile with the GAAP audit discussed above. The auditor also needs to advise on surplus cash calculations and opening trial balance preparation before the fact, not after a problem has already occurred. And the firm needs a track record of actually hitting the 90-day deadline, which comes down to scheduling discipline and getting records requests out early rather than waiting on the client to volunteer documents.

The first audit cycle after closing is where a lot of the real difficulty piles up. An operator who closes on a Section 232 loan without lining up a HUD-experienced CPA right away runs into a stack of interlocking tasks all at once, and it's a lot to improvise under a 90-day clock: building the opening trial balance from scratch, reconciling every bank account back to the transaction date, and organizing the full closing binder described earlier, all before actual fieldwork can even start. That's a lot to improvise under a 90-day clock. Related-party structures, common enough in this sector to be closer to the norm than the exception, add another layer, since the auditor has to document borrower-operator relationships, related-party transactions, and master lease arrangements in a way that satisfies both ORCF's review standards and standard GAAP disclosure rules.

QASS actively reviews the work independent public accounting firms submit through REAC, so a firm that treats a HUD 232 engagement as routine multifamily housing work, rather than the specialized healthcare compliance exercise it actually is, creates exposure that lands on the operator, not just on the accounting firm's reputation. A CPA practice with a genuine, dedicated HUD 232 and skilled nursing focus, one that also understands how the CMS cost reporting side interacts with the HUD audit, functions less like an annual vendor and more like a year-round set of eyes on the property's financial health. That kind of continuity is what catches a surplus cash problem in September instead of finding it flagged in an OIG report eighteen months later.