HOA financial controls: how a small board protects the money (and the treasurer)

In a small self-managed HOA, one person usually handles the money. They have the bank login, they pay the bills, they reconcile the account when anyone does, and they report the balance at the annual meeting. Nobody else looks, because nobody else has time, and because the treasurer is a neighbor everyone trusts.

That trust is usually deserved. The setup is still a problem. A single person with unchecked access can make an honest mistake that compounds for months, pay a fake invoice, or in the rare bad case, quietly move money for a long time before anyone notices. And when something does go wrong, the treasurer has no easy way to show they did everything right.

Financial controls fix both problems. They are not about suspicion. They protect the association's money and the volunteer who handles it. Here are five that a small board can set up in an afternoon.

1. Never let one person hold the money alone

The core principle is separation of duties: the person who moves money should not be the only person who can see where it went.

A large board splits approving, paying, and recording across different people. A three-person board for a six-townhome HOA cannot split every task, but it can make sure nobody acts unseen:

• At least two board members can log in to every account. Read-only access is fine for the second person. The point is that someone besides the treasurer can check the balance on any given day.
• Two signers on every bank account, and the bank knows who they are. Update the signature card every time the board changes. A former director still listed as a signer is a gap.
• Statements reach a second person. Have the bank send statements to a shared board address or a second director, not only the treasurer.

For reserves in Washington, two signatures are not optional. RCW 64.90.535 requires the signatures of at least two officers or directors for every disbursement of reserve funds, along with supporting invoices. If your reserve account lets one person move money with a single click, call the bank this month.

2. Reconcile monthly, and have someone else review it

A reconciliation matches the bank statement against the association's records. Every deposit traces to an owner payment, and every withdrawal traces to an approved bill. For a small community it takes about 20 minutes a month, and it catches most problems early: duplicate payments, missed dues, bank fees nobody approved, a vendor that billed twice.

The control is the second set of eyes. The treasurer prepares the reconciliation, and a different board member reviews it and signs off, even if that is just a reply that says "reviewed." The reviewer should open the actual bank statement, not just the summary. It is a five-minute job.

Add "reconciliation reviewed" as a standing line on every board meeting agenda. If it did not happen, the minutes will show it, and that visibility is usually enough to keep it happening.

3. Set a written approval threshold for spending

Decide in advance what the treasurer can pay without asking anyone. A simple written policy works:

• Recurring, budgeted bills like insurance, trash, the landscaping contract, and utilities get paid on schedule by the treasurer.
• New or unbudgeted expenses over a set amount, for example $500, need a second board member's written approval before payment. An email reply counts.
• Larger amounts, or anything that commits the association to a contract, go to a board vote and into the minutes.

Pick numbers that fit your budget. For a six-townhome HOA with a $30,000 operating budget, $500 is a meaningful line. A bigger community might set it at $2,000. What matters is that the threshold is written down and everyone uses the same one.

4. Verify every change to payment details

For many small organizations, the bigger risk today is not insider theft. It is payment fraud. An email arrives that looks like it came from your landscaper or your insurance agent: "We changed banks, please send this month's payment to the new account." The sender's address is one letter off, or the vendor's real email account was hacked. The money goes out and does not come back.

The control is simple and absolute:

• Never change a vendor's payment details based on an email. Call the vendor at the phone number you already have on file, not the one in the message, and confirm.
• Treat urgency as a warning sign. "Pay today or service stops" is a classic pressure tactic.
• Confirm requests that appear to come from a board member. A message from "the president" asking the treasurer to wire money or buy gift cards gets a phone call before anything else.

Put this in writing so the treasurer can point to it when a pushy email arrives: "Our policy is to verify payment changes by phone. I'll call you back."

5. Report to owners and get an outside review

Owners should see the numbers. A short monthly or quarterly report is enough: beginning balance, money in, money out by category, and the ending balance for each account. Add the count and total of accounts more than 60 days behind, without names. Post it where every owner can find it.

Once a year, someone outside the day-to-day should look at the books. In Washington, RCW 64.90.530 requires an annual financial statement and an annual audit by a CPA. For associations with annual assessments under $100,000 (a figure adjusted for inflation), owners holding a majority of the votes can waive the audit, but the waiver has to happen every year. Record that vote in the minutes each time.

Many small boards waive the audit because a full audit is expensive for a tiny budget. If you do, replace it with something lighter rather than nothing. A CPA review engagement works. So does an owner who is not on the board walking through the year's statements and reconciliations with the treasurer and signing a short note saying they did.

Other states set different thresholds, and your governing documents may require more than state law. Check both.

Back it up with fidelity coverage

Controls reduce risk. They do not eliminate it. Fidelity or crime coverage protects the association if someone with authorized access steals funds, which property and liability policies typically exclude. Our insurance guide covers how to size it, but the short version is to cover close to the total the association holds, reserves included. Insurers may ask about dual signatures and reconciliation on the application, so having these controls in place makes that conversation easier.

Put it on one page

Pull all five controls into a one-page financial controls policy and adopt it by board vote at a regular meeting:

1. Who can access each account, and who the authorized signers are
2. Who reconciles, who reviews, and by what day each month
3. Spending thresholds and how approval is recorded
4. The phone-verification rule for payment changes
5. The owner reporting schedule and the annual review method

Review it every year when the board turns over, and give it to each new treasurer on day one. It turns "trust me" into a routine anyone can check.

In Fourplex, owner payments go directly into the association's own bank account, and board members can see who has paid and what is outstanding, so the dues side of the picture never lives with just one person. The habits above still matter more than any tool. A board with a one-page policy and a five-minute monthly review is safer than a board with great software and one volunteer holding every login.

This is general information, not legal or accounting advice. Confirm the requirements in your governing documents and state law, and talk to a CPA about the right level of annual review for your association.