Woman Explaining Project

Your housing authority is still on the hook for strong controls when you outsource business functions. Know the risks of control failures and how to avoid them.


PHAs: Avoid Lapses in Internal Controls Over Third-Party Service Providers

  • Karen Greiner
  • 1/14/2019

Many public housing authorities (PHAs) we work with opt to use third-party service providers (3PSP) for functions like HQS inspections, payroll and human resources, property management, and FDS submissions. While engaging outsourced providers is very often a smart business decision, remember that it doesn’t relieve your PHA of your responsibilities to monitor controls or get you off the hook if they go unmet by the providers you engaged.

You can reap the cost-saving and efficiency-boosting benefits of working with a 3PSP as long as you take certain precautions to help your PHA avoid potential lapses in internal controls and possible monetary consequences. Here are a few scenarios that help illustrate the pitfalls of engaging 3PSPs without proper checks and balances, as well as tips for steering clear of gaps in oversight.

Outsourced HQS inspections


A PHA outsources its housing quality standards (HQS) inspection process to a 3PSP and provides the 3PSP with access to its tenant system, which allows for the electronic upload and maintenance of inspection reports. The PHA also provides the listings of units due for inspection. The duties of the 3PSP include setting appointments for inspections, performing inspections, notifying the tenants and landlords of inspection results, scheduling and performing follow-up inspections for failed units, and entering inspection results into the tenant system.

The PHA encounters various difficulties with the 3PSP in the first six months. The inspectors frequently fail to upload their inspection results into the tenant system. Instead, the 3PSP sends the PHA’s inspection supervisor a large PDF file containing all inspections performed in a single day. In many cases, the inspection supervisor does not receive this file until weeks after the inspections occurred.

The size of the file also causes difficulties in extracting information about specific tenant units. The PHA begins receiving phone calls from tenants who stated they took time off work to wait for the inspector, but the inspector never showed. The PHA realizes some inspectors were marking off inspections as tenant no-shows, but never attempted to visit the unit. Finally, the 3PSP inspectors do not always re-inspect failed units within the proper time frame (or at all).

Implement controls to avoid this scenario

  • Ensure the 3PSP inspectors receive adequate training on using the tenant system and fully understand the process required to upload inspection results into the system.
  • Provide the inspectors with a user guide, and monitor the uploaded reports on a daily basis for the first few weeks to verify they properly complete the process. This allows the PHA to identify any missed inspections and schedule them in a timely manner.
  • Assign a PHA employee to perform daily spot checks on units with recent inspections scheduled to ensure results were uploaded.
  • In the event of improper or missing uploads of results (e.g., receiving large PDF files of all inspections), the PHA inspection supervisor should reiterate the proper process to the 3PSP. If issues continue, notify the procurement department and executive director to report a contract failure.
  • Assign a PHA employee to conduct unannounced onsite visits to scheduled inspections to ensure the 3PSP inspector actually conducts the inspection.
  • Run reports to identify failed inspections without a pass date and failed inspections with significant delays between the fail date and the pass date. This allows the PHA to determine if housing assistance payments should be abated or if follow-up inspections are performed properly.

Outsourced payroll/human resources


A PHA chooses to outsource its payroll and human resources functions because of a reduction in funding and staff. The 3PSP provides an electronic timesheet system, performs the payroll process, and maintains original paperwork to document pay raises and other human resources functions. During the course of the contract, the relationship between the PHA and 3PSP sours, and the PHA stops paying the 3PSP.

In response, the 3PSP eliminates the PHA’s ability to access its electronic timesheets and other payroll information. During an annual financial statement audit, the PHA cannot provide timesheets or evidence of approved pay raises because the 3PSP maintains the documentation.

Implement controls to avoid this scenario

  • Pay raises and other wage rate changes such as cost of living adjustments (COLA) should require approval of a PHA supervisor and its executive director (or the board). Some PHAs print a list of all employees who qualify for an annual COLA. The executive director signs each page to acknowledge approval. The COLA is also approved by the board and recorded in the board minutes. Maintaining that list of employees and the board minutes would provide verification of the COLA for all employees, even if the information is eventually maintained electronically by the 3PSP.
  • Reporting systems often offer options that allow users to run and download reports. A PHA employee could be tasked with running a report from the time system on a daily (or weekly) basis to list the timesheet details for all employees. This eliminates the possibility of losing key data should the time system fail.
  • Original documents, especially payroll information, should not be sent to anyone outside of the PHA.
  • The contract with the 3PSP should specifically require the 3PSP to provide the PHA with copies of all documentation created by the 3PSP (evaluations, payroll registers, pay increase forms, etc.). 
  • Consider potential legal and procedural consequences before breaking a contract. In this scenario, requesting copies of all paperwork and downloading files before withholding payment would have provided the PHA with most of its information.

Property management


A PHA hires a property management company to handle the daily financial accounting and reporting for a housing development reported as a blended component unit in the PHA’s financial statements. The duties of the company include receiving/depositing rent checks, recording transactions in the general ledger, paying vendors, preparing bank reconciliations, and providing monthly financial reports to the PHA.

The PHA’s internal auditor speaks with the company and learns one person has the responsibility to perform all financial functions for the development, including preparing bank reconciliations. The bank reconciliations are not reviewed or approved by anyone in the management company. The auditor speaks with the development accountant at the PHA and learns the monthly reports provided by the management company (which include the bank reconciliations) are reviewed by the development accountant but nobody else at the PHA. This information results in internal control deficiencies over financial reporting for the blended component unit.

Implement controls to avoid this scenario

  • The contract between the PHA and 3PSP should specifically describe the internal controls the 3PSP must follow.
  • A person other than the one handling the daily financial activity should prepare the bank reconciliation, and a third person should review and approve the reconciliation. The people preparing and approving the reconciliation should sign and date the reconciliation to provide an audit trail.
  • The PHA should have procedures related to the receipt of the monthly reporting package from the 3PSP. The development accountant at the PHA should complete a standard set of review procedures and provide an executive summary to the CFO or finance director.

Fee accountants for FDS submissions


A PHA hires a fee accountant to assist with year-end closeout procedures and create the unaudited FDS submission. The fee accountant makes numerous adjustments to the trial balance while creating the unaudited FDS submission, but does not provide adjusting entries to the PHA or maintain a clear crosswalk showing how the trial balance accounts agree with the FDS.

While preparing for the annual audit, the finance director compares the FDS submission to the trial balance downloaded from the PHA’s accounting system and cannot reconcile the balances or roll forward net position amounts. The finance director is unable to explain what makes up balances on certain FDS lines, as they do not tie to the trial balance.

Implement controls to avoid this scenario

  • A fee accountant should always provide details of any proposed journal entries to the PHA.
  • Whenever possible, adjustments or reclassifications should be posted directly to the accounting system to minimize differences between the trial balance and the FDS. This is especially important for PHAs that use accounting systems designed to mirror the FDS line numbers.
  • Upon completion of the unaudited FDS, the fee accountant should provide a crosswalk listing all GL accounts, their respective FDS line numbers, and all adjusting entries between the trial balance and the FDS.

Remember, the buck stops with your PHA

The overarching lesson from these scenarios is that internal controls are your PHA’s responsibility, no matter who performs a process. Your PHA cannot shift the responsibility to provide and monitor a system of internal controls to any third party. It’s also worth noting here that, despite common misconceptions, an external independent auditor can never be part of an entity’s internal control structure.

A conservative approach could be to treat a 3PSP the same as your employees and subject them to the same monitoring and recordkeeping requirements. Just as new employees require more supervision in the beginning of their tenures, the same is true when utilizing 3PSPs. Consider potential problems and establish internal controls to prevent them in the beginning of a relationship to save time and money in the future.

How we can help

CLA’s housing authority-specialized professionals can help your PHA implement and monitor internal controls in your contracts and interactions with third-party service providers, as well as your in-house functions.

  • Karen Greiner
  • Director