Issue Date August 5, 2009 Audit Report Number 2009-KC-1009 TO: Brenda L. Waters, Acting Hub Director, Kansas City Multifamily Hub, 7AHMA //signed// FROM: Ronald J. Hosking, Regional Inspector General for Audit, 7AGA SUBJECT: Milestone Management Systems Inc.’s Management Controls for Managing Multifamily Properties Were Not Adequate HIGHLIGHTS What We Audited and Why We audited Milestone Management Services, Inc. (Milestone), of Topeka, Kansas, in response to a request from the U.S. Department of Housing and Urban Development’s (HUD) Office of Multifamily Housing in Kansas City, Kansas. HUD was concerned that Milestone had not complied with cash management requirements. Our audit objective was to determine whether Milestone complied with HUD’s cash management requirements for management agents. What We Found Milestone’s management controls were not adequate in three respects. Milestone did not (1) adequately segregate duties of on-site staff or provide proper oversight of these employees, (2) have a system for tracking significant rehabilitation and related costs for individual units, or (3) practice proper budgetary controls. In addition, Milestone did not provide its properties with adequate fidelity bond coverage, and it overpaid itself management fees. What We Recommend We recommend that HUD ensure that Milestone/property owners implement an adequate system of management controls and provide technical assistance and guidance as needed. We also recommend that HUD require Milestone/property owners to implement procedures to periodically assess the adequacy of fidelity bond coverage and adjust the coverage for each property when needed. Further, we recommend that HUD ensure that Milestone/property owners use a reliable process to calculate and pay management fees and that Milestone immediately repays overpaid management fees to the overcharged properties. Lastly, we recommend that HUD take appropriate administrative actions against Milestone/property owners if Milestone is unable or unwilling to comply with HUD requirements. For each recommendation without a management decision, please respond and provide status reports in accordance with HUD Handbook 2000.06, REV-3. Please furnish us copies of any correspondence or directives issued because of the audit. Auditee’s Response We provided the draft report to Milestone on June 10, 2009, and requested a response by July 29, 2009. Milestone provided comments on July 28, 2009. It generally agreed with our findings and recommendations. The complete text of the auditee’s response, along with our evaluation of that response, can be found in appendix B of this report. 2 TABLE OF CONTENTS Background and Objective 4 Results of Audit Finding 1: Milestone’s Management Controls Were Not Adequate 5 Finding 2: Milestone Did Not Provide Properties with Adequate Fidelity Bond 10 Coverage Finding 3: Milestone Overpaid Itself Management Fees 12 Scope and Methodology 14 Internal Controls 15 Appendixes A. Schedule of Questioned Costs 17 B. Auditee Comments and OIG’s Evaluation 18 3 BACKGROUND AND OBJECTIVE Milestone Management Services Inc. (Milestone), is a property management company operating out of Topeka, Kansas. Milestone was incorporated on February 6, 1989, and began managing U.S. Department of Housing and Urban Development (HUD)-related multifamily properties in the same year. During our audit period, Milestone managed seven multifamily properties located in Kansas, Missouri, and Illinois. Five of the properties were housing cooperatives, and two were not. Milestone managed HUD-insured and/or HUD-assisted properties governed by the following sections of the National Housing Act, as amended: • Section 213 – Mortgage Insurance for Cooperative Housing • Section 221(d)(3) and (4) – Mortgage Insurance for Rental and Cooperative Housing • Section 236 – Subsidized Mortgages/Interest Reduction Programs Under these sections of the National Housing Act, property owners enter into regulatory agreements with HUD. The regulatory agreements contain certain provisions, including but not limited to establishing and maintaining property reserve accounts, collecting rents, and performing property maintenance. Property owners are ultimately responsible for ensuring that the properties are operated in accordance with the regulatory agreement and applicable HUD handbooks. However, property owners may contract with a management agent, such as Milestone, to carry out the day-to-day management of the property. As the management agent, Milestone signs a HUD certification that it agrees to comply with the property’s regulatory agreement as well as other HUD requirements. Milestone and the property owners also enter into a management agreement between themselves, which details the expectations and responsibilities of the management agent. One of Milestone’s key responsibilities as the management agent is the oversight and supervision of personnel working on site at the properties. These on-site employees, such as the office and maintenance personnel, are employees of the property, not employees of Milestone. Our audit objective was to determine whether Milestone complied with HUD’s cash management requirements for management agents. 4 RESULTS OF AUDIT Finding 1: Milestone’s Management Controls Were Not Adequate Milestone’s management controls were not adequate. This deficiency occurred because Milestone did not fully understand the importance of a strong system of management controls. As a result, HUD and property owners could not be assured that Milestone’s efforts reasonably protected its properties’ funds from fraud, waste, and abuse. Milestone’s management controls were not adequate in three respects. Milestone did not (1) adequately segregate duties of on-site staff or provide proper oversight of these employees, (2) have a system for tracking significant rehabilitation and related costs for individual units, or (3) practice proper budgetary controls. No Segregation of Duties with Limited Oversight of Property Staff Milestone did not provide for adequate segregation of duties for on-site staff, nor did it provide acceptable oversight of these employees. HUD’s handbook governing financial operations and accounting procedures for insured multifamily properties contains detailed requirements for segregation of duties involving financial transactions. Further, as the management agent, Milestone was responsible for supervising on-site property employees to properly maintain and operate the property. Milestone allowed on-site property managers to control most cash income processes without properly overseeing or validating their work. On-site managers collected tenant rents, posted rent payments to tenant accounts maintained in a separate set of books and records at the properties, and prepared and made bank deposits. Further, Milestone’s accounting system was not integrated with the various properties it managed, so it relied on bank deposit information and month-end rent collection records prepared by the on-site property managers. Based on the information from the managers, Milestone posted only total rents collected to its own set of accounting records for each property but did not independently verify the validity of the information. In addition, it made on-site property managers solely responsible for following up with tenants regarding late or unpaid rent. In December 2006, Milestone learned that one on-site manager had stolen tenant rents for more than three years. The property’s bank had notified Milestone that the manager had made suspicious financial transactions with money orders made out to the property. Milestone conducted a financial review and confirmed the long-term theft. Milestone had inappropriately allowed the employee to control all aspects of 5 the rent collection, deposits, recording, and late/unpaid rent follow-up process. The employee was able to manipulate the tenant records and accounting information and report false information to Milestone to hide the theft. For another property, Milestone allowed an assistant maintenance supervisor to approve and submit property invoices for rehabilitation and maintenance costs without oversight. It paid the invoices without verifying the legitimacy of the invoices or that the described work had been completed. Instead, it relied on the on- site employee’s approval. Milestone told us that it believed that an invoice containing the initials of the on-site manager or the assistant maintenance supervisor was sufficient to validate a property expense. However, Milestone later learned from other property employees, and subsequently confirmed, that the assistant maintenance supervisor had submitted a number of false invoices. Milestone paid the invoices because it did not recognize that the invoices were false. The scheme occurred because neither Milestone nor the on-site property manager had provided adequate oversight. No Tracking System for Costs of Substantial Rehabilitation Work Milestone did not have a system for tracking or following up on significant rehabilitation work performed on individual units. According to the management agreements between Milestone and the properties it managed, Milestone was to maintain a comprehensive system of records, books, and accounts. It also signed HUD certifications that it agreed to ensure that all expenses of the properties were reasonable and necessary. During the audit period, Milestone managed renovations of a number of units at its largest property. Although the property had in excess of 500 units, Milestone could not provide a detailed plan or schedule identifying what units were to be rehabilitated, by when, or at what cost for each unit. In addition, Milestone did not conduct adequate on-site verifications of completed rehabilitation work. It visited the property but did not conduct detailed inspections of the units. Further, it did not track renovation costs per unit. Therefore, it could not identify questionable costs charged for a unit, such as duplicated or unnecessary costs, nor could it compare the costs charged to the actual work completed to ensure that the costs were valid. The lack of a tracking system allowed the assistant maintenance supervisor to submit multiple invoices for payment for the same goods and services for the same unit. Milestone then paid fraudulent invoices that contained identical items for the same unit as many as five times. Milestone told us that the software system it used to generate payments identified duplicate invoices based only on the invoice number and the system did not have the ability to track or sort expenses by unit. 6 Lack of Budgetary Controls Milestone did not practice proper budgetary controls. Management agreements between Milestone and the properties required Milestone to prepare monthly financial reports, including a comparison of monthly income and expenses to the budget. Milestone generally provided monthly accounting and budget variance reports to owners and board members and discussed the reports at board meetings. However, it did not use the reports as a tool to help manage the properties, particularly when income was noticeably less than expected or expenses were significantly higher than expected. In addition, Milestone did not always make required monthly deposits to properties’ general operating reserve accounts, and it exceeded withdrawal limits without obtaining HUD’s approval. The purpose of the general operating reserve fund is to provide a measure of financial stability and to meet unforeseen financial obligations of the property. The properties’ regulatory agreements require the owner (or its management agent) to make monthly deposits to the operating reserve account equal to a certain percentage of rent collections for that month. In addition, property owners and designated agents are not permitted to make withdrawals from the general operating reserve in excess of a certain limit without HUD’s approval. For one property, the independent auditor noted that Milestone did not make any of the required deposits to the general operating reserve account for fiscal year 2007. Milestone also exceeded withdrawal limits for this property without first obtaining HUD’s approval. Milestone told us that it did not seek HUD’s approval when it exceeded withdrawal limits because the property needed the funds immediately to pay its monthly operating expenses. However, if Milestone had used proper budgetary controls, it should have been able to plan for required HUD approvals. For another property, in fiscal year 2008, Milestone did not make the required monthly deposits but, instead, arbitrarily made deposits throughout the year to fulfill the requirement. Prior HUD reviews for fiscal years ending 1999, 2000, and 2001 also revealed problems with Milestone’s not funding properties’ general operating reserve accounts and making unauthorized withdrawals. Importance of Management Controls Not Fully Understood Milestone did not understand that a strong system of management controls is necessary to safeguard its properties’ assets and provide for accurate books and records. Instead, it relied on limited site visits to ensure that its on-site employees properly managed the properties. 7 Property Assets Susceptible to Errors, Waste, and Fraud HUD and property owners could not be assured that Milestone’s efforts reasonably protected property funds or met budgetary control and financial stability requirements. This problem is illustrated by the on-site employee thefts at two of Milestone’s properties. Both thefts occurred over periods lasting at least three years. Milestone estimated property losses at more than $300,000. In addition, its independent auditor raised substantial doubt about one of the property’s ability to continue as a going concern. The auditor was mainly concerned about high vacancy rates but the employee theft of about $200,000 also contributed to the property having difficulty meeting daily operations costs. That property continued to experience severe cash flow problems and could place HUD at risk for the $11 million balance on its insured mortgage. If Milestone had practiced proper management controls, it should have been able to either prevent the employee thefts or detect and end them before the properties experienced significant losses. Conclusion Milestone’s management control efforts did not provide reasonable assurance that property funds were protected from fraud, waste, and abuse. HUD and property owners relied on the management agent to successfully manage properties and to do so in accordance with HUD rules and regulations. However, Milestone did not understand the importance of segregation of duties, sufficient management oversight, tracking of property expenditures, and proper budgetary controls. If Milestone had practiced proper management controls, it could have better protected property assets. Further, the above deficiencies along with those in findings 2 and 3 detailed later in this report, describe significant and repeated breaches of commitments to HUD and violations of HUD requirements. These deficiencies rise to a level to which HUD needs to consider whether Milestone can immediately improve its operations to fully comply with HUD requirements, or whether HUD should no longer allow Milestone to manage HUD properties. Recommendations We recommend that the Director, Office of Multifamily Housing, Kansas City, Kansas, 1A. Ensure that Milestone/property owners implement an adequate system of management controls. 8 1B. Provide technical assistance and guidance to Milestone as needed. 1C. Take appropriate administrative actions against Milestone/property owners if Milestone is unable or unwilling to comply with HUD requirements. 9 Finding 2: Milestone Did Not Provide Properties with Adequate Fidelity Bond Coverage Milestone did not provide the properties with adequate fidelity bond coverage. This deficiency occurred because Milestone did not periodically assess whether fidelity bond coverage was within acceptable limits. As a result, multifamily properties were placed at unnecessary risk of loss. Inadequate Fidelity Bond Coverage for Two Properties Milestone did not provide two properties with adequate fidelity bond coverage during the audit period. A fidelity bond is an insurance policy that protects property owners against financial loss resulting from dishonest acts of its employees. HUD regulations and management certifications signed by Milestone require property owners or their designated management agents to obtain a fidelity bond in the amount at least equal to potential rent collections for two months. One property had fidelity bond coverage of $100,000 in effect at the time of the audit. However, the potential rent collections for two months were nearly $170,000. We notified Milestone of this deficiency, and it increased the property’s fidelity bond coverage to $200,000, effective retroactively to September 2008. Another property did not have adequate coverage for 2007 and most of 2008. The property’s rent revenue increased substantially in 2007, primarily due to an increase in rents. However, Milestone did not increase the property’s fidelity bond coverage to an adequate level until September 2008. As a result, the property was underinsured by approximately $150,000 for the 21-month period. Adequacy of Coverage Not Periodically Assessed Milestone did not periodically assess whether fidelity bond coverage was within acceptable limits. The fidelity bond coverage requirement is based on a variable (potential rent collections) that may change over time, and, therefore, the acceptable amount of coverage may also change. Milestone and property owners were jointly responsible for reasonably assessing coverage and ensuring that the properties’ fidelity bond policies were sufficient. Multifamily Properties Placed at Unnecessary Risk of Loss Two multifamily properties were unnecessarily vulnerable to risk of loss. Milestone and property owners were responsible for safeguarding property assets 10 and mitigating potential losses. Maintaining adequate fidelity bond coverage to cover employee dishonesty was a way to protect HUD and property owners from losses, and Milestone and the owners should have taken the steps necessary to secure proper coverage. Recommendation We recommend that the Director, Office of Multifamily Housing, Kansas City, Kansas, 2A. Require Milestone/property owners to implement procedures to periodically assess the adequacy of fidelity bond coverage and to adjust the coverage for each property when needed. 11 Finding 3: Milestone Overpaid Itself Management Fees Milestone overpaid itself management fees. This problem occurred because Milestone did not have a reliable process for calculating and paying itself management fees, nor did it provide supporting documentation to property owners. As a result, properties did not have access to all of their operating funds. Overpaid Management Fees Milestone overpaid itself management fees. Its monthly compensation was established by the management agreements between itself and the properties it managed. The individual management agreements identified a certain percentage of gross collections to be paid monthly to Milestone from the properties’ operating account. Because Milestone was responsible for generating the payments for properties’ expenses, it generated payments to itself for the management fees. Milestone overpaid itself nearly $6,700 for one property (property A) for the fiscal year ending September 30, 2008, and owed the property more $600 from prior periods as of the end of our audit. HUD agreed and instructed Milestone to repay more than $7,000 to the property in March 2009. Milestone had a history of overpaying itself management fees. The properties’ independent auditor identified such overpayments as significant deficiencies for the properties and periods indicated in the chart below. Management Property name Fiscal year ending fee overpayment Property A September 30, 2006 $1,128 Property B December 31, 2007 $2,643 Property C June 30, 2008 $3,186 Milestone repaid the amounts indicated in the chart above. However, HUD recently determined that Milestone overpaid itself an additional $3,800 for property B for the same period identified in the chart. HUD instructed Milestone to repay this amount to the property in March 2009. Milestone recently notified HUD that it disagreed with the amounts identified as overpaid and not yet repaid for properties A and B. As of this report, HUD was evaluating Milestone’s disagreement with the amounts. 12 Unreliable Process for Calculating Management Fees Milestone did not have a reliable process for calculating and paying itself management fees. It also had not provided supporting documentation to owners. For most properties, Milestone made two payments to itself from the properties’ accounts each month. Contrary to the management agreement, the first payment was generally a flat fee paid at the beginning of the month, and the second payment was made during the middle of the month. Milestone told us that it based the second payment on estimated collections. It had not provided supporting documentation to most property owners to show how it had calculated the payments. Properties without Access to All Funds The properties did not have access to all of their operating funds. In addition, the overpaid management fees essentially resulted in improper loans from the properties to Milestone. Further, property owners could not readily assess whether the management fees paid to Milestone complied with the management agreements. Recommendations We recommend that the Director, Office of Multifamily Housing, Kansas City, Kansas, 3A. Ensure that Milestone/property owners use a reliable process to calculate and pay itself/themselves management fees. This process should include procedures through which Milestone would base its fees only on actual gross collections and provide detailed invoices showing monthly management fee calculations to property owners. 3B. Ensure that Milestone immediately repays $7,359 to property A and $3,866 to property B, and any additional overpaid management fees to the respective overcharged properties, unless Milestone provides adequate evidence that it had not overpaid itself. 13 SCOPE AND METHODOLOGY Our review generally covered the period October 2005 through September 2008. We conducted our audit work from November 2008 to March 2009 at Milestone’s office at 4900 Fairlawn Road, Topeka, Kansas. To achieve our objective, we conducted interviews of Milestone management and staff. We also interviewed HUD staff in the Kansas City, Kansas, Office of Multifamily Housing. We evaluated a management review of Milestone that HUD conducted in 2002. We also reviewed management reviews HUD conducted in 2008 for two properties that Milestone managed. We reviewed the property regulatory agreements, management certifications, management agreements, and applicable HUD handbooks and regulations. We also reviewed Milestone’s policies and procedures. In addition, we reviewed the records of a sample of properties based on property information provided by HUD and those properties with a larger number of housing units. We tested cash receipts and/or expenditures on the following properties: • Pin Oak Acres Apartments, Inc. • Parade Park Homes, Inc. • Fox Ridge Cooperative Townhouses, Inc. To test cash receipts and expenditures, we reviewed property budgets, bank statements, check registers, payroll journals, cash receipt journals, rent rolls, invoices, and general ledgers. We also reviewed audited financial statements for four properties that Milestone managed: • Pin Oak Acres Apartments, Inc. – fiscal year ending September 30, 2006 • Prairie Glen East Cooperative, Inc. – fiscal year ending December 31, 2007 • Parade Park Homes, Inc. – fiscal year ending December 31, 2007 • Fox Ridge Cooperative Townhouses, Inc. – fiscal year ending June 30, 2008 We reviewed the fidelity bond policies for six properties, including the four identified above as well as Wheatview Apartments and North Park Tower Cooperative. In addition, we reviewed Milestone’s analysis of employee thefts that occurred at two of the properties. We reviewed reports generated by Milestone’s computerized accounting system (CYMA Accounting Software). We used the computerized data for background and informational purposes only; therefore, we performed no tests of the data. We conducted the audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 14 INTERNAL CONTROLS Internal control is an integral component of an organization’s management that provides reasonable assurance that the following controls are achieved: • Program operations, • Relevance and reliability of information, • Compliance with applicable laws and regulations, and • Safeguarding of assets and resources. Internal controls relate to management’s plans, methods, and procedures used to meet its mission, goals, and objectives. They include the processes and procedures for planning, organizing, directing, and controlling program operations as well as the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined that the following internal controls were relevant to our audit objective: Milestone’s management controls for • Evaluating the validity of property expenses. • Ensuring receipt and proper recording of property receivables. • Calculating and paying management fees. • Complying with applicable laws, regulations, and agreements. • Preparing and evaluating property operating budgets and variance reports. We assessed the relevant controls identified above. A significant weakness exists if management controls do not provide reasonable assurance that the process for planning, organizing, directing, and controlling program operations will meet the organization’s objectives. Significant Weaknesses Based on our review, we believe that the following items are significant weaknesses: • Milestone did not provide for segregation of duties or provide acceptable oversight of on-site property employees (finding 1). • Milestone did not have a system for tracking or following up on significant rehabilitation and related costs for individual units (finding 1). • Milestone did not practice proper budgetary controls for its properties (finding 1). 15 • Milestone did not periodically assess whether fidelity bond coverage was within acceptable limits (finding 2). • Milestone did not have a reliable process for calculating and paying itself management fees (finding 3). 16 APPENDIXES Appendix A SCHEDULE OF QUESTIONED COSTS Recommendation Ineligible number 1/ 3B $7,359 1/ Ineligible costs are costs charged to a HUD-financed or HUD-insured program or activity that the auditor believes are not allowable by law; contract; or federal, state, or local policies or regulations. Although recommendation 3B also includes a recommendation for Milestone to repay $3,866 in ineligible costs to the applicable property, HUD identified this amount independent of our audit. Therefore, we did not include this amount as a questioned cost. 17 Appendix B AUDITEE COMMENTS AND OIG’S EVALUATION Ref to OIG Evaluation Auditee Comments Comment 1 18 Ref to OIG Evaluation Auditee Comments Comment 2 Comment 3 Comment 4 19 Ref to OIG Evaluation Auditee Comments Comment 5 20 Ref to OIG Evaluation Auditee Comments 21 Ref to OIG Evaluation Auditee Comments 22 Ref to OIG Evaluation Auditee Comments 23 Ref to OIG Evaluation Auditee Comments 24 Ref to OIG Evaluation Auditee Comments 25 Ref to OIG Evaluation Auditee Comments 26 Ref to OIG Evaluation Auditee Comments 27 OIG Evaluation of Auditee Comments Comment 1 As noted in the report, HUD asked that we review Milestone because HUD was concerned that Milestone had not complied with cash management requirements. HUD also told us of Milestone’s past noncompliance with HUD requirements and of the two instances of property employees involved with stolen rents and false invoices. HUD’s experience with Milestone led it to request that our office conduct a review of Milestone’s cash management practices and controls. Comment 2 Milestone’s written response to the report did not contain the referenced April 21, 2009, memorandum; however, Milestone provided the memorandum to us during the audit. The memorandum discussed Milestone’s policy to not allow the employee that collected and recorded rents, and prepared and recorded bank deposits, to also take the cash deposit to the bank. We do not believe that this procedure sufficiently addressed our segregation of duties concern identified in finding 1. The memorandum continued to allow the same employee access and responsibility for collecting rents, recording rents received, and preparing and recording each bank deposit. Allowing one employee to perform these duties is not adequate segregation of duties because it could allow an employee to manipulate the records and misappropriate property income. Milestone needs to adequately address this issue and present evidence of acceptable improvements to HUD. Comment 3 Although the June 15, 2009, memorandum had merit, it was addressed to on-site property managers and maintenance supervisors. It did not address how Milestone staff would use the information to prevent duplicate invoice payments or other misappropriation of property assets. Milestone needs to provide more detailed information to HUD regarding how Milestone staff will use the information to protect property assets. Comment 4 The July 2008, memorandum was an appropriate notice to Milestone staff; however, during our audit we identified two instances in which Milestone did not follow the written procedure after the memorandum date. As explained in finding 3, staff did not follow the policy for one property in August and September 2008, which was immediately following the memorandum date. Milestone needs to reiterate the policy to its staff and provide evidence to HUD that it is following the policy. Comment 5 Our report did not address Milestone’s actions for the past 20 years. As explained in the scope and methodology section of this report, our review generally covered the period October 2005 through September 2008. We also reviewed a management review of Milestone that HUD had conducted in 2002. However, we did not review or reach conclusions on Milestone’s operations beyond the indicated timeframes. 28
Milestone Management Systems Inc.'s Management Controls for Managing Multifamily Properties Were Not Adequate
Published by the Department of Housing and Urban Development, Office of Inspector General on 2009-08-05.
Below is a raw (and likely hideous) rendition of the original report. (PDF)