Issue Date
August 5, 2009
Audit Report Number
2009-KC-1009
TO: Brenda L. Waters, Acting Hub Director, Kansas City Multifamily Hub, 7AHMA
//signed//
FROM: Ronald J. Hosking, Regional Inspector General for Audit, 7AGA
SUBJECT: Milestone Management Systems Inc.’s Management Controls for Managing
Multifamily Properties Were Not Adequate
HIGHLIGHTS
What We Audited and Why
We audited Milestone Management Services, Inc. (Milestone), of Topeka,
Kansas, in response to a request from the U.S. Department of Housing and Urban
Development’s (HUD) Office of Multifamily Housing in Kansas City, Kansas.
HUD was concerned that Milestone had not complied with cash management
requirements.
Our audit objective was to determine whether Milestone complied with HUD’s cash
management requirements for management agents.
What We Found
Milestone’s management controls were not adequate in three respects. Milestone
did not (1) adequately segregate duties of on-site staff or provide proper oversight
of these employees, (2) have a system for tracking significant rehabilitation and
related costs for individual units, or (3) practice proper budgetary controls. In
addition, Milestone did not provide its properties with adequate fidelity bond
coverage, and it overpaid itself management fees.
What We Recommend
We recommend that HUD ensure that Milestone/property owners implement an
adequate system of management controls and provide technical assistance and
guidance as needed. We also recommend that HUD require Milestone/property
owners to implement procedures to periodically assess the adequacy of fidelity bond
coverage and adjust the coverage for each property when needed. Further, we
recommend that HUD ensure that Milestone/property owners use a reliable process
to calculate and pay management fees and that Milestone immediately repays
overpaid management fees to the overcharged properties. Lastly, we recommend
that HUD take appropriate administrative actions against Milestone/property owners
if Milestone is unable or unwilling to comply with HUD requirements.
For each recommendation without a management decision, please respond and
provide status reports in accordance with HUD Handbook 2000.06, REV-3.
Please furnish us copies of any correspondence or directives issued because of the
audit.
Auditee’s Response
We provided the draft report to Milestone on June 10, 2009, and requested a
response by July 29, 2009. Milestone provided comments on July 28, 2009. It
generally agreed with our findings and recommendations.
The complete text of the auditee’s response, along with our evaluation of that
response, can be found in appendix B of this report.
2
TABLE OF CONTENTS
Background and Objective 4
Results of Audit
Finding 1: Milestone’s Management Controls Were Not Adequate 5
Finding 2: Milestone Did Not Provide Properties with Adequate Fidelity Bond
10
Coverage
Finding 3: Milestone Overpaid Itself Management Fees 12
Scope and Methodology 14
Internal Controls 15
Appendixes
A. Schedule of Questioned Costs 17
B. Auditee Comments and OIG’s Evaluation 18
3
BACKGROUND AND OBJECTIVE
Milestone Management Services Inc. (Milestone), is a property management company operating out
of Topeka, Kansas. Milestone was incorporated on February 6, 1989, and began managing U.S.
Department of Housing and Urban Development (HUD)-related multifamily properties in the same
year. During our audit period, Milestone managed seven multifamily properties located in Kansas,
Missouri, and Illinois. Five of the properties were housing cooperatives, and two were not.
Milestone managed HUD-insured and/or HUD-assisted properties governed by the following
sections of the National Housing Act, as amended:
• Section 213 – Mortgage Insurance for Cooperative Housing
• Section 221(d)(3) and (4) – Mortgage Insurance for Rental and Cooperative Housing
• Section 236 – Subsidized Mortgages/Interest Reduction Programs
Under these sections of the National Housing Act, property owners enter into regulatory agreements
with HUD. The regulatory agreements contain certain provisions, including but not limited to
establishing and maintaining property reserve accounts, collecting rents, and performing property
maintenance.
Property owners are ultimately responsible for ensuring that the properties are operated in
accordance with the regulatory agreement and applicable HUD handbooks. However, property
owners may contract with a management agent, such as Milestone, to carry out the day-to-day
management of the property. As the management agent, Milestone signs a HUD certification that it
agrees to comply with the property’s regulatory agreement as well as other HUD requirements.
Milestone and the property owners also enter into a management agreement between themselves,
which details the expectations and responsibilities of the management agent. One of Milestone’s
key responsibilities as the management agent is the oversight and supervision of personnel working
on site at the properties. These on-site employees, such as the office and maintenance personnel,
are employees of the property, not employees of Milestone.
Our audit objective was to determine whether Milestone complied with HUD’s cash management
requirements for management agents.
4
RESULTS OF AUDIT
Finding 1: Milestone’s Management Controls Were Not Adequate
Milestone’s management controls were not adequate. This deficiency occurred because
Milestone did not fully understand the importance of a strong system of management controls.
As a result, HUD and property owners could not be assured that Milestone’s efforts reasonably
protected its properties’ funds from fraud, waste, and abuse.
Milestone’s management controls were not adequate in three respects. Milestone did not (1)
adequately segregate duties of on-site staff or provide proper oversight of these employees, (2)
have a system for tracking significant rehabilitation and related costs for individual units, or (3)
practice proper budgetary controls.
No Segregation of Duties with
Limited Oversight of Property
Staff
Milestone did not provide for adequate segregation of duties for on-site staff, nor did
it provide acceptable oversight of these employees. HUD’s handbook governing
financial operations and accounting procedures for insured multifamily properties
contains detailed requirements for segregation of duties involving financial
transactions. Further, as the management agent, Milestone was responsible for
supervising on-site property employees to properly maintain and operate the
property.
Milestone allowed on-site property managers to control most cash income processes
without properly overseeing or validating their work. On-site managers collected
tenant rents, posted rent payments to tenant accounts maintained in a separate set of
books and records at the properties, and prepared and made bank deposits. Further,
Milestone’s accounting system was not integrated with the various properties it
managed, so it relied on bank deposit information and month-end rent collection
records prepared by the on-site property managers. Based on the information from
the managers, Milestone posted only total rents collected to its own set of accounting
records for each property but did not independently verify the validity of the
information. In addition, it made on-site property managers solely responsible for
following up with tenants regarding late or unpaid rent.
In December 2006, Milestone learned that one on-site manager had stolen tenant
rents for more than three years. The property’s bank had notified Milestone that the
manager had made suspicious financial transactions with money orders made out to
the property. Milestone conducted a financial review and confirmed the long-term
theft. Milestone had inappropriately allowed the employee to control all aspects of
5
the rent collection, deposits, recording, and late/unpaid rent follow-up process. The
employee was able to manipulate the tenant records and accounting information and
report false information to Milestone to hide the theft.
For another property, Milestone allowed an assistant maintenance supervisor to
approve and submit property invoices for rehabilitation and maintenance costs
without oversight. It paid the invoices without verifying the legitimacy of the
invoices or that the described work had been completed. Instead, it relied on the on-
site employee’s approval. Milestone told us that it believed that an invoice
containing the initials of the on-site manager or the assistant maintenance supervisor
was sufficient to validate a property expense. However, Milestone later learned
from other property employees, and subsequently confirmed, that the assistant
maintenance supervisor had submitted a number of false invoices. Milestone paid
the invoices because it did not recognize that the invoices were false. The scheme
occurred because neither Milestone nor the on-site property manager had provided
adequate oversight.
No Tracking System for Costs
of Substantial Rehabilitation
Work
Milestone did not have a system for tracking or following up on significant
rehabilitation work performed on individual units. According to the management
agreements between Milestone and the properties it managed, Milestone was to
maintain a comprehensive system of records, books, and accounts. It also signed
HUD certifications that it agreed to ensure that all expenses of the properties were
reasonable and necessary.
During the audit period, Milestone managed renovations of a number of units at its
largest property. Although the property had in excess of 500 units, Milestone could
not provide a detailed plan or schedule identifying what units were to be
rehabilitated, by when, or at what cost for each unit. In addition, Milestone did not
conduct adequate on-site verifications of completed rehabilitation work. It visited
the property but did not conduct detailed inspections of the units. Further, it did not
track renovation costs per unit. Therefore, it could not identify questionable costs
charged for a unit, such as duplicated or unnecessary costs, nor could it compare the
costs charged to the actual work completed to ensure that the costs were valid.
The lack of a tracking system allowed the assistant maintenance supervisor to submit
multiple invoices for payment for the same goods and services for the same unit.
Milestone then paid fraudulent invoices that contained identical items for the same
unit as many as five times. Milestone told us that the software system it used to
generate payments identified duplicate invoices based only on the invoice number
and the system did not have the ability to track or sort expenses by unit.
6
Lack of Budgetary Controls
Milestone did not practice proper budgetary controls. Management agreements
between Milestone and the properties required Milestone to prepare monthly
financial reports, including a comparison of monthly income and expenses to the
budget. Milestone generally provided monthly accounting and budget variance
reports to owners and board members and discussed the reports at board meetings.
However, it did not use the reports as a tool to help manage the properties,
particularly when income was noticeably less than expected or expenses were
significantly higher than expected.
In addition, Milestone did not always make required monthly deposits to properties’
general operating reserve accounts, and it exceeded withdrawal limits without
obtaining HUD’s approval. The purpose of the general operating reserve fund is to
provide a measure of financial stability and to meet unforeseen financial obligations
of the property. The properties’ regulatory agreements require the owner (or its
management agent) to make monthly deposits to the operating reserve account equal
to a certain percentage of rent collections for that month. In addition, property
owners and designated agents are not permitted to make withdrawals from the
general operating reserve in excess of a certain limit without HUD’s approval.
For one property, the independent auditor noted that Milestone did not make any of
the required deposits to the general operating reserve account for fiscal year 2007.
Milestone also exceeded withdrawal limits for this property without first obtaining
HUD’s approval. Milestone told us that it did not seek HUD’s approval when it
exceeded withdrawal limits because the property needed the funds immediately to
pay its monthly operating expenses. However, if Milestone had used proper
budgetary controls, it should have been able to plan for required HUD approvals.
For another property, in fiscal year 2008, Milestone did not make the required
monthly deposits but, instead, arbitrarily made deposits throughout the year to fulfill
the requirement. Prior HUD reviews for fiscal years ending 1999, 2000, and 2001
also revealed problems with Milestone’s not funding properties’ general operating
reserve accounts and making unauthorized withdrawals.
Importance of Management
Controls Not Fully Understood
Milestone did not understand that a strong system of management controls is
necessary to safeguard its properties’ assets and provide for accurate books and
records. Instead, it relied on limited site visits to ensure that its on-site employees
properly managed the properties.
7
Property Assets Susceptible to
Errors, Waste, and Fraud
HUD and property owners could not be assured that Milestone’s efforts reasonably
protected property funds or met budgetary control and financial stability
requirements. This problem is illustrated by the on-site employee thefts at two of
Milestone’s properties. Both thefts occurred over periods lasting at least three years.
Milestone estimated property losses at more than $300,000. In addition, its
independent auditor raised substantial doubt about one of the property’s ability to
continue as a going concern. The auditor was mainly concerned about high vacancy
rates but the employee theft of about $200,000 also contributed to the property
having difficulty meeting daily operations costs. That property continued to
experience severe cash flow problems and could place HUD at risk for the $11
million balance on its insured mortgage. If Milestone had practiced proper
management controls, it should have been able to either prevent the employee thefts
or detect and end them before the properties experienced significant losses.
Conclusion
Milestone’s management control efforts did not provide reasonable assurance that
property funds were protected from fraud, waste, and abuse. HUD and property
owners relied on the management agent to successfully manage properties and to
do so in accordance with HUD rules and regulations. However, Milestone did not
understand the importance of segregation of duties, sufficient management
oversight, tracking of property expenditures, and proper budgetary controls. If
Milestone had practiced proper management controls, it could have better
protected property assets.
Further, the above deficiencies along with those in findings 2 and 3 detailed later
in this report, describe significant and repeated breaches of commitments to HUD
and violations of HUD requirements. These deficiencies rise to a level to which
HUD needs to consider whether Milestone can immediately improve its
operations to fully comply with HUD requirements, or whether HUD should no
longer allow Milestone to manage HUD properties.
Recommendations
We recommend that the Director, Office of Multifamily Housing, Kansas City,
Kansas,
1A. Ensure that Milestone/property owners implement an adequate system of
management controls.
8
1B. Provide technical assistance and guidance to Milestone as needed.
1C. Take appropriate administrative actions against Milestone/property owners if
Milestone is unable or unwilling to comply with HUD requirements.
9
Finding 2: Milestone Did Not Provide Properties with Adequate
Fidelity Bond Coverage
Milestone did not provide the properties with adequate fidelity bond coverage. This deficiency
occurred because Milestone did not periodically assess whether fidelity bond coverage was
within acceptable limits. As a result, multifamily properties were placed at unnecessary risk of
loss.
Inadequate Fidelity Bond
Coverage for Two Properties
Milestone did not provide two properties with adequate fidelity bond coverage
during the audit period. A fidelity bond is an insurance policy that protects property
owners against financial loss resulting from dishonest acts of its employees. HUD
regulations and management certifications signed by Milestone require property
owners or their designated management agents to obtain a fidelity bond in the
amount at least equal to potential rent collections for two months.
One property had fidelity bond coverage of $100,000 in effect at the time of the
audit. However, the potential rent collections for two months were nearly $170,000.
We notified Milestone of this deficiency, and it increased the property’s fidelity
bond coverage to $200,000, effective retroactively to September 2008.
Another property did not have adequate coverage for 2007 and most of 2008. The
property’s rent revenue increased substantially in 2007, primarily due to an increase
in rents. However, Milestone did not increase the property’s fidelity bond coverage
to an adequate level until September 2008. As a result, the property was
underinsured by approximately $150,000 for the 21-month period.
Adequacy of Coverage Not
Periodically Assessed
Milestone did not periodically assess whether fidelity bond coverage was within
acceptable limits. The fidelity bond coverage requirement is based on a variable
(potential rent collections) that may change over time, and, therefore, the
acceptable amount of coverage may also change. Milestone and property owners
were jointly responsible for reasonably assessing coverage and ensuring that the
properties’ fidelity bond policies were sufficient.
Multifamily Properties Placed
at Unnecessary Risk of Loss
Two multifamily properties were unnecessarily vulnerable to risk of loss.
Milestone and property owners were responsible for safeguarding property assets
10
and mitigating potential losses. Maintaining adequate fidelity bond coverage to
cover employee dishonesty was a way to protect HUD and property owners from
losses, and Milestone and the owners should have taken the steps necessary to
secure proper coverage.
Recommendation
We recommend that the Director, Office of Multifamily Housing, Kansas City,
Kansas,
2A. Require Milestone/property owners to implement procedures to periodically
assess the adequacy of fidelity bond coverage and to adjust the coverage for
each property when needed.
11
Finding 3: Milestone Overpaid Itself Management Fees
Milestone overpaid itself management fees. This problem occurred because Milestone did not
have a reliable process for calculating and paying itself management fees, nor did it provide
supporting documentation to property owners. As a result, properties did not have access to all
of their operating funds.
Overpaid Management Fees
Milestone overpaid itself management fees. Its monthly compensation was
established by the management agreements between itself and the properties it
managed. The individual management agreements identified a certain percentage of
gross collections to be paid monthly to Milestone from the properties’ operating
account. Because Milestone was responsible for generating the payments for
properties’ expenses, it generated payments to itself for the management fees.
Milestone overpaid itself nearly $6,700 for one property (property A) for the fiscal
year ending September 30, 2008, and owed the property more $600 from prior
periods as of the end of our audit. HUD agreed and instructed Milestone to repay
more than $7,000 to the property in March 2009.
Milestone had a history of overpaying itself management fees. The properties’
independent auditor identified such overpayments as significant deficiencies for the
properties and periods indicated in the chart below.
Management
Property name Fiscal year ending fee
overpayment
Property A September 30, 2006 $1,128
Property B December 31, 2007 $2,643
Property C June 30, 2008 $3,186
Milestone repaid the amounts indicated in the chart above. However, HUD
recently determined that Milestone overpaid itself an additional $3,800 for
property B for the same period identified in the chart. HUD instructed Milestone
to repay this amount to the property in March 2009.
Milestone recently notified HUD that it disagreed with the amounts identified as
overpaid and not yet repaid for properties A and B. As of this report, HUD was
evaluating Milestone’s disagreement with the amounts.
12
Unreliable Process for
Calculating Management Fees
Milestone did not have a reliable process for calculating and paying itself
management fees. It also had not provided supporting documentation to owners.
For most properties, Milestone made two payments to itself from the properties’
accounts each month. Contrary to the management agreement, the first payment
was generally a flat fee paid at the beginning of the month, and the second
payment was made during the middle of the month. Milestone told us that it
based the second payment on estimated collections. It had not provided
supporting documentation to most property owners to show how it had calculated
the payments.
Properties without Access to All
Funds
The properties did not have access to all of their operating funds. In addition, the
overpaid management fees essentially resulted in improper loans from the
properties to Milestone. Further, property owners could not readily assess
whether the management fees paid to Milestone complied with the management
agreements.
Recommendations
We recommend that the Director, Office of Multifamily Housing, Kansas City,
Kansas,
3A. Ensure that Milestone/property owners use a reliable process to calculate
and pay itself/themselves management fees. This process should include
procedures through which Milestone would base its fees only on actual
gross collections and provide detailed invoices showing monthly
management fee calculations to property owners.
3B. Ensure that Milestone immediately repays $7,359 to property A and
$3,866 to property B, and any additional overpaid management fees to the
respective overcharged properties, unless Milestone provides adequate
evidence that it had not overpaid itself.
13
SCOPE AND METHODOLOGY
Our review generally covered the period October 2005 through September 2008. We conducted
our audit work from November 2008 to March 2009 at Milestone’s office at 4900 Fairlawn
Road, Topeka, Kansas.
To achieve our objective, we conducted interviews of Milestone management and staff. We also
interviewed HUD staff in the Kansas City, Kansas, Office of Multifamily Housing. We
evaluated a management review of Milestone that HUD conducted in 2002. We also reviewed
management reviews HUD conducted in 2008 for two properties that Milestone managed.
We reviewed the property regulatory agreements, management certifications, management
agreements, and applicable HUD handbooks and regulations. We also reviewed Milestone’s
policies and procedures. In addition, we reviewed the records of a sample of properties based on
property information provided by HUD and those properties with a larger number of housing
units. We tested cash receipts and/or expenditures on the following properties:
• Pin Oak Acres Apartments, Inc.
• Parade Park Homes, Inc.
• Fox Ridge Cooperative Townhouses, Inc.
To test cash receipts and expenditures, we reviewed property budgets, bank statements, check
registers, payroll journals, cash receipt journals, rent rolls, invoices, and general ledgers. We
also reviewed audited financial statements for four properties that Milestone managed:
• Pin Oak Acres Apartments, Inc. – fiscal year ending September 30, 2006
• Prairie Glen East Cooperative, Inc. – fiscal year ending December 31, 2007
• Parade Park Homes, Inc. – fiscal year ending December 31, 2007
• Fox Ridge Cooperative Townhouses, Inc. – fiscal year ending June 30, 2008
We reviewed the fidelity bond policies for six properties, including the four identified above as
well as Wheatview Apartments and North Park Tower Cooperative. In addition, we reviewed
Milestone’s analysis of employee thefts that occurred at two of the properties.
We reviewed reports generated by Milestone’s computerized accounting system (CYMA
Accounting Software). We used the computerized data for background and informational
purposes only; therefore, we performed no tests of the data.
We conducted the audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective. We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objective.
14
INTERNAL CONTROLS
Internal control is an integral component of an organization’s management that provides
reasonable assurance that the following controls are achieved:
• Program operations,
• Relevance and reliability of information,
• Compliance with applicable laws and regulations, and
• Safeguarding of assets and resources.
Internal controls relate to management’s plans, methods, and procedures used to meet its
mission, goals, and objectives. They include the processes and procedures for planning,
organizing, directing, and controlling program operations as well as the systems for measuring,
reporting, and monitoring program performance.
Relevant Internal Controls
We determined that the following internal controls were relevant to our audit
objective: Milestone’s management controls for
• Evaluating the validity of property expenses.
• Ensuring receipt and proper recording of property receivables.
• Calculating and paying management fees.
• Complying with applicable laws, regulations, and agreements.
• Preparing and evaluating property operating budgets and variance reports.
We assessed the relevant controls identified above.
A significant weakness exists if management controls do not provide reasonable
assurance that the process for planning, organizing, directing, and controlling
program operations will meet the organization’s objectives.
Significant Weaknesses
Based on our review, we believe that the following items are significant weaknesses:
• Milestone did not provide for segregation of duties or provide acceptable
oversight of on-site property employees (finding 1).
• Milestone did not have a system for tracking or following up on
significant rehabilitation and related costs for individual units (finding 1).
• Milestone did not practice proper budgetary controls for its properties
(finding 1).
15
• Milestone did not periodically assess whether fidelity bond coverage was
within acceptable limits (finding 2).
• Milestone did not have a reliable process for calculating and paying itself
management fees (finding 3).
16
APPENDIXES
Appendix A
SCHEDULE OF QUESTIONED COSTS
Recommendation Ineligible
number 1/
3B $7,359
1/ Ineligible costs are costs charged to a HUD-financed or HUD-insured program or activity
that the auditor believes are not allowable by law; contract; or federal, state, or local
policies or regulations.
Although recommendation 3B also includes a recommendation for Milestone to repay
$3,866 in ineligible costs to the applicable property, HUD identified this amount
independent of our audit. Therefore, we did not include this amount as a questioned cost.
17
Appendix B
AUDITEE COMMENTS AND OIG’S EVALUATION
Ref to OIG Evaluation Auditee Comments
Comment 1
18
Ref to OIG Evaluation Auditee Comments
Comment 2
Comment 3
Comment 4
19
Ref to OIG Evaluation Auditee Comments
Comment 5
20
Ref to OIG Evaluation Auditee Comments
21
Ref to OIG Evaluation Auditee Comments
22
Ref to OIG Evaluation Auditee Comments
23
Ref to OIG Evaluation Auditee Comments
24
Ref to OIG Evaluation Auditee Comments
25
Ref to OIG Evaluation Auditee Comments
26
Ref to OIG Evaluation Auditee Comments
27
OIG Evaluation of Auditee Comments
Comment 1 As noted in the report, HUD asked that we review Milestone because HUD was
concerned that Milestone had not complied with cash management requirements.
HUD also told us of Milestone’s past noncompliance with HUD requirements and
of the two instances of property employees involved with stolen rents and false
invoices. HUD’s experience with Milestone led it to request that our office
conduct a review of Milestone’s cash management practices and controls.
Comment 2 Milestone’s written response to the report did not contain the referenced April 21,
2009, memorandum; however, Milestone provided the memorandum to us during
the audit. The memorandum discussed Milestone’s policy to not allow the
employee that collected and recorded rents, and prepared and recorded bank
deposits, to also take the cash deposit to the bank. We do not believe that this
procedure sufficiently addressed our segregation of duties concern identified in
finding 1. The memorandum continued to allow the same employee access and
responsibility for collecting rents, recording rents received, and preparing and
recording each bank deposit. Allowing one employee to perform these duties is
not adequate segregation of duties because it could allow an employee to
manipulate the records and misappropriate property income. Milestone needs to
adequately address this issue and present evidence of acceptable improvements to
HUD.
Comment 3 Although the June 15, 2009, memorandum had merit, it was addressed to on-site
property managers and maintenance supervisors. It did not address how
Milestone staff would use the information to prevent duplicate invoice payments
or other misappropriation of property assets. Milestone needs to provide more
detailed information to HUD regarding how Milestone staff will use the
information to protect property assets.
Comment 4 The July 2008, memorandum was an appropriate notice to Milestone staff;
however, during our audit we identified two instances in which Milestone did not
follow the written procedure after the memorandum date. As explained in finding
3, staff did not follow the policy for one property in August and September 2008,
which was immediately following the memorandum date. Milestone needs to
reiterate the policy to its staff and provide evidence to HUD that it is following
the policy.
Comment 5 Our report did not address Milestone’s actions for the past 20 years. As explained
in the scope and methodology section of this report, our review generally covered
the period October 2005 through September 2008. We also reviewed a
management review of Milestone that HUD had conducted in 2002. However, we
did not review or reach conclusions on Milestone’s operations beyond the
indicated timeframes.
28
Milestone Management Systems Inc.'s Management Controls for Managing Multifamily Properties Were Not Adequate
Published by the Department of Housing and Urban Development, Office of Inspector General on 2009-08-05.
Below is a raw (and likely hideous) rendition of the original report. (PDF)