oversight

Milestone Management Systems Inc.'s Management Controls for Managing Multifamily Properties Were Not Adequate

Published by the Department of Housing and Urban Development, Office of Inspector General on 2009-08-05.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                                                                 Issue Date
                                                                          August 5, 2009
                                                                 Audit Report Number
                                                                              2009-KC-1009




TO:        Brenda L. Waters, Acting Hub Director, Kansas City Multifamily Hub, 7AHMA


           //signed//
FROM:      Ronald J. Hosking, Regional Inspector General for Audit, 7AGA

SUBJECT: Milestone Management Systems Inc.’s Management Controls for Managing
           Multifamily Properties Were Not Adequate


                                   HIGHLIGHTS

 What We Audited and Why

            We audited Milestone Management Services, Inc. (Milestone), of Topeka,
            Kansas, in response to a request from the U.S. Department of Housing and Urban
            Development’s (HUD) Office of Multifamily Housing in Kansas City, Kansas.
            HUD was concerned that Milestone had not complied with cash management
            requirements.

            Our audit objective was to determine whether Milestone complied with HUD’s cash
            management requirements for management agents.

 What We Found
            Milestone’s management controls were not adequate in three respects. Milestone
            did not (1) adequately segregate duties of on-site staff or provide proper oversight
            of these employees, (2) have a system for tracking significant rehabilitation and
            related costs for individual units, or (3) practice proper budgetary controls. In
            addition, Milestone did not provide its properties with adequate fidelity bond
            coverage, and it overpaid itself management fees.
What We Recommend

           We recommend that HUD ensure that Milestone/property owners implement an
           adequate system of management controls and provide technical assistance and
           guidance as needed. We also recommend that HUD require Milestone/property
           owners to implement procedures to periodically assess the adequacy of fidelity bond
           coverage and adjust the coverage for each property when needed. Further, we
           recommend that HUD ensure that Milestone/property owners use a reliable process
           to calculate and pay management fees and that Milestone immediately repays
           overpaid management fees to the overcharged properties. Lastly, we recommend
           that HUD take appropriate administrative actions against Milestone/property owners
           if Milestone is unable or unwilling to comply with HUD requirements.

           For each recommendation without a management decision, please respond and
           provide status reports in accordance with HUD Handbook 2000.06, REV-3.
           Please furnish us copies of any correspondence or directives issued because of the
           audit.

Auditee’s Response


           We provided the draft report to Milestone on June 10, 2009, and requested a
           response by July 29, 2009. Milestone provided comments on July 28, 2009. It
           generally agreed with our findings and recommendations.

           The complete text of the auditee’s response, along with our evaluation of that
           response, can be found in appendix B of this report.




                                            2
                            TABLE OF CONTENTS

Background and Objective                                                            4

Results of Audit
      Finding 1: Milestone’s Management Controls Were Not Adequate                  5
      Finding 2: Milestone Did Not Provide Properties with Adequate Fidelity Bond
                                                                                    10
                  Coverage

      Finding 3: Milestone Overpaid Itself Management Fees                          12

Scope and Methodology                                                               14

Internal Controls                                                                   15

Appendixes
   A. Schedule of Questioned Costs                                                  17
   B. Auditee Comments and OIG’s Evaluation                                         18




                                            3
                      BACKGROUND AND OBJECTIVE

Milestone Management Services Inc. (Milestone), is a property management company operating out
of Topeka, Kansas. Milestone was incorporated on February 6, 1989, and began managing U.S.
Department of Housing and Urban Development (HUD)-related multifamily properties in the same
year. During our audit period, Milestone managed seven multifamily properties located in Kansas,
Missouri, and Illinois. Five of the properties were housing cooperatives, and two were not.

Milestone managed HUD-insured and/or HUD-assisted properties governed by the following
sections of the National Housing Act, as amended:

   •   Section 213 – Mortgage Insurance for Cooperative Housing
   •   Section 221(d)(3) and (4) – Mortgage Insurance for Rental and Cooperative Housing
   •   Section 236 – Subsidized Mortgages/Interest Reduction Programs

Under these sections of the National Housing Act, property owners enter into regulatory agreements
with HUD. The regulatory agreements contain certain provisions, including but not limited to
establishing and maintaining property reserve accounts, collecting rents, and performing property
maintenance.

Property owners are ultimately responsible for ensuring that the properties are operated in
accordance with the regulatory agreement and applicable HUD handbooks. However, property
owners may contract with a management agent, such as Milestone, to carry out the day-to-day
management of the property. As the management agent, Milestone signs a HUD certification that it
agrees to comply with the property’s regulatory agreement as well as other HUD requirements.

Milestone and the property owners also enter into a management agreement between themselves,
which details the expectations and responsibilities of the management agent. One of Milestone’s
key responsibilities as the management agent is the oversight and supervision of personnel working
on site at the properties. These on-site employees, such as the office and maintenance personnel,
are employees of the property, not employees of Milestone.

Our audit objective was to determine whether Milestone complied with HUD’s cash management
requirements for management agents.




                                                4
                                  RESULTS OF AUDIT

Finding 1: Milestone’s Management Controls Were Not Adequate
Milestone’s management controls were not adequate. This deficiency occurred because
Milestone did not fully understand the importance of a strong system of management controls.
As a result, HUD and property owners could not be assured that Milestone’s efforts reasonably
protected its properties’ funds from fraud, waste, and abuse.


Milestone’s management controls were not adequate in three respects. Milestone did not (1)
adequately segregate duties of on-site staff or provide proper oversight of these employees, (2)
have a system for tracking significant rehabilitation and related costs for individual units, or (3)
practice proper budgetary controls.

 No Segregation of Duties with
 Limited Oversight of Property
 Staff


               Milestone did not provide for adequate segregation of duties for on-site staff, nor did
               it provide acceptable oversight of these employees. HUD’s handbook governing
               financial operations and accounting procedures for insured multifamily properties
               contains detailed requirements for segregation of duties involving financial
               transactions. Further, as the management agent, Milestone was responsible for
               supervising on-site property employees to properly maintain and operate the
               property.

               Milestone allowed on-site property managers to control most cash income processes
               without properly overseeing or validating their work. On-site managers collected
               tenant rents, posted rent payments to tenant accounts maintained in a separate set of
               books and records at the properties, and prepared and made bank deposits. Further,
               Milestone’s accounting system was not integrated with the various properties it
               managed, so it relied on bank deposit information and month-end rent collection
               records prepared by the on-site property managers. Based on the information from
               the managers, Milestone posted only total rents collected to its own set of accounting
               records for each property but did not independently verify the validity of the
               information. In addition, it made on-site property managers solely responsible for
               following up with tenants regarding late or unpaid rent.

               In December 2006, Milestone learned that one on-site manager had stolen tenant
               rents for more than three years. The property’s bank had notified Milestone that the
               manager had made suspicious financial transactions with money orders made out to
               the property. Milestone conducted a financial review and confirmed the long-term
               theft. Milestone had inappropriately allowed the employee to control all aspects of


                                                  5
           the rent collection, deposits, recording, and late/unpaid rent follow-up process. The
           employee was able to manipulate the tenant records and accounting information and
           report false information to Milestone to hide the theft.

           For another property, Milestone allowed an assistant maintenance supervisor to
           approve and submit property invoices for rehabilitation and maintenance costs
           without oversight. It paid the invoices without verifying the legitimacy of the
           invoices or that the described work had been completed. Instead, it relied on the on-
           site employee’s approval. Milestone told us that it believed that an invoice
           containing the initials of the on-site manager or the assistant maintenance supervisor
           was sufficient to validate a property expense. However, Milestone later learned
           from other property employees, and subsequently confirmed, that the assistant
           maintenance supervisor had submitted a number of false invoices. Milestone paid
           the invoices because it did not recognize that the invoices were false. The scheme
           occurred because neither Milestone nor the on-site property manager had provided
           adequate oversight.

No Tracking System for Costs
of Substantial Rehabilitation
Work


           Milestone did not have a system for tracking or following up on significant
           rehabilitation work performed on individual units. According to the management
           agreements between Milestone and the properties it managed, Milestone was to
           maintain a comprehensive system of records, books, and accounts. It also signed
           HUD certifications that it agreed to ensure that all expenses of the properties were
           reasonable and necessary.

           During the audit period, Milestone managed renovations of a number of units at its
           largest property. Although the property had in excess of 500 units, Milestone could
           not provide a detailed plan or schedule identifying what units were to be
           rehabilitated, by when, or at what cost for each unit. In addition, Milestone did not
           conduct adequate on-site verifications of completed rehabilitation work. It visited
           the property but did not conduct detailed inspections of the units. Further, it did not
           track renovation costs per unit. Therefore, it could not identify questionable costs
           charged for a unit, such as duplicated or unnecessary costs, nor could it compare the
           costs charged to the actual work completed to ensure that the costs were valid.

           The lack of a tracking system allowed the assistant maintenance supervisor to submit
           multiple invoices for payment for the same goods and services for the same unit.
           Milestone then paid fraudulent invoices that contained identical items for the same
           unit as many as five times. Milestone told us that the software system it used to
           generate payments identified duplicate invoices based only on the invoice number
           and the system did not have the ability to track or sort expenses by unit.




                                              6
Lack of Budgetary Controls


           Milestone did not practice proper budgetary controls. Management agreements
           between Milestone and the properties required Milestone to prepare monthly
           financial reports, including a comparison of monthly income and expenses to the
           budget. Milestone generally provided monthly accounting and budget variance
           reports to owners and board members and discussed the reports at board meetings.
           However, it did not use the reports as a tool to help manage the properties,
           particularly when income was noticeably less than expected or expenses were
           significantly higher than expected.

           In addition, Milestone did not always make required monthly deposits to properties’
           general operating reserve accounts, and it exceeded withdrawal limits without
           obtaining HUD’s approval. The purpose of the general operating reserve fund is to
           provide a measure of financial stability and to meet unforeseen financial obligations
           of the property. The properties’ regulatory agreements require the owner (or its
           management agent) to make monthly deposits to the operating reserve account equal
           to a certain percentage of rent collections for that month. In addition, property
           owners and designated agents are not permitted to make withdrawals from the
           general operating reserve in excess of a certain limit without HUD’s approval.

           For one property, the independent auditor noted that Milestone did not make any of
           the required deposits to the general operating reserve account for fiscal year 2007.
           Milestone also exceeded withdrawal limits for this property without first obtaining
           HUD’s approval. Milestone told us that it did not seek HUD’s approval when it
           exceeded withdrawal limits because the property needed the funds immediately to
           pay its monthly operating expenses. However, if Milestone had used proper
           budgetary controls, it should have been able to plan for required HUD approvals.

           For another property, in fiscal year 2008, Milestone did not make the required
           monthly deposits but, instead, arbitrarily made deposits throughout the year to fulfill
           the requirement. Prior HUD reviews for fiscal years ending 1999, 2000, and 2001
           also revealed problems with Milestone’s not funding properties’ general operating
           reserve accounts and making unauthorized withdrawals.

Importance of Management
Controls Not Fully Understood

           Milestone did not understand that a strong system of management controls is
           necessary to safeguard its properties’ assets and provide for accurate books and
           records. Instead, it relied on limited site visits to ensure that its on-site employees
           properly managed the properties.




                                               7
Property Assets Susceptible to
Errors, Waste, and Fraud

             HUD and property owners could not be assured that Milestone’s efforts reasonably
             protected property funds or met budgetary control and financial stability
             requirements. This problem is illustrated by the on-site employee thefts at two of
             Milestone’s properties. Both thefts occurred over periods lasting at least three years.
             Milestone estimated property losses at more than $300,000. In addition, its
             independent auditor raised substantial doubt about one of the property’s ability to
             continue as a going concern. The auditor was mainly concerned about high vacancy
             rates but the employee theft of about $200,000 also contributed to the property
             having difficulty meeting daily operations costs. That property continued to
             experience severe cash flow problems and could place HUD at risk for the $11
             million balance on its insured mortgage. If Milestone had practiced proper
             management controls, it should have been able to either prevent the employee thefts
             or detect and end them before the properties experienced significant losses.

Conclusion


             Milestone’s management control efforts did not provide reasonable assurance that
             property funds were protected from fraud, waste, and abuse. HUD and property
             owners relied on the management agent to successfully manage properties and to
             do so in accordance with HUD rules and regulations. However, Milestone did not
             understand the importance of segregation of duties, sufficient management
             oversight, tracking of property expenditures, and proper budgetary controls. If
             Milestone had practiced proper management controls, it could have better
             protected property assets.

             Further, the above deficiencies along with those in findings 2 and 3 detailed later
             in this report, describe significant and repeated breaches of commitments to HUD
             and violations of HUD requirements. These deficiencies rise to a level to which
             HUD needs to consider whether Milestone can immediately improve its
             operations to fully comply with HUD requirements, or whether HUD should no
             longer allow Milestone to manage HUD properties.

Recommendations

             We recommend that the Director, Office of Multifamily Housing, Kansas City,
             Kansas,

             1A.    Ensure that Milestone/property owners implement an adequate system of
                    management controls.



                                                8
1B.   Provide technical assistance and guidance to Milestone as needed.

1C.   Take appropriate administrative actions against Milestone/property owners if
      Milestone is unable or unwilling to comply with HUD requirements.




                                9
Finding 2: Milestone Did Not Provide Properties with Adequate
           Fidelity Bond Coverage
Milestone did not provide the properties with adequate fidelity bond coverage. This deficiency
occurred because Milestone did not periodically assess whether fidelity bond coverage was
within acceptable limits. As a result, multifamily properties were placed at unnecessary risk of
loss.


 Inadequate Fidelity Bond
 Coverage for Two Properties

               Milestone did not provide two properties with adequate fidelity bond coverage
               during the audit period. A fidelity bond is an insurance policy that protects property
               owners against financial loss resulting from dishonest acts of its employees. HUD
               regulations and management certifications signed by Milestone require property
               owners or their designated management agents to obtain a fidelity bond in the
               amount at least equal to potential rent collections for two months.

               One property had fidelity bond coverage of $100,000 in effect at the time of the
               audit. However, the potential rent collections for two months were nearly $170,000.
               We notified Milestone of this deficiency, and it increased the property’s fidelity
               bond coverage to $200,000, effective retroactively to September 2008.

               Another property did not have adequate coverage for 2007 and most of 2008. The
               property’s rent revenue increased substantially in 2007, primarily due to an increase
               in rents. However, Milestone did not increase the property’s fidelity bond coverage
               to an adequate level until September 2008. As a result, the property was
               underinsured by approximately $150,000 for the 21-month period.

 Adequacy of Coverage Not
 Periodically Assessed

               Milestone did not periodically assess whether fidelity bond coverage was within
               acceptable limits. The fidelity bond coverage requirement is based on a variable
               (potential rent collections) that may change over time, and, therefore, the
               acceptable amount of coverage may also change. Milestone and property owners
               were jointly responsible for reasonably assessing coverage and ensuring that the
               properties’ fidelity bond policies were sufficient.

 Multifamily Properties Placed
 at Unnecessary Risk of Loss


               Two multifamily properties were unnecessarily vulnerable to risk of loss.
               Milestone and property owners were responsible for safeguarding property assets


                                                 10
          and mitigating potential losses. Maintaining adequate fidelity bond coverage to
          cover employee dishonesty was a way to protect HUD and property owners from
          losses, and Milestone and the owners should have taken the steps necessary to
          secure proper coverage.

Recommendation


          We recommend that the Director, Office of Multifamily Housing, Kansas City,
          Kansas,

          2A. Require Milestone/property owners to implement procedures to periodically
              assess the adequacy of fidelity bond coverage and to adjust the coverage for
              each property when needed.




                                         11
Finding 3: Milestone Overpaid Itself Management Fees
Milestone overpaid itself management fees. This problem occurred because Milestone did not
have a reliable process for calculating and paying itself management fees, nor did it provide
supporting documentation to property owners. As a result, properties did not have access to all
of their operating funds.



 Overpaid Management Fees

              Milestone overpaid itself management fees. Its monthly compensation was
              established by the management agreements between itself and the properties it
              managed. The individual management agreements identified a certain percentage of
              gross collections to be paid monthly to Milestone from the properties’ operating
              account. Because Milestone was responsible for generating the payments for
              properties’ expenses, it generated payments to itself for the management fees.

              Milestone overpaid itself nearly $6,700 for one property (property A) for the fiscal
              year ending September 30, 2008, and owed the property more $600 from prior
              periods as of the end of our audit. HUD agreed and instructed Milestone to repay
              more than $7,000 to the property in March 2009.

              Milestone had a history of overpaying itself management fees. The properties’
              independent auditor identified such overpayments as significant deficiencies for the
              properties and periods indicated in the chart below.

                                                                         Management 
                      Property name               Fiscal year ending         fee 
                                                                         overpayment 
                         Property A             September 30, 2006          $1,128 
                         Property B             December 31, 2007           $2,643 
                         Property C                June 30, 2008            $3,186 

              Milestone repaid the amounts indicated in the chart above. However, HUD
              recently determined that Milestone overpaid itself an additional $3,800 for
              property B for the same period identified in the chart. HUD instructed Milestone
              to repay this amount to the property in March 2009.

              Milestone recently notified HUD that it disagreed with the amounts identified as
              overpaid and not yet repaid for properties A and B. As of this report, HUD was
              evaluating Milestone’s disagreement with the amounts.




                                                12
Unreliable Process for
Calculating Management Fees

            Milestone did not have a reliable process for calculating and paying itself
            management fees. It also had not provided supporting documentation to owners.
            For most properties, Milestone made two payments to itself from the properties’
            accounts each month. Contrary to the management agreement, the first payment
            was generally a flat fee paid at the beginning of the month, and the second
            payment was made during the middle of the month. Milestone told us that it
            based the second payment on estimated collections. It had not provided
            supporting documentation to most property owners to show how it had calculated
            the payments.

Properties without Access to All
Funds

            The properties did not have access to all of their operating funds. In addition, the
            overpaid management fees essentially resulted in improper loans from the
            properties to Milestone. Further, property owners could not readily assess
            whether the management fees paid to Milestone complied with the management
            agreements.

Recommendations


            We recommend that the Director, Office of Multifamily Housing, Kansas City,
            Kansas,

            3A.    Ensure that Milestone/property owners use a reliable process to calculate
                   and pay itself/themselves management fees. This process should include
                   procedures through which Milestone would base its fees only on actual
                   gross collections and provide detailed invoices showing monthly
                   management fee calculations to property owners.

            3B.    Ensure that Milestone immediately repays $7,359 to property A and
                   $3,866 to property B, and any additional overpaid management fees to the
                   respective overcharged properties, unless Milestone provides adequate
                   evidence that it had not overpaid itself.




                                             13
                         SCOPE AND METHODOLOGY

Our review generally covered the period October 2005 through September 2008. We conducted
our audit work from November 2008 to March 2009 at Milestone’s office at 4900 Fairlawn
Road, Topeka, Kansas.

To achieve our objective, we conducted interviews of Milestone management and staff. We also
interviewed HUD staff in the Kansas City, Kansas, Office of Multifamily Housing. We
evaluated a management review of Milestone that HUD conducted in 2002. We also reviewed
management reviews HUD conducted in 2008 for two properties that Milestone managed.

We reviewed the property regulatory agreements, management certifications, management
agreements, and applicable HUD handbooks and regulations. We also reviewed Milestone’s
policies and procedures. In addition, we reviewed the records of a sample of properties based on
property information provided by HUD and those properties with a larger number of housing
units. We tested cash receipts and/or expenditures on the following properties:

   •    Pin Oak Acres Apartments, Inc.
   •    Parade Park Homes, Inc.
   •    Fox Ridge Cooperative Townhouses, Inc.

To test cash receipts and expenditures, we reviewed property budgets, bank statements, check
registers, payroll journals, cash receipt journals, rent rolls, invoices, and general ledgers. We
also reviewed audited financial statements for four properties that Milestone managed:

    •   Pin Oak Acres Apartments, Inc. – fiscal year ending September 30, 2006
    •   Prairie Glen East Cooperative, Inc. – fiscal year ending December 31, 2007
    •   Parade Park Homes, Inc. – fiscal year ending December 31, 2007
    •   Fox Ridge Cooperative Townhouses, Inc. – fiscal year ending June 30, 2008

We reviewed the fidelity bond policies for six properties, including the four identified above as
well as Wheatview Apartments and North Park Tower Cooperative. In addition, we reviewed
Milestone’s analysis of employee thefts that occurred at two of the properties.

We reviewed reports generated by Milestone’s computerized accounting system (CYMA
Accounting Software). We used the computerized data for background and informational
purposes only; therefore, we performed no tests of the data.

We conducted the audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective. We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objective.




                                                 14
                              INTERNAL CONTROLS

Internal control is an integral component of an organization’s management that provides
reasonable assurance that the following controls are achieved:

   •   Program operations,
   •   Relevance and reliability of information,
   •   Compliance with applicable laws and regulations, and
   •   Safeguarding of assets and resources.

Internal controls relate to management’s plans, methods, and procedures used to meet its
mission, goals, and objectives. They include the processes and procedures for planning,
organizing, directing, and controlling program operations as well as the systems for measuring,
reporting, and monitoring program performance.



 Relevant Internal Controls
              We determined that the following internal controls were relevant to our audit
              objective: Milestone’s management controls for

              •       Evaluating the validity of property expenses.
              •       Ensuring receipt and proper recording of property receivables.
              •       Calculating and paying management fees.
              •       Complying with applicable laws, regulations, and agreements.
              •       Preparing and evaluating property operating budgets and variance reports.

              We assessed the relevant controls identified above.

              A significant weakness exists if management controls do not provide reasonable
              assurance that the process for planning, organizing, directing, and controlling
              program operations will meet the organization’s objectives.

 Significant Weaknesses
              Based on our review, we believe that the following items are significant weaknesses:

              •       Milestone did not provide for segregation of duties or provide acceptable
                      oversight of on-site property employees (finding 1).
              •       Milestone did not have a system for tracking or following up on
                      significant rehabilitation and related costs for individual units (finding 1).
              •       Milestone did not practice proper budgetary controls for its properties
                      (finding 1).



                                                15
•   Milestone did not periodically assess whether fidelity bond coverage was
    within acceptable limits (finding 2).
•   Milestone did not have a reliable process for calculating and paying itself
    management fees (finding 3).




                             16
                                   APPENDIXES

Appendix A

                SCHEDULE OF QUESTIONED COSTS

                           Recommendation               Ineligible
                                  number                        1/
                                          3B               $7,359


1/   Ineligible costs are costs charged to a HUD-financed or HUD-insured program or activity
     that the auditor believes are not allowable by law; contract; or federal, state, or local
     policies or regulations.

     Although recommendation 3B also includes a recommendation for Milestone to repay
     $3,866 in ineligible costs to the applicable property, HUD identified this amount
     independent of our audit. Therefore, we did not include this amount as a questioned cost.




                                            17
Appendix B

        AUDITEE COMMENTS AND OIG’S EVALUATION

Ref to OIG Evaluation   Auditee Comments




Comment 1




                         18
Ref to OIG Evaluation   Auditee Comments




Comment 2




Comment 3




Comment 4




                         19
Ref to OIG Evaluation   Auditee Comments




Comment 5




                         20
Ref to OIG Evaluation   Auditee Comments




                         21
Ref to OIG Evaluation   Auditee Comments




                         22
Ref to OIG Evaluation   Auditee Comments




                         23
Ref to OIG Evaluation   Auditee Comments




                         24
Ref to OIG Evaluation   Auditee Comments




                         25
Ref to OIG Evaluation   Auditee Comments




                         26
Ref to OIG Evaluation   Auditee Comments




                         27
                         OIG Evaluation of Auditee Comments


Comment 1   As noted in the report, HUD asked that we review Milestone because HUD was
            concerned that Milestone had not complied with cash management requirements.
            HUD also told us of Milestone’s past noncompliance with HUD requirements and
            of the two instances of property employees involved with stolen rents and false
            invoices. HUD’s experience with Milestone led it to request that our office
            conduct a review of Milestone’s cash management practices and controls.

Comment 2   Milestone’s written response to the report did not contain the referenced April 21,
            2009, memorandum; however, Milestone provided the memorandum to us during
            the audit. The memorandum discussed Milestone’s policy to not allow the
            employee that collected and recorded rents, and prepared and recorded bank
            deposits, to also take the cash deposit to the bank. We do not believe that this
            procedure sufficiently addressed our segregation of duties concern identified in
            finding 1. The memorandum continued to allow the same employee access and
            responsibility for collecting rents, recording rents received, and preparing and
            recording each bank deposit. Allowing one employee to perform these duties is
            not adequate segregation of duties because it could allow an employee to
            manipulate the records and misappropriate property income. Milestone needs to
            adequately address this issue and present evidence of acceptable improvements to
            HUD.

Comment 3   Although the June 15, 2009, memorandum had merit, it was addressed to on-site
            property managers and maintenance supervisors. It did not address how
            Milestone staff would use the information to prevent duplicate invoice payments
            or other misappropriation of property assets. Milestone needs to provide more
            detailed information to HUD regarding how Milestone staff will use the
            information to protect property assets.

Comment 4   The July 2008, memorandum was an appropriate notice to Milestone staff;
            however, during our audit we identified two instances in which Milestone did not
            follow the written procedure after the memorandum date. As explained in finding
            3, staff did not follow the policy for one property in August and September 2008,
            which was immediately following the memorandum date. Milestone needs to
            reiterate the policy to its staff and provide evidence to HUD that it is following
            the policy.

Comment 5   Our report did not address Milestone’s actions for the past 20 years. As explained
            in the scope and methodology section of this report, our review generally covered
            the period October 2005 through September 2008. We also reviewed a
            management review of Milestone that HUD had conducted in 2002. However, we
            did not review or reach conclusions on Milestone’s operations beyond the
            indicated timeframes.




                                            28