HOA Embezzlement: How Small Boards Prevent It Without Accusing Anyone

Every small homeowners association (HOA) has a Carol. Ours did. She had the checkbook, the bank login, the QuickBooks file, and twenty years of goodwill. Nobody checked her work. Checking felt like an insult.

I am the treasurer of a 128-unit oceanfront condo in Florida. More than a million dollars moves through our accounts in a year. We are volunteers. The controls that protect that money cannot depend on trust, and saying that out loud is the hardest part of this job.

This guide covers the four-hats rule, five controls a three-person board can actually run, the conversation that gets them adopted without accusing anyone, and what to do when something looks wrong.

1. Takeaways: trust is a feeling, not a control. The board owes members both.
2. The median fraud loss runs near $145,000, and the typical scheme runs a year before detection.
3. The four-hats rule: approve, hold, record, watch. No one person wears more than two.
4. Read-only bank access for every director is the single cheapest control that exists.
5. Adopt controls as standing policy. Controls protect the honest treasurer most of all.

Why nice communities get robbed by nice people

The Association of Certified Fraud Examiners studies thousands of occupational fraud cases every two years. The pattern never changes. The median loss sits near $145,000. The typical scheme runs about twelve months before anyone notices. Small organizations lose the most, and they lose the most for one reason: they have the fewest controls.

Homeowners association embezzlement follows the same script. The person who takes the money is almost never a stranger. It is the long-serving volunteer everyone loves, handling everything alone, year after year. Opportunity does the damage. A person with sole control of the account, the ledger, and the statement can take a little, cover it, and take a little more.

Here is the reframe that changed how our board talks about this: controls are not about suspicion. A control is how an honest treasurer proves the money is all there. I want the two-signature rule. It protects me.

The four-hats rule

Auditors break money-handling into four jobs. Approving a payment. Holding the asset, meaning access to the bank. Recording the transaction in the ledger. Watching the results, meaning reviewing statements and reports.

In a company those are four departments. On a volunteer board they can be four neighbors in flip flops. The rule is simple: no single person wears more than two hats, and never the holding hat plus the recording hat together. The person who can move money must never be the only person keeping the books, and the person keeping the books must never be the only person reading the bank statement.

A three-person board can do this. President approves. Treasurer holds and records. Secretary watches, meaning the secretary opens the bank statement every month and compares it to the treasurer's report. That one assignment defeats most of the schemes in the fraud studies.

Five controls a small board can actually run

Skip the corporate audit manual. These five fit a volunteer board, cost almost nothing, and close the gaps that real cases exploit.

1. Read-only bank access for every director. Banks hand out view-only logins for free. Every board member gets one, for the operating account and the reserve account both. Statements can be altered after download. A live login cannot. This is the modern version of mailing a duplicate statement to a second director, and it is the single cheapest control that exists.

2. Two approvals above a threshold. Pick a number that fits your budget. We use $1,000. Any payment above it needs a second board member's sign-off, in writing, before it goes out. Reserve money gets two approvals at any amount. The person who prepares a payment never approves it alone.

3. No cash, ever. Every dollar in arrives by check or electronic payment straight to the association's account, the way we laid out in the dues collection guide. Cash has no trail. A no-cash policy costs one vote and removes an entire category of loss.

4. The five-minute monthly packet. Bank statements, the reconciliation, and a budget-versus-actual page, attached to the minutes every month. Our board spends five minutes on it. Owners who can read a budget report stop asking whether the money is safe. The packet answers before they ask.

5. Outside eyes on a schedule. A CPA review or audit on a fixed rotation, and a fidelity bond checked every renewal. Florida ties the requirement to revenue for condos. Do it on schedule, not when suspicion forces it. An audit adopted in calm times insults nobody.

Adopting controls without accusing Carol

The controls above fail at the same spot in most communities: the motion. Somebody proposes two signatures and the room hears an accusation. The treasurer who has served since 2009 pushes back. The board drops it to keep the peace.

Run the motion differently. Adopt the controls as standing policy, tied to the role and not the person. The script that worked for us: these rules protect whoever holds the checkbook, this year and every year after. A clean audit trail is how Carol proves she never touched a cent. The day a rumor starts at the pool, the packet and the read-only logins end it in one meeting.

Boards that split the work survive turnover too. Our self-managed board series covers the deeper version: any job only one person can do is a risk, financial or not.

Six red flags worth a closer look

None of these proves anything. Each one earns a question at the next meeting.

1. Bank statements stop arriving, arrive late, or arrive already opened.
2. One person insists on handling deposits, payments, and the books alone.
3. Reconciliations run months behind with a new excuse each meeting.
4. Payments to vendors nobody on the board can describe.
5. Round-number checks, voided checks, or reimbursements without receipts.
6. A budget that never varies. Real spending wobbles. Perfect numbers are drawn, not earned.

If you find something

Move deliberately. Do not confront anyone first, and do not vote the problem quiet to spare a friendship.

Preserve the records the moment suspicion turns serious: statements, the ledger, emails. Call the association's attorney before the suspect hears a word. Check the fidelity bond and the crime coverage on your policy stack. We walked that stack in the insurance guide. Most carriers require a police report before paying a claim, so the report is not optional and it is not personal. It is the claim.

Where software fits

Software cannot make anyone honest. It makes honesty visible. When the ledger, the invoices, the vendor file, and the meeting packet live in one portal, every director sees the same numbers with no gatekeeper. An activity log records who uploaded, who edited, and who approved, with timestamps nobody can rewrite. Online dues collection that lands straight in the association's own bank account is rolling out on our platform now, and it removes the riskiest step of all: money passing through a person's hands.

Sunlight is the control that scales. The rest is five policies and one honest conversation.

If this guide helped, the tools it describes live in SoShiny. It is the portal our own board runs on, $25 a month plus 33 cents a unit, every feature on every plan.