What a complete property management audit checklist covers
A property management audit checklist is a structured set of documents and procedural steps that state real estate commissions and internal reviewers use to verify trust account compliance, licensing, and fiduciary obligations. Get these five document categories ready before any auditor walks in the door.
Core document categories:
- Trust account bank statements: Complete statements for every month in the review period, showing all deposits, disbursements, and fee deductions traceable to ledger entries
- Three-way reconciliation reports: One per month, proving the trust account bank balance matches the owner sub-ledger totals and the accounting software register
- Per-owner ledgers: Individual records for each active owner showing rent collected, expenses paid, fees deducted, reserves held, and distributions made
- Security deposit records: A complete register by tenant and unit, with documentation of any amounts applied to damages or returned
- Signed management agreements: A current, executed agreement for every property under management during the review period
Beyond those five, a thorough audit also checks licensing and insurance currency, owner reporting timelines, fiduciary standards, and documentation of any corrections made to trust account entries. Annual audits typically cover 28 inspection points across those categories and take roughly 3–4 hours to complete.
Why property management audits matter more than most firms realize
State real estate commissions focus their audits almost entirely on trust account compliance, not marketing practices, not tenant relations, and not business performance. That narrow focus surprises a lot of operators who assume a clean operation means a clean audit. It does not.
Types of audits you may face:
- Regulatory (state commission) audits: Triggered by license renewal, random selection, or a complaint; focus on trust accounting and licensing
- Internal audits: Self-assessments run by the principal broker or compliance officer to catch problems before regulators do
- External operational audits: Third-party assessments of workflows, staffing, tools, and financial operations
- NARPM CRMC designation audits: Structured reviews against the Certified Residential Management Company standards, covering everything from office organization to vendor insurance verification
Proactive regulatory audits outnumber complaint-based ones in several states. California's Department of Real Estate closed 274 proactive versus 166 investigative audits in a single fiscal year. That ratio means any firm managing trust funds is eligible for a random audit at any time, regardless of its complaint history.
Who carries audit responsibility:
- Principal broker: Owns the license, owns the liability, signs off on the audit response
- Compliance officer or regional director: Organizes documentation, runs pre-audit self-checks
- Bookkeeper or accountant: Produces reconciliation reports and ledgers on request
- Property managers: Maintain signed agreements and owner communication records for their portfolios
The consequences of a failed audit range from a correctable finding to license suspension, depending on whether the issue is a procedural gap or a systemic violation. A firm with correct balances but missing reconciliation documentation still fails on the procedural count.
Which reports and records you need to have ready
Organizing documentation before an audit notice arrives is the single most effective thing you can do. Auditors request records covering 12–24 months, so your accounting must be accurate and retrievable for at least two years, not just the current month.
Required documents and their audit purpose:
| Document | What it must show | Why auditors request it |
|---|---|---|
| Trust account bank statements | All deposits, disbursements, fees traceable to ledger entries | Verifies no unexplained transfers or undocumented adjustments |
| Three-way reconciliation reports | Bank balance = owner ledger totals = software register, every month | A missing reconciliation is treated as a failure for that month |
| Per-owner ledgers | Rent collected, expenses, fees, reserves, distributions by month | Confirms owner statements match the accounting system exactly |
| Security deposit register | Every deposit by tenant, unit, date received, and current status | Verifies deposits are held in trust, not the operating account |
| Signed management agreements | Executed agreement for every active property in the review period | Confirms fees charged match authorized rates in the agreement |
| Correction documentation | Written explanation of what was wrong, what was corrected, and when | Unexplained round-number adjustments are the first red flag auditors flag |
Per-owner ledger specifics to check:
- Rent collected broken down by property and unit
- Expenses paid with category labels matching the management agreement
- Management fees and other deductions labeled consistently
- Reserves held with a clear balance
- Distributions paid with dates
One detail that trips up otherwise clean books: if your owner statements are generated from a different source than your core accounting system, those two records must agree exactly. Rounding differences or unexplained variances between them are a finding.
Pro Tip: Pull a sample three-way reconciliation for the oldest month in your likely review period right now. If you cannot produce it in under five minutes, your retrieval process needs work before an auditor asks for it.
Security audit checklist every property manager should run
Physical and digital security controls show up in both regulatory audits and NARPM CRMC designation reviews. Gaps here create liability that goes beyond a compliance finding.
Physical security controls:
- Controlled access to office areas where owner files and trust account records are stored
- Secure key storage system for all managed properties, with a log of who accessed which key and when
- Surveillance coverage of entry points and key storage areas
- Locked filing systems for paper management agreements and owner records
- Visitor sign-in procedures for anyone accessing the office outside of normal business hours
Digital and IT security controls:
- Regular, documented data backups for accounting software and property management platforms
- Role-based access controls so staff see only the records relevant to their function
- Password policies and multi-factor authentication on systems holding trust account data
- Software update and patch schedules documented in writing
- Incident response procedure for unauthorized access or data loss
Trust fund security specifically:
Security deposits must be held in a trust account, completely separate from operating funds. Commingling, even briefly, is a violation independent of whether the balance is correct. The NARPM CRMC checklist also requires a current employee dishonesty or fidelity bond to protect owner trust funds from internal theft.
Common security vulnerabilities auditors find:
- Keys stored without a sign-out log
- Shared login credentials for accounting software
- No documented backup verification (backups exist but are never tested)
- Security deposit funds sitting in the operating account at month-end
- Former employees retaining system access after separation
How often to audit and what to do before, during, and after
Annual audits are the standard for property management compliance reviews, with the principal broker or compliance officer running the review. Waiting for a regulatory notice to trigger your first self-check is the wrong approach.
Pre-audit preparation steps:
- Pull all trust account bank statements for the past 24 months and verify each one is complete
- Confirm a three-way reconciliation exists for every month in that window
- Run a management agreement audit: list every active property, then pull the signed agreement for each one
- Check the security deposit register against the trust account balance
- Verify all licenses and insurance certificates are current, including errors and omissions coverage at adequate limits
- Document any corrections made to trust account entries, with written explanations
During the audit:
- Organize documents by month and category before the auditor arrives
- Provide exactly what is requested, nothing more
- Do not amend or correct records after receiving an audit notice. Any correction made post-notice draws additional scrutiny and may appear as an attempt to conceal the original error
- If you identify a problem while pulling documents, consult a real estate attorney before responding
Post-audit follow-up:
- Address every finding in writing with a corrective action and a timeline
- Update internal procedures to prevent recurrence
- Schedule a follow-up self-check 90 days after remediation to confirm the fix held
- File the completed audit with the principal broker per your state's requirements
A proactive audit culture, where the team runs internal checks quarterly rather than scrambling annually, catches most problems while they are still correctable findings rather than violations.
Advanced operational audit insights and red flags to watch for
Regulatory audits check whether your paperwork is in order. Operational audits go deeper, examining whether your operation actually runs the way you think it does. The two are different exercises, and the findings from each rarely overlap.
A professional operational audit examines seven interconnected areas: knowledge and documentation, software and tools, communication infrastructure, staffing and roles, workflows and processes, financial operations, and resident experience. The value of looking at all seven together is that you start to see root causes underneath the symptoms. A slow unit turnover rate is rarely just a scheduling problem. It usually traces back to a knowledge gap, a workflow bottleneck, or a vendor coordination failure that nobody has mapped.
Common audit failures and what they signal:
- Missing management agreements: The most preventable failure, and the most common. Firms typically discover unsigned or missing agreements only when an auditor requests them. A missing agreement for any active property is a standalone violation in most states, regardless of whether the accounting was correct
- Missing three-way reconciliation for any month: Treated as a failure for that period, not a gap to explain. The documentation requirement carries the same weight as the accounting accuracy itself
- Security deposits in the operating account: A trust account violation, not just a deficiency. Procedural failures like commingling are treated more seriously than balance shortfalls because they indicate a broken control environment
- Undocumented round-number transfers: Unexplained adjustments and round-number entries without supporting documentation are the first things auditors flag for deeper review
- Owner statements that do not match the accounting system: Any variance between what the owner received and what the ledger shows requires a written explanation
Operational red flags that surface in deeper reviews:
- Staff who cannot answer basic questions about property specs or procedures without calling someone else
- Vendor contacts stored in personal phones rather than a shared system
- Maintenance workflows that depend on one person's memory to move forward
- No documented property standards, so every tech makes their own call on paint colors, filter sizes, and fixture specs
Pro Tip: When a symptom keeps recurring, such as units not being ready on time or vendors missing scope, trace it back one level. The root cause is almost always a documentation or coordination gap, not a personnel problem. Fix the system, and the symptom usually disappears.
The goal of an operational audit is a prioritized fix plan, not a report that sits on a shelf. The best assessments pay for themselves by identifying the first improvement that recoups the cost of the engagement. For auditing property management companies at the operational level, that first fix is often something as concrete as centralizing vendor contacts or documenting property specs in a shared location.
How TurnTrack supports audit readiness for unit turns
TurnTrack does not replace your property management system or your accounting software. What it does is create the documentation that those systems miss: the unit-level activity record that shows exactly what happened during a turn, who did it, and when.
Every turn in TurnTrack carries a shared timeline from Move-Out through Tech Start, Cleaners, Carpet, Inspection, and Make-Ready, with a live status of Ready, On Track, At Risk, or Overdue. The activity feed logs updates at each stage, and optional photos can be attached to inspection items where the property requires documentation, such as smoke detector replacements with the date written. That record exists as a byproduct of the work, not as an extra documentation step.
The Property Standards Library keeps property-specific specs in one place: the exact Sherwin-Williams paint code, the HVAC filter size, the faucet model, the preferred vendor. A tech in the field gets the answer from the spec sheet in the app without needing a TurnTrack account. Vendor contacts live inside the turn itself, so there is no digging through a phone or a separate list when you need to call the carpet crew.
For service managers running 5–15 active turns at once, that shared record is also an audit trail for the make-ready process. When a dispute arises over unit condition or a vendor's scope, the timeline and photos are already there.
TurnTrack is $14.99/month for the workspace, covers your invited team, and is available on iOS with a free trial at turntrack.online.
Key Takeaways
A complete property management audit requires five core document categories, continuous reconciliation documentation, and a proactive internal review culture to avoid findings before regulators ask.
| Point | Details |
|---|---|
| Five required document categories | Trust account statements, three-way reconciliations, per-owner ledgers, security deposit records, and signed management agreements are all mandatory. |
| Missing reconciliation equals failure | A missing three-way reconciliation for any month is treated as a failure for that period, not an explainable gap. |
| Management agreements are the top failure | Missing or unsigned agreements are the most common and preventable audit finding across property management firms. |
| Proactive audits outnumber complaints | Regulatory bodies conduct random audits on a rolling basis, so audit-ready documentation must be maintained continuously. |
| Operational audits reveal root causes | A seven-area operational review traces symptoms like slow turns back to documentation, workflow, or coordination failures. |