Most board members know their HOA needs "some kind of financial report" every year, but few understand the difference between the three levels — or why the distinction matters. A compilation, a review, and an audit are not interchangeable. Each involves a fundamentally different scope of CPA work, produces a different level of assurance, and costs a different amount. Choosing the wrong one — or sticking with the minimum when circumstances demand more — has led to multi-million-dollar fraud going undetected for years in Florida communities.
This guide explains what a CPA actually does at each level, what Florida Statute 720.303(7) requires based on your association's revenue, when to upgrade beyond the minimum, and what real Florida fraud cases reveal about the limits of each approach. For a primer on reading the financial statements these reports produce, see our guide on how to read an HOA balance sheet.
The three levels of financial reporting
The AICPA defines three distinct engagement types for CPA-prepared financial statements. Each provides a different level of assurance — meaning a different degree of confidence that the numbers are accurate:
Compilation — No Assurance ($500 - $2,000)
- The CPA takes management's financial data and organizes it into properly formatted financial statements
- No verification, no testing, no independent confirmation of any kind
- The CPA does not express any opinion or provide any assurance on the accuracy of the numbers
- The CPA is required to read the statements for obvious errors or departures from accounting standards, but is not required to investigate
- Best analogy: a professional typesetter who formats your manuscript but does not fact-check it
Review — Limited Assurance ($1,500 - $5,000)
- The CPA performs analytical procedures — comparing current-year figures to prior years, budgets, and industry benchmarks
- The CPA interviews management and asks questions about accounting policies, unusual transactions, and significant changes
- Provides "limited assurance" — the CPA states that "nothing came to our attention" suggesting material misstatement
- Does NOT independently verify balances with banks, vendors, or owners
- Best analogy: a doctor who asks about your symptoms and takes your temperature, but does not order blood work
Audit — Reasonable Assurance ($3,000 - $10,000+)
- Everything from compilation and review, plus extensive independent testing
- CPA sends confirmation letters directly to banks to verify account balances
- CPA contacts vendors and third parties to confirm amounts owed
- CPA selects a sample of transactions and traces them to invoices, contracts, and board approvals
- CPA evaluates the design and effectiveness of internal controls (segregation of duties, authorization procedures, bank reconciliation processes)
- CPA assesses the risk of fraud and designs procedures to address that risk
- Issues a formal opinion letter stating whether the financial statements comply with GAAP and are free of material misstatement
- Must report any significant deficiencies or material weaknesses in internal controls to the board in writing
- Best analogy: a doctor who asks about symptoms, runs blood work, orders imaging, and writes a diagnosis — not just a wellness check
A review relies on management's representations. The CPA asks the treasurer and management company questions and analyzes the numbers they provide — but does not independently verify those numbers with outside parties. An audit goes directly to the source: the bank, the vendor, the insurance company. If someone inside the association is manipulating the books, a review is unlikely to catch it because the CPA is relying on the very people who control the data.
Florida's reporting tiers under 720.303(7)
Florida Statute 720.303(7) sets minimum financial reporting requirements based on total annual revenue (assessments plus all other income). The statute does not prevent an association from choosing a higher level — it only sets the floor:
| Annual Revenue | Minimum Required Report | CPA Required? |
|---|---|---|
| Under $150,000 | Report of cash receipts & expenditures | No — can be prepared by an officer or bookkeeper |
| $150,000 – $299,999 | Compiled financial statements | Yes — licensed CPA formats the statements |
| $300,000 – $499,999 | Reviewed financial statements | Yes — CPA provides limited assurance |
| $500,000+ | Audited financial statements | Yes — CPA provides reasonable assurance with opinion |
HB 1203 (effective July 2024) added a new trigger: any HOA with 1,000 or more parcels must have audited financial statements regardless of revenue. This closed a loophole where large communities with low per-unit assessments could avoid independent audits despite managing millions in assets. For the full list of HB 1203 changes, see our guide to new Florida HOA laws.
Members can vote to accept a lower reporting level at a properly noticed meeting, but not in consecutive fiscal years. And 20% of parcel owners can always petition for a higher level — useful when homeowners suspect financial mismanagement and the board is resisting scrutiny. For more on member rights to financial records, see our guide on Florida HOA document request rights.
What each report includes
Beyond the level of assurance, each engagement type produces different deliverables. Understanding what you get — and don't get — helps boards evaluate whether the minimum is sufficient for their community:
| Component | Compilation | Review | Audit |
|---|---|---|---|
| Balance sheet | Yes | Yes | Yes |
| Income statement (revenues & expenses) | Yes | Yes | Yes |
| Statement of cash flows | Sometimes | Yes | Yes |
| Notes to financial statements | Optional | Yes | Yes |
| Reserve fund disclosures | Optional | Yes | Yes |
| Analytical procedures (trend analysis) | No | Yes | Yes |
| Management inquiry / representation letter | No | Yes | Yes |
| Independent bank confirmations | No | No | Yes |
| Third-party vendor confirmations | No | No | Yes |
| Transaction testing (sample-based) | No | No | Yes |
| Internal controls evaluation | No | No | Yes |
| Fraud risk assessment | No | No | Yes |
| Formal opinion letter | No | No | Yes |
| Internal control deficiency report | No | No | Yes (if found) |
For a deeper look at how to interpret the balance sheet and income statement these reports produce, see our guide on how to evaluate HOA financials.
Cost comparison by community size
Costs vary significantly based on community size, record organization, and whether the association has had prior engagements with the same CPA firm. First-time engagements always cost more because the CPA has no prior-year baseline. As HOA Tax's audit guide documents, the biggest cost driver is record disorganization — every hour a CPA spends hunting for missing documents is billed at $150 to $300:
| Community Size | Compilation | Review | Full Audit |
|---|---|---|---|
| Small (under 75 units) | $500 – $2,000 | $1,500 – $3,500 | $3,000 – $6,000 |
| Medium (75 – 250 units) | $1,000 – $3,000 | $2,500 – $5,000 | $5,000 – $10,000 |
| Large (250+ units) | $1,500 – $4,000 | $3,500 – $7,000 | $7,000 – $15,000+ |
Have the complete document package ready before fieldwork begins. Use our HOA audit preparation checklist to organize bank statements, reconciliations, vendor contracts, and board minutes in advance. Associations that provide organized, digitized records typically pay 20-30% less than those with boxes of unsorted paperwork. Multi-year engagements with the same CPA also reduce costs because the firm retains institutional knowledge from prior years.
A common mistake: boards choosing the cheapest CPA bid. Lower fees often mean less experienced staff, less time allocated to the engagement, and a higher risk of missing material issues. Get at least three proposals from firms with demonstrated HOA experience — the Florida Institute of CPAs directory can help. For more context on HOA financial oversight, see our guide on whether an HOA president can spend money unilaterally.
Try Mosaic alongside your current software. No Risk!
- Keep yourself compliant on every statute change
- Keep your board compliant across every workflow
- Keep your HOA compliant and your owners happy
When to upgrade beyond the minimum
Florida law sets a floor, not a ceiling. Many communities should voluntarily upgrade to a full audit even when the statute only requires a review or compilation. As Aprio's research on HOA fraud trends documents, the associations most vulnerable to financial loss are those that treat the statutory minimum as sufficient in all circumstances.
Here are 10 red flags that signal your community should upgrade to a full audit — even if the statute does not require one:
Governance red flags
- Significant board turnover — new board members inherit financial records they did not create and cannot verify without independent testing
- Suspected fraud or embezzlement — even vague suspicion demands the independent verification only an audit provides
- Management company change — the transition period is the highest-risk time for financial irregularities; an audit establishes a clean baseline
- Board member conflicts of interest — related-party transactions with vendors controlled by board members require independent scrutiny
- Owner complaints about financial transparency — an audit provides the credibility a review cannot
Financial red flags
- Five or more years since the last audit — even if a review is performed annually, the absence of independent verification for extended periods creates cumulative risk
- Weak segregation of duties — one person writing checks, reconciling accounts, and approving invoices means no internal check on accuracy
- Large reserve balances with limited oversight — reserve funds represent years of owner contributions and are a primary target for misuse
- Major construction or restoration projects — large capital expenditures create opportunities for overbilling, change-order fraud, and kickbacks
- Upcoming bank loan or refinancing — lenders typically require audited financial statements, and producing them retroactively is far more expensive
A full audit costs $3,000 to $10,000 more than a review. But a single year of undetected embezzlement averages $35,000 to $50,000 in community associations, according to FS Residential's fraud research. The audit is not an expense — it is insurance. A community that skips audits for five years to save $25,000 is risking losses that can exceed $250,000.
Common audit findings in Florida HOAs
Even well-run associations receive audit findings. The question is whether those findings identify minor bookkeeping issues or reveal systemic weaknesses that expose the community to financial loss. According to published CPA analyses of HOA audits, these findings appear most often:
| Finding | What the CPA Discovered | Risk If Not Corrected |
|---|---|---|
| Commingled funds | Operating and reserve money held in a single bank account, or reserve funds used for operating expenses without board approval | Violation of F.S. 720.303(7); personal liability for board members; reserves unavailable when needed |
| Underfunded reserves | Reserve fund balance below 50-70% of the level recommended by the current reserve study | Special assessments to cover deferred maintenance; property value decline; potential SIRS compliance issues for condos |
| Unauthorized transactions | Expenditures exceeding the budget or management authority limits without board approval documented in minutes | Fiduciary breach; personal liability; grounds for member lawsuit or board member recall |
| Weak segregation of duties | One individual responsible for writing checks, reconciling bank statements, and approving invoices | Primary enabler of embezzlement — a single person controlling all financial functions can conceal theft indefinitely |
| Missing vendor documentation | Payments made without supporting invoices, contracts, or competitive bids on file | Cannot verify work was performed; overpayment; kickback risk |
| Bank reconciliation deficiencies | Monthly bank reconciliations not performed, performed late, or not reviewed by an independent party | Unauthorized transactions go undetected; cash position unknown; audit cost increases |
Real Florida cases: what went wrong
The difference between a review and an audit is not theoretical. Real Florida communities have suffered catastrophic financial losses because they relied on lower-level reporting — or stopped financial oversight entirely. For more on how to report suspected fraud, see our guide on how to report HOA fraud in Florida.
Hammocks Community Association — $12 Million+ Fraud
The Hammocks, a 6,200-home community in Miami-Dade County, stopped conducting annual audits in 2018. Without independent financial oversight, management allegedly misappropriated over $12 million in association funds over multiple years. The fraud was eventually uncovered — not by a review or compilation, but by homeowner investigations and law enforcement. Had the community continued annual audits, the independent bank confirmations and transaction testing would have detected the diversion of funds years earlier. Under HB 1203's 1,000-parcel rule, a community this size now must have audited financial statements every year.
Stonebridge Place — $743,000 Caught by Bank, Not Audit
At Stonebridge Place in South Florida, a property manager was able to steal $743,000 from a small community's accounts. The fraud was not detected by the association's financial reporting — it was caught by a bank employee who noticed suspicious transaction patterns. This case illustrates a critical point: compilations and reviews rely on the records management provides. If the person preparing the records is the one committing the fraud, those engagement types are structurally incapable of catching it. Only an audit — with its independent bank confirmations — would have flagged the discrepancies.
Boynton Beach Townhome Association — $50,000 Treasurer Theft
A volunteer treasurer in a Boynton Beach townhome community embezzled approximately $50,000 by writing unauthorized checks to herself. The small association relied on compiled financial statements — the lowest CPA engagement level. Because a compilation provides no assurance and no independent verification, the CPA simply formatted the data the treasurer provided, never questioning whether the payments were legitimate. A full audit would have tested a sample of disbursements against board approvals and flagged the unauthorized payments.
- The association relied on the minimum reporting level or stopped financial oversight entirely
- One person had too much control over financial functions (weak segregation of duties)
- The fraud was detected by an outside party (bank, homeowner, law enforcement) — not by the association's financial reports
- The total loss exceeded what audits would have cost by 10x to 100x
These cases are not rare. Community Associations Institute research estimates that financial fraud affects thousands of community associations nationwide each year. The associations that avoid catastrophic losses are the ones that treat independent audits as essential, not optional.
Frequently asked questions
Share this guide
