Property management internal controls: Who should access what

Key Takeaways

• The single person who can initiate a payment, approve it, and reconcile the account against the bank statement is the most common structural enabler of PM fraud, and it is also the most common structure at solo and small PM operations, not because anyone intends wrongdoing but because there is nobody else to do it.

• Internal controls should scale with team size, not with intent to prevent fraud specifically. A one-person operation needs compensating controls (external review). A two-to-four person team can begin true segregation of duties. A five-or-more person operation should formalize dual authorization and rotating review.

• Three controls cost nothing to implement regardless of size: a monthly bank statement review by someone other than the day-to-day bookkeeper, a documented vendor onboarding checklist, and an annual review of who has access to what, conducted on a fixed calendar date rather than reactively.

• Software access controls matter as much as process controls. A PM platform that gives every staff member full administrative access, regardless of role, has effectively no internal control structure no matter what the written policy says.

• The goal of internal controls is not to signal distrust of staff. It is to protect everyone, including honest employees, from being in a position where they alone are responsible for funds that belong to someone else, with no independent check on their work.

The person managing the trust account, approving vendor payments, and reconciling the bank statement at most small PM companies is the same person, doing all three jobs because the company is not large enough to separate them. This is not a red flag about that person's character. It is a structural gap that internal controls exist to address, and the right control looks different depending on whether the PM company has one employee or fifteen.

Numetix takes an expert-led, AI-powered, and human-in-the-loop approach to internal controls, building the review structure that fits each client's actual team size rather than applying a template designed for a much larger operation. This guide covers what controls make sense at each stage of growth.

Quick Answer: What internal controls should a property management company have?

• Every PM company, regardless of size, should have monthly bank statement review by someone other than the person initiating payments, a documented vendor onboarding process, and an annual review of who has system access to what.

• The specific structure changes with team size: a solo operator relies on external review by the owner or an outside accountant; a small team can segregate approval from execution; a larger team should implement dual authorization above a defined dollar threshold and rotate who performs the reconciliation review.

• Software access should mirror the process control, not undercut it. If the internal policy says one person approves and another reconciles, but both have full administrative access to make any change in the PM software, the control exists on paper only.

What internal controls actually mean in property management

Internal controls are the structural checks that ensure no single person has unchecked ability to move money, approve their own work, or hide an error or a deliberate act from review. In a fiduciary business like property management, where the funds being managed belong to owners and tenants rather than the company itself, internal controls are not a best practice layered on top of good operations. They are close to a legal requirement, since most state real estate commissions expect PM companies to demonstrate that trust funds are protected by more than good intentions.

The one-person operation: compensating controls when you're the only one

True segregation of duties is not possible when one person handles every financial function. The compensating control is external review: someone outside the daily operation, ideally the business owner if they are not also the bookkeeper, or an outside accountant if the owner is, reviews the actual bank statement directly every month. This review should include the raw bank statement, not just a summary report generated by the same person whose work is being reviewed. Specific controls for this scale: bank statement review by an external party on a fixed monthly date, a trust balance spot-check against the sub-ledger total on a separate date from the main reconciliation, a documented vendor onboarding process even when there is no one else to enforce it against, and an annual management agreement review to confirm fee structures match what is actually being charged.

The 2-to-4-person team: where segregation of duties becomes possible

At this scale, true segregation becomes achievable for the first time: one person can initiate payments while a different person approves them, and a third person (or the owner, if not involved in daily transactions) performs the reconciliation. The specific assignment matters less than the principle that no single person completes the full cycle alone. An authorization matrix, even an informal one, should specify who can do what: who can add a new vendor, who can approve a payment above a set dollar threshold, and who has reconciliation access versus payment access. The PM bookkeeping myths guide covers the trust accounting misconceptions that often coexist with weak segregation of duties at this team size.

The 5+ person operation: where formal controls become necessary

Once a PM company reaches five or more staff involved in financial operations, informal segregation is no longer sufficient on its own. Dual authorization for trust disbursements above a defined threshold (commonly set between $500 and $2,500 depending on portfolio size) ensures no single approval moves significant funds. Reconciliation review should rotate periodically, since a person who reconciles the same accounts every month for years can develop blind spots even without any wrongdoing involved. A quarterly internal financial review with the PM company owner, separate from the monthly reconciliation, catches patterns that a single month's view will not reveal.

The three controls every PM company can implement this week regardless of size

Three controls require no additional headcount and no software purchase. First, a monthly bank statement review by someone other than the primary bookkeeper, even if that person is the owner reviewing it personally for twenty minutes. Second, a documented vendor onboarding checklist (W-9 collected, business verified, invoice matched to a work order) applied consistently, with no exceptions for "quick" or "emergency" vendor additions. Third, an annual access review, scheduled on a fixed calendar date, confirming that every person with system access still needs the level of access they have, and removing access immediately when someone leaves the company rather than at the next convenient moment.

Frequently asked questions

Should a property manager's bookkeeper be able to sign checks?

In a properly controlled structure, the bookkeeper who prepares and enters payments should not also have unilateral check-signing authority, particularly for trust account disbursements. Some PM companies use dual-signature requirements on trust account checks above a threshold, requiring the owner or a second authorized person to co-sign. Where check signing cannot be separated due to team size, the compensating control is the same as elsewhere: independent review of the cleared checks against the ledger by someone who did not write them.

How does a PM company audit its own trust account without outside help?

A basic self-audit compares three things independently: the trust bank account balance per the bank statement, the sum of all individual owner and tenant sub-ledger balances, and the PM company's internal trust ledger total. All three should match exactly. Beyond this monthly three-way check, a periodic deeper self-audit should sample a set of transactions (perhaps 10 to 15 per quarter) and trace each one back to a supporting document: a lease, a work order, an invoice, or a signed management agreement. Any transaction that cannot be traced to supporting documentation is a finding that needs resolution before the next audit cycle.

What's the minimum control structure required before hiring a first employee?

Before hiring the first employee who will touch trust funds, the owner should have already established a documented vendor onboarding process, a monthly reconciliation routine, and a clear written policy on payment approval thresholds, even if the owner is currently the only person executing all of it. Bringing structure in before the first hire means the new employee is trained into an existing control environment rather than the control environment being built reactively around whatever habits develop after they start. It also gives the owner a documented baseline to compare against if anything looks different after the hire.

For property management firms that want an internal control structure sized correctly for their current team, with independent reconciliation review built into the monthly close regardless of headcount, our accounting services provide that independent layer, expert-led, AI-powered, and human-in-the-loop.

See the complete guide to property management accounting for the full trust accounting and internal controls framework.