Community associations run on turnover. Board members serve a term or two and rotate off, management contracts change hands, and the volunteers who signed up for the bank portal, the accounting software, and the resident records move on to other things. What almost never rotates with them is their access. The treasurer who left three years ago can still log into the association's bank account. The former property manager still has the accounting credentials. The board president from two administrations ago still receives copies of the financial statements at a personal email address nobody remembers adding.
The Numbers Behind the Exposure
The Foundation for Community Association Research counts roughly 373,000 community associations in the United States, collecting $124.2 billion in annual assessments and holding $31.1 billion in reserve funds, governed by more than 2.5 million volunteer board and committee members. Every one of those associations has bank accounts, records, and software, and every one of those volunteers eventually leaves.
A Beyond Identity survey found that 83% of former employees admitted they retained access to accounts from a previous employer, and volunteer boards run looser than employers: there's no HR department, no offboarding checklist, and often no written record of who was ever given access to what.
The Association of Certified Fraud Examiners' 2024 Report to the Nations put the median occupational fraud loss at $145,000, with small organizations, the category most associations and management firms fall into, losing a median of $141,000 per scheme. Duration is the multiplier: the median scheme runs 12 months before detection, and while fraud caught within six months costs a median of $30,000, schemes that run five years or more cost a median of $875,000. An association where nobody reviews who holds access is an association where a scheme can run for years.
Why Associations Are Built for This Problem
Authority rotates on election cycles, so institutional memory about who was granted what leaves with the person who granted it. The people holding access are volunteers, so nobody wants the awkward conversation of cutting off a former board member who "might still help out." Between 30% and 40% of associations are self-managed, with no professional staff at all, and even managed communities split access between the board, the management company, and vendors in ways nobody documents.
Bank portal logins shared by email years ago. Accounting software with six active users for a five-member board. A gate system administered by a company whose contract ended in 2022. Resident records, with the Social Security numbers and bank details that dues collection requires, reachable by people with no current role in the community.
The problem is that the association can't say which ones, and fiduciary duty doesn't grade on intentions. Board members are legally obligated to safeguard association funds and records, and "we never removed anyone's access" is a difficult sentence in a deposition, an insurance claim, or a members' meeting after money is missing.
What Disciplined Access Looks Like
An access inventory: a written record of every system the association uses, bank, accounting, records, email, building systems, and every person who can reach each one. Individual accounts instead of shared logins, so access can be removed for one person without resetting it for everyone, and so activity traces to a name. A transition step tied to every board election and every management change: within days, departing members' access is removed, passwords they held are changed, and the inventory is updated. And a review on a schedule, at least annually, where the current board confirms that the access list matches the people who actually hold roles.
Multi-factor authentication on the bank portal and accounting system backs all of it, since a years-old shared password is exactly the kind that circulates. The ACFE's data shows the payoff of controls like these: the difference between a scheme caught in months and one discovered after years is, at the median, hundreds of thousands of dollars.
Where a Managed IT Partner Helps
A managed service provider can operate access management as an ongoing, proactive service that outlasts any particular board. The provider can build and maintain the access inventory, convert shared logins to individual accounts with multi-factor authentication, execute the access changes when a board seat or management contract turns over, and run the periodic reviews that keep the list honest. For the board, that turns a fiduciary obligation into a documented routine, and the documentation is itself protection: it shows members, auditors, and insurers that the association controls who can reach its money and records.
If your association can't produce a current list of everyone who can access its bank accounts, its records, and its systems, a Network Discovery might be in order. We'll identify what your association uses, who can actually reach it, and which access should have ended years ago.
Ready to take the next step? Contact the Connecting Point team today to discuss your organization's needs.
Fill out our Network Discovery Form to get started!
970.356.7224 | www.CPcolorado.com | sales@CPcolorado.com
Connecting Point is a trusted IT solutions provider based in Greeley, Colorado, helping businesses across Northern Colorado and beyond navigate technology decisions with confidence.
