CommunityPay

Governance
Attestation

Formal assurance of board-level financial governance. Immutable artifacts. Quantified effectiveness. Institutional credibility for audit reliance and underwriting review.

Periodic attestations · Exception registers · Policy snapshots · Control effectiveness metrics.
System-generated evidence, not after-the-fact compilation.

G-ATT Reference Format
SHA-256 Content Integrity
Immutable Audit Trail
0–100 Effectiveness Score
Governance software must produce attestations, or it is incomplete. Notifications are not governance. Logs are not assurance. Institutions require formal, reviewable, immutable artifacts — not screenshots of dashboards or threads of email.

Governance attestations do not replace financial audits or legal opinions. They provide system-generated evidence of control operation, suitable for audit reliance, board fiduciary documentation, and institutional review.

01

What It Produces

Governance attestation generates formal artifacts that answer one question: "Did this association operate within its declared governance policies during this period?"

Governance Attestation (PDF)
Formal compliance report with a stable reference number (G-ATT-2026-001), SHA-256 content hash, qualified compliance statement, and the period policy snapshot. Suitable for board minutes and audit workpapers.
Exception Register
Normalized, immutable view of every policy deviation in the period: exclusions, escalations, overrides, SLA breaches, and compliance failures. Each entry carries a unique reference (EXC-2026-00123) and resolution status.
Control Effectiveness Metrics
Quantified answers to "are our controls working?" — response rates, SLA compliance, override patterns, coverage gaps, and a weighted overall score. Measurements, not logs.
02

How It Works

Every guard decision, escalation, and override is captured in real time. At period close, the attestation service compiles the evidence, freezes the policy snapshot, computes the content hash, and renders the PDF. Nothing is back-filled.

Policy Snapshots

  • Immutable capture of governance policy at attestation time
  • SHA-256 config hash on every snapshot
  • Historical attestations reference historical rules, not current
  • Policy changes create new snapshots automatically
  • Auditor-verifiable policy binding for each period

Continuous Generation

  • Monthly, quarterly, annual, or incident-driven periods
  • Not dependent on manual compilation
  • Statistics calculated from live system data
  • PDF generation with branded institutional formatting
  • Third-party shareable with access logging
Immutability guarantee. Once generated, attestations cannot be modified — the model rejects updates to all fields except share controls. Reference numbers, content hashes, and timestamps are permanent. This is what makes them suitable for institutional reliance.
03

Who Uses It

Boards
Formal documentation of governance effectiveness. Evidence that fiduciary duty is being met. Quarterly attestations for board packages.
CPAs & Auditors
System-generated evidence for controls testing. Policy snapshots showing rules at any point in time. Exception registers with resolution documentation.
Insurance Underwriters
Quantified governance metrics for risk assessment. Response rates and SLA compliance data. Trend visibility for renewal decisions.
Management Companies
Transition documentation with full governance history. Portable attestation records survive turnover — no institutional memory loss.
Escrow Officers
Disclosure-packet evidence of governance controls. Formal artifacts for due diligence files. Shareable proof with access logging and expiration.
Legal Counsel
Contemporaneous documentation for liability defense. Evidence that controls existed and were operating. Immutable records resistant to challenge.
04

What It Replaces

Before Attestation With Attestation
Manual exception logs in spreadsheets Automated exception register with reference numbers
Ad-hoc explanations when auditors ask Pre-generated attestation artifacts ready for review
Post-hoc scrambling to document controls Continuous evidence of control effectiveness
"We sent notifications" as governance claim Quantified response rates and SLA compliance
Email threads as audit trail Immutable decision records with policy binding
Institutional memory lost with board turnover Governance history preserved in system artifacts
05

Control Effectiveness Metrics

Every attestation includes quantified metrics that answer the board question: "Are our controls working? Do people respond when they fire?"

Escalation Metrics

  • Response rate — share of escalations acknowledged
  • Mean, median, and P95 time to acknowledge
  • SLA compliance rate
  • Chain escalation frequency
  • Resolution rate and resolution time

Override Metrics

  • Override rate — share of transactions using bypass
  • Top reasons distribution
  • Approver analysis by scope
  • Active override count
  • Trend direction (improving, stable, degrading)
Coverage Metrics
Notification coverage (share of exceptions with documented notification), escalation coverage, and resolution rate. Gaps are visible, not hidden.
Overall Score
Weighted effectiveness score (0–100) combining response, coverage, override, and health components — with the underlying detail preserved for drill-down.
Attention Items
System-identified issues requiring management attention: SLA breaches, pending escalations, elevated override rates, invariant violations.
06

Board Certification

System-generated evidence is one layer. Board sign-off is another. CommunityPay supports both: the attestation is generated automatically; board members certify the artifact through an immutable signature workflow that binds the signature to a specific content hash.

How Signatures Bind

  • Each signature records the content hash at signing time
  • Modification of the artifact invalidates the signature
  • Multi-signer orchestration tracks completion across the board
  • Restatement creates a new artifact and a new signing round
  • Signing forensics captured (timestamp, IP, user, method)

Where It Lives

  • Generated attestation lands in the Vault — Artifacts tab
  • Available as institutional packet type GCA
  • Shareable to CPAs and underwriters via revocable token
  • Surfaces in close packages alongside the CEP
  • Stays in the historical chain even after restatement
GCA — Governance Controls Attestation. Inside the institutional packet system, the formal artifact carries the gca packet type. It sits alongside the Close Evidence Pack, Resale Certificate, Reserve Funding Status Report, and other hashed deliverables — all generated by the same shared attestation infrastructure.
07

Third-Party Shareable Proof

Attestations are designed for external distribution. Share with CPAs, insurers, and escrow officers without requiring system access — and without losing the audit trail.

Shareable Tokens
Time-limited access links generated on demand. No recipient login required. Automatic expiration. Revocable by the issuing HOA.
Access Logging
Every view recorded with timestamp, accessor identity (or external accessor email), IP address, and access method. Complete external access trail for sensitive disclosure documents.
Integrity Verification
Recipients can recompute the SHA-256 content hash and compare it to the value printed on the artifact. Proof the document has not been modified since generation.
08

Artifact Reference

Field Specification
Attestation reference G-ATT-{year}-{seq:03d} — e.g. G-ATT-2026-001. Assigned at creation, unique per HOA-year.
Exception reference EXC-{year}-{seq:05d} — e.g. EXC-2026-00123. Unique per HOA-year.
Content hash SHA-256 of canonical JSON. Computed at creation. Printed on the PDF. Recomputable by recipients.
Policy snapshot hash SHA-256 of the governance policy in effect at attestation time. Frozen for the lifetime of the attestation.
Period types supported Periodic, annual, on-demand, incident-driven. Period start and end accept arbitrary dates.
Packet type Institutional packet identifier: gca (Governance Controls Attestation). Routes through the shared attestation infrastructure.
Mutable fields after issuance Share token, share expiration, shareable flag, and PDF file only. Every other field is frozen.

Software that produces alerts produces notifications.
Software that produces attestations produces assurance.

Governance attestation is not a feature. It is the formal expression of whether an association is governing itself properly — and the permanent record that survives every board transition.

Foundational reading. Continuous Governance Attestation for Community Associations — why governance requires attestations, not alerts.

Institutional-Grade Governance.
System-Generated Assurance.

Replace post-hoc explanations with formal governance evidence. The attestation capability auditors, insurers, and incoming boards expect.

Request a Walkthrough View Audit Trail
CommunityPay