CPA Audit Portal

CommunityPay provides CPA firms with direct, read-only access to HOA financial data through a token-gated audit portal. No login is required. The CPA receives a secure link, clicks it, and navigates the same ledger data that governs day-to-day financial operations.

This page describes how the portal works, what the CPA can see, and how access is controlled.

Why a CPA Portal

The standard audit workflow for HOAs involves weeks of back-and-forth: the CPA requests a trial balance, the board emails a PDF, the CPA asks for the journal register, the board emails another PDF, the CPA needs AR aging, and so on. Each exchange introduces delay, version confusion, and the risk of stale data.

The CPA Audit Portal eliminates this cycle. The HOA grants time-limited access to the system of record. The CPA pulls what they need, when they need it, from the same ledger that produces enforcement decisions, integrity scans, and institutional packets. There is no secondary reporting layer.

Creating an Engagement

An HOA administrator creates an engagement from the Vault.

Steps

1. Navigate to Vault in the accounting navigation
2. Click the Audit Portal tab
3. Click Create Engagement (top-right)
4. Fill in the engagement details:

1. Click Create Engagement

The system generates a unique access token, emails the secure link to the CPA, and opens a confirmation page that shows the link. The raw token is shown once — on that page and in the invitation email — and never stored; only its SHA-256 hash is persisted. Reloading the confirmation page finds nothing to show. The confirmation also states whether the invitation email was accepted for delivery, so a board that sees it was not can copy the link and deliver it directly.

Token Security

The access token follows the same security pattern as CARI API keys:

If the token is lost, the engagement must be revoked and a new one created. There is no token recovery mechanism. This is deliberate — a recoverable token is a weaker token.

IP Allowlist

An engagement may carry an allowlist of IP addresses, entered on the creation form. When the list is set, every portal request from an address not on it is refused with "Access denied from this IP address" and the refusal is logged with the address that tried. The list holds exact addresses, not ranges. An empty list (the default) allows any address; the token remains the credential.

What the CPA Sees

The portal presents a read-only interface with a header bar showing the association's name, firm name, engagement type, period, and days remaining. A "Read-only access" banner is always visible.

The left sidebar provides navigation to 13 sections, and the integrity scan detail opens from the Integrity Scans section:

Portal Sections

Every section is scoped to the engagement's HOA and period window. The CPA cannot see data outside the granted time range.

The PBC Bundle

An audit begins with a list of what to have ready. The PBC Bundle is that list, in the auditor's own words, with what the books hold beside each line:

• The year's annual financial statement package
• The subledger schedules
• Every bank reconciliation with its outstanding items
• The cash receipts and cash disbursements registers
• The insurance schedule
• The governing documents
• The minutes for anything the board approved

Each line is present, withheld with a reason, or not applicable with a reason. There is no empty state: a schedule with nothing on it says the books hold nothing, and a schedule that could not be built says so. Every figure comes from the service that renders it on its own page, so the bundle cannot disagree with the page it points to.

The bundle carries a SHA-256 digest over its manifest, and a board officer's sign-off binds to that digest. When the books move, the digest moves, and the sign-off stops matching the page. The generation time is recorded and is not hashed.

CSV Exports

Six sections support CSV export, and the PBC Bundle exports its manifest as a text file. The CPA clicks the export link and receives a file named with the association's name and period end date. Every export is logged as a separate event with resource_type set to export_trial_balance, export_journal_register, export_pbc_bundle, and so on.

Export formats follow standard accounting conventions:

Scope Manifest

Engagements can be restricted to specific portal sections using the scope manifest. On the creation form every section is a checkbox, all checked by default; unchecking sections stores the remaining keys as a JSON list on the engagement record, in portal order. Overview, the portal landing page, is always included.

If every section is checked, the manifest is stored empty and all 14 sections are accessible. If populated, only the listed sections are permitted. A CPA attempting to open a restricted section sees a clear error message, and the attempt is logged.

Available section keys:

overview, trial_balance, fund_reconciliation, integrity, integrity_detail, journal_register, chart_of_accounts, artifacts, ar_aging, ap_aging, enforcement, close_packages, fund_statements, pbc_bundle

This allows an HOA to grant a tax preparer access to only the trial balance and journal register, while a full audit engagement gets all sections.

Engagement Types

The engagement type is informational — it appears in the portal header and event log but does not affect which sections are accessible. Scope restriction is controlled separately via the scope manifest.

Access Logging

Every portal interaction creates an immutable AuditEngagementEvent record. The model refuses updates to an existing event — the save() method rejects them via the _state.adding check — and the admin registers events read-only.

Each event records:

The HOA can see aggregated access data on the Vault engagement list: total access count, first accessed date, and last accessed date. The full event log — every section viewed, every export, every refusal, expiry, and revocation — opens from the engagement's Events link in the Vault. Platform staff can also read engagements and their event logs in the admin interface, where both are registered read-only: the admin cannot create, edit, or delete an engagement or an event.

Managing Engagements

The Vault's Audit Portal tab shows all engagements for the HOA with status badges:

Auto-Expiry

When a CPA accesses the portal after the expiration date, the system automatically transitions the engagement to EXPIRED status and logs an expiration event. No manual intervention is required.

Revocation

An HOA administrator can revoke an active engagement at any time from the Vault. Revocation is immediate — the CPA's next request will see an error message. The revocation is logged with the revoking user's identity.

Creating a New Engagement

If an engagement expires or is revoked and the CPA still needs access, create a new engagement. Each engagement has its own token, expiration, and event log. There is no mechanism to extend or reactivate an expired engagement. This is deliberate — each engagement is a discrete, auditable grant of access.

Data Mode

Engagements carry a data mode:

Every engagement created from the Vault is LIVE. The creation form does not offer SNAPSHOT. All queries are scoped by the engagement's period start and end dates, ensuring the CPA sees only data within the granted window while still reflecting the most current posted state of that data.

The association can also hand over the whole books as one zip with a manifest and a SHA-256 for every file. See Security & Trust.

This describes p