Map the money movement
Document which entity receives rent, holds deposits, approves invoices, changes banking details, and releases contractor payments. Include property-specific trust or operating accounts and outside accounting access. A portfolio can change materially when a manager begins handling a new payment function, even if no new building is added.
Keep evidence of controls
Bring bank-signatory records, approval workflows, payment-change procedures, reconciliation reports, and a sample of a completed vendor-payment file. The goal is a factual operating record. It should show how staff verify a changed instruction and who can override or authorize a payment.
Ask about the exact crime terms
Compare employee theft, client-property or client-funds wording, funds-transfer fraud, social-engineering treatment, computer-fraud language, deductibles, sublimits, discovery provisions, and conditions. A fraudulent instruction and an unauthorized transfer may be treated differently by a form, so preserve the exact question and form reference.
Review after a control changes
Revisit the record when the accounting platform, bank approval process, staffing model, or vendor-payment workflow changes. The FTC describes business email compromise as a fraud risk; its guidance can inform internal controls but does not determine policy response. Policy wording, declarations, and endorsements control.
- Account ownership and signers
- Payment-change verification
- Client-funds and fraud wording
- Dated reconciliation and exception records