The Sept. 30 audit, covering MEDA’s 2025 fiscal year, identifies a “material weakness” in the organization’s internal controls. Auditors said the nonprofit lacked sufficient checks on new vendors, conflicts of interest and payments, allowing someone with procurement authority to bypass established procedures.

The audit does not state how much money was involved or when the alleged activity began. It also does not characterize the conduct as a crime. San Francisco’s controller, in an Oct. 19 letter, said city monitoring had found that a MEDA employee made unauthorized expenses and engaged in “self-dealing,” but the letter did not explain what that allegation involved.

MEDA told auditors it was reviewing the activity, had sought insurance coverage, referred the matter to local officials and hired a temporary outside IT vendor. The organization later said its insurer paid the covered amount, but it did not disclose the payment or the value of the purchases. MEDA also said an independent auditor found no unauthorized expenses charged to public or private grants.

“MEDA reported this matter to the appropriate authorities because we believe we are the victim of a crime,” spokesperson Juan Mesa said in a written statement. The organization declined to identify the former employee. A representative also declined to say whether MEDA had filed a police report.

The audit’s findings come as the city has placed MEDA in Tier 3, its highest-risk category for nonprofit contractors. Controller Greg Wagner’s Oct. 19 letter cited 10 unresolved concerns identified through monitoring by four city departments that fund the organization. Those included missing documentation for expenses billed to the city and questionable subcontractor payments.

The designation and audit have put a proposed city financing agreement of up to $22.2 million in the spotlight. Supervisors delayed a committee vote on the proposal, which is scheduled to be heard Wednesday. The city had approved a separate $37.8 million refinancing package for 15 MEDA-owned housing sites six months earlier.

MEDA Executive Director Luis Granados said in an Oct. 22 interview that the organization had resolved its internal-control concerns related to the city’s oversight. The controller’s office said MEDA had been proactive in addressing the problems and described Tier 3 status as a tool intended to prompt corrections that could lead to a change in designation.

MEDA said it had resolved seven concerns raised by the city, including all issues related to the potential Tier 3 designation, but did not specify which ones. Granados said the organization was focused on collaborating with the controller rather than disputing the findings. He said MEDA’s programs continued without interruption and that clients had not felt the effects of the financial scrutiny.

The audit adds to a record of warnings about MEDA’s accounting controls. Auditors identified material weaknesses from 2021 through 2024, citing procedures that were not sufficient to catch and correct errors before an audit. The organization attributed earlier problems to turnover among finance staff and a transition to new systems. Auditors later said those issues had been cleared, before the latest report raised concerns about purchasing controls.

MEDA, a 53-year-old nonprofit with more than 1,300 housing units, has also faced recent financial strain. It laid off 12 employees in April and reduced salaries for remaining staff; Granados took a voluntary 43% pay cut for one year. MEDA said it had 12 months of financial runway as of Aug. 31.

The audit was conducted by Aprio LLP as part of MEDA’s regular annual audit. Because the nonprofit receives substantial federal funding, it is required to undergo independent audits.