Risk Management and Compliance
What the domain tests
Risk Management and Compliance tests whether the supervisor builds controls across the portfolio: safety, fair housing, accessibility, environmental hazards, insurance and contracts, incident reporting, emergency readiness, fraud prevention, and records. The supervisor sets the system and verifies it; site staff execute it.
Core rules and concepts
- Identify risk by category: life-safety, habitability, liability, regulatory, financial, data, and reputational. Assign likelihood, severity, owner, and control.
- Fair housing requires consistent application of screening criteria, nondiscriminatory advertising, reasonable accommodation handling, and no retaliation. Protected classes under federal law include race, color, religion, sex, national origin, familial status, and disability; state and local law may add more.
- Vendors must carry current insurance and required endorsements; verify limits, additional insured status, workers’ compensation, and expiration before work begins.
- Maintain incident reports, inspection logs, key control, segregation of duties, and retention schedules; document corrective actions.
- Emergency plans need contact trees, evacuation, habitability response, and testing, not just a binder.
Worked example
A vendor’s certificate of insurance expired ten days ago, and the vendor is scheduled to repair a stairwell. The supervisor pauses non-emergency work, requests a current certificate showing the required general liability and workers’ compensation coverage and additional insured endorsement, and documents approval. If a stairwell collapse creates an emergency, the supervisor may use emergency procurement to secure the area and an approved contractor, but still obtains insurance verification and incident documentation promptly. Letting the vendor work on an expired certificate transfers uninsured liability to the owner.
Traps
Treating compliance as the community manager’s sole job; inconsistent exceptions; no documentation of accommodation requests; accepting a certificate without checking dates or endorsements; and writing policies that cannot be audited.