An independent audit of the Mission Economic Development Agency, a 53-year-old affordable housing nonprofit with a portfolio of more than 1,300 housing units, alleges that a former employee made unauthorized IT purchases and faults the organization for financial safeguards that exposed it to the risk of misappropriated funds.
The report, dated Sept. 30, covered the nonprofit’s 2025 fiscal year. It provides the most detailed public account yet of the alleged misconduct cited by the San Francisco controller when it placed MEDA under the city’s highest level of financial scrutiny for nonprofits earlier this month.
That reporting has been consequential. City supervisors last week delayed an Oct. 21 committee vote on a proposed city financing agreement of up to $22.2 million. The proposal is scheduled to be heard on Wednesday.
MEDA said it has fixed most of the issues flagged by the city, including “all concerns” having to do with the city’s new level of oversight.
“There were concerns about internal controls,” Executive Director Luis Granados said in an Oct. 22 interview. “Those have been fully resolved.”
The city controller, for its part, said “MEDA has been proactive intaking steps to rectify the concerns that led to their current Tier 3 designation” and that its designation was meant to “motivate corrections,” and could be changed.
Still, the new findings add to a history of audit warnings stretching back years.
The nonprofit’s recent troubles follow MEDA’s April layoffs of 12 employees and salary cuts for remaining staff, amid other signs of fiscal strain. Granados took a voluntary 43 percent pay cut for one year. The cuts came six months after the city approved a $37.8 million refinancing package for 15 MEDA-owned housing sites.
According to the September audit, conducted by Aprio LLP as a regular part of its annual audit, MEDA leaders began reviewing expenditures after noticing rising costs for IT products and services. They discovered that a former employee had allegedly established unauthorized vendors and vendor invoices.
Auditors found that MEDA lacked adequate safeguards for approving new vendors, overseeing conflicts of interest and reviewing payments, making it difficult to detect the alleged misconduct.
“Segregation of duties and management oversight were insufficient to prevent or detect misconduct by an individual with authority over procurement-related activities,” auditors wrote.
The report classified the problems as a “material weakness” — a serious deficiency in internal financial controls. It said MEDA was exposed to the possibility of money being misappropriated through unauthorized payments and inflated prices for purchases.
“This was achieved through bypassing established internal controls,” the auditors wrote.
The city’s controller described the alleged misconduct in stronger terms. In an Oct. 19 letter, the office said its fiscal monitoring had identified “issues in which a MEDA employee made unauthorized expenses and engaged in self-dealing.”
The letter did not explain what constituted the alleged self-dealing. Neither document specified how much money was involved or when the alleged activity began. The audit stopped short of describing the activity as a crime.
According to the audit, MEDA told auditors it was reviewing the activity, that it had sought insurance coverage, that it had referred the matter to local officials and that it had brought in a temporary outside IT vendor. It also said it was tightening vendor verification and requiring conflict-of-interest disclosures.
In an emailed response to Mission Local, MEDA said its insurer paid out the amount covered by insurance. It did not disclose the size of the payment or the value of the unauthorized purchases.
It also said an independent auditor found that no unauthorized expenses were charged to public or private grants.
In an Oct. 22 interview, MEDA representatives, including Granados, declined to identify the employee.
In an emailed statement, MEDA spokesperson Juan Mesa wrote, “MEDA reported this matter to the appropriate authorities because we believe we are the victim of a crime. MEDA has taken numerous internal measures to help ensure this does not occur again.”
When asked in an Oct. 22 interview which authorities MEDA had notified, Will Reisman, the organization’s PR representative, responded, “The appropriate ones.”
He declined to say whether the organization had filed a police report.
History of audit warnings
Because MEDA receives substantial federal funding, it must undergo annual independent audits.
From 2021 through 2024, auditors repeatedly identified “material” weaknesses, finding that MEDA’s accounting procedures were insufficient to catch and correct errors before auditors reviewed them.
Despite those problems, MEDA received “unmodified” audit opinions, meaning auditors concluded they fairly represented the nonprofit’s finances after corrections were made.
MEDA attributed the problems to finance staff turnover and, in 2024, a transition to new systems. It said it had expanded its accounting staff and improved those systems.
Auditors subsequently noted the issues had been cleared, but the Sept. 30 audit then identified the alleged purchasing misconduct.
Asked whether the alleged employee misconduct should raise concerns about MEDA’s internal controls, Granados maintained that the organization’s safeguards had improved over time.
“Every year they have become stronger,” he said.
City presses for financial reforms
On Oct. 19, San Francisco Controller Greg Wagner notified MEDA of its “Tier 3” designation, the city’s highest-risk category for nonprofit contractors. He cited 10 unresolved issues.
The findings stemmed from fiscal monitoring involving four city departments that fund MEDA. The controller’s concerns included missing documentation for expenses billed to the city and questionable subcontractor payments, among others.
MEDA did not directly say whether the expenses and payments flagged by city monitors had been corrected.
It said it was working through the controller’s response process and that it would be “premature to comment further” while the review remained open.
In its Oct. 19 letter, the controller’s office warned that “the financial and organizational health of Mission Economic Development Agency may be at risk,” citing a potential need for oversight by the city.
Asked whether MEDA agreed with the city’s findings, Granados said he had focused on addressing the problems rather than disputing them.
“For us, it hasn’t been about disagreeing,” he said. “It has been more of an approach about problem solving and collaborating with the controller and with those agencies in resolving these issues.”
But the October letter was not the city’s first intervention.
Granados said his efforts to strengthen MEDA’s financial controls had begun months before the Tier 3 designation. In April, he developed a work plan that the controller’s office turned into a corrective action plan in May.
The plan, obtained by Mission Local, said gaps in MEDA’s invoicing prevented city monitors from confirming that the nonprofit had adequate safeguards against conflicts of interest and improper purchasing. The controller’s October letter reiterated those concerns.
“MEDA did not provide the required supporting documentation for invoiced expenses and there were a number of questionable expenses and related subcontractor payments,” the letter reads.
The plan called for 10 improvements, including better documentation of credit-card charges and petty-cash spending, more reliable employee time records and improved expense tracking. It also flagged issues with MEDA’s cash reserves and recommended stronger revenue forecasting. MEDA said that, as of Aug. 31, it had 12 months of runway.
The city’s plan also recommended “Executive Financial Leadership Coaching” and financial-controls training so staff and leadership can “quickly see and understand financial health to make better and faster decisions.”
During the Oct. 22 interview, Granados said the city arranged for coaching with the consulting firm BDO.
In a subsequent written response, MEDA said it had resolved seven of the concerns identified by the city in May and October, including “all concerns related to potential Tier 3 designation,” but did not specify which.
Granados disputed that MEDA had already been formally placed in Tier 3, describing the designation as proposed. The controller’s letter, however, states that the office “has designated MEDA to Tier 3,” while also providing an opportunity for reconsideration.
Granados said MEDA’s programs had continued operating without interruption.
“Our clients have not felt any of this,” he said.
