401(k) Fiduciary Checklist: Investments, Fees, and Notices

A 401(k) fiduciary checklist covers the recurring duties that keep a retirement plan in compliance with ERISA and shield the people running it from personal liability. If you exercise any control over a 401(k) plan’s management, assets, or administration, you are a fiduciary under federal law regardless of your title, and losses caused by a breach of that duty can come out of your own pocket. The items below are what a well-run plan handles on a predictable schedule.

Confirm Who Is Actually a Fiduciary

ERISA applies a functional test. You become a fiduciary by what you do, not by what your business card says. That covers anyone who exercises discretionary authority over plan management or assets, provides investment advice for compensation, or holds discretionary responsibility for plan administration.¹ In a typical small or midsize employer, that means the business owner, the members of the retirement committee, and any outside advisor who recommends or selects investments.

The core obligation is to run the plan solely in the interest of participants and their beneficiaries, for the exclusive purpose of providing retirement benefits and paying reasonable plan expenses. Fiduciaries who fall short can be held personally liable to restore any losses the plan suffers or to give back profits earned through misuse of plan assets.¹

Keep the Plan Documents Current

Written Plan Document and Summary Plan Description

The written plan document is the legal foundation. It sets out eligibility, contribution mechanics, vesting, and distribution options, and fiduciaries must administer the plan in accordance with it so long as it does not conflict with the law itself.² If a third-party provider drafted your document years ago, read it again and confirm it still describes how the plan actually operates.

The Summary Plan Description translates that document into language participants can understand. ERISA requires the plan administrator to furnish the SPD to every participant and beneficiary, describing rights, benefits, and responsibilities in plain terms.³ Update it whenever the plan is amended.

Investment Policy Statement

An Investment Policy Statement is not legally required, but it is one of the strongest tools a fiduciary can have. The IPS spells out how you select, monitor, and replace investment options: the criteria for evaluating fund performance, the benchmarks used for comparison, and the steps for removing a fund that consistently underperforms. When a DOL auditor or a plaintiff’s attorney asks why you chose a particular fund, the IPS is what answers.

Records

ERISA Section 107 requires you to keep records supporting your annual filings for at least six years after the filing date. That includes Form 5500 and all schedules, nondiscrimination test results, participant notices, financial reports, fidelity bond documentation, and any worksheets or receipts used to verify those filings.⁴ Store them somewhere secure and retrievable, whether physical or cloud-based.

Monitor Investments on a Documented Schedule

Selecting investments at the outset is only the start. The DOL expects fiduciaries to follow a formal review process at reasonable intervals, comparing each investment option against the criteria in the IPS: performance against appropriate benchmarks, competitiveness of expense ratios, any changes in fund management, and participant complaints.⁵ Most plan committees review quarterly. The law does not mandate a specific frequency.

The law also does not require you to pick the cheapest fund or the highest performer. It requires a prudent process. Document what you reviewed, what alternatives you considered, and why you kept or replaced each fund. That paper trail is your best defense if a participant sues alleging you offered underperforming or overpriced investments.

Know Which Type of Advisor You Have

If you hire an outside investment professional, the scope of their authority changes your own liability. ERISA distinguishes two categories:

A Section 3(21) advisor recommends investments but leaves the final decision to you. You share fiduciary responsibility as a co-fiduciary and still need to evaluate and approve each recommendation.
A Section 3(38) investment manager has full discretion to select and replace investments without your approval. This shifts more of the investment-selection liability to the manager, but you remain responsible for choosing and reviewing the manager.

Hiring a 3(38) manager does not let you walk away from oversight. Review the manager’s track record, fee structure, and investment changes at least once a year.

Evaluate Service Providers and Their Fees

Collect the 408(b)(2) Disclosure

Before hiring or renewing a recordkeeper, third-party administrator, or investment advisor, collect their 408(b)(2) fee disclosure. Covered service providers must give the plan fiduciary a written breakdown of all compensation they expect to receive, including direct fees paid from plan assets and indirect compensation from sources like mutual fund revenue-sharing arrangements.⁶ Indirect compensation often takes the form of 12b-1 fees or sub-transfer agency payments flowing from fund companies back to the recordkeeper.⁷

Benchmark Fees Against Comparable Plans

Disclosure tells you what your providers charge. Benchmarking tells you whether the amount is reasonable. Compare total plan costs against plans with similar asset levels and participant counts. There is no legal cap on fees, but every fee charged to the plan must be reasonable for the services provided.⁵ If benchmarking shows you are paying well above market, that alone does not prove a violation, but ignoring it probably does. Refresh the benchmarking whenever you sign or renew a service contract.

Deposit Employee Contributions on Time

Late deposits of employee salary deferrals are the single most common fiduciary violation the DOL encounters, and one of the easiest to prevent. Deposit participant contributions and loan repayments into the plan trust as soon as they can reasonably be separated from the employer’s general assets. The outer limit is the 15th business day of the month after the money was withheld, but treat that as a ceiling, not a target.⁸

Plans with fewer than 100 participants can rely on a seven-business-day safe harbor. Deposits made within seven business days of payroll are presumed timely.⁸ Larger plans typically deposit within one to three business days depending on their payroll systems. If you discover a late deposit, the DOL’s Voluntary Fiduciary Correction Program lets you self-correct certain delinquent contribution errors, including calculating and restoring lost earnings.

Run the Required Annual Tests

ADP and ACP Tests

The IRS requires most traditional 401(k) plans to pass annual nondiscrimination tests proving that highly compensated employees are not benefiting disproportionately. For 2026, a highly compensated employee is anyone who earned more than $160,000 in the prior year or owns more than 5% of the business.⁹

The Actual Deferral Percentage test compares average deferral rates for the highly compensated group against everyone else. The highly compensated group’s ADP passes if it does not exceed either 125% of the non-highly compensated group’s ADP, or the non-highly compensated group’s ADP plus 2 percentage points (capped at 200% of their ADP), whichever is greater. The Actual Contribution Percentage test applies the same math to employer matching and after-tax contributions.¹⁰ A failure calls for corrective distributions or additional employer contributions.

Top-Heavy Testing

A plan is top-heavy when more than 60% of its total assets belong to key employees. For 2026, key employees include officers earning more than $235,000, anyone owning more than 5% of the business, and owners of more than 1% with compensation above $150,000. If the plan is top-heavy, the employer generally must contribute at least 3% of compensation for all eligible non-key employees who worked through the last day of the plan year.

Safe Harbor Design

A safe harbor plan design bypasses most of this testing. By committing to a qualifying employer contribution, such as a 3% nonelective contribution or a dollar-for-dollar match on the first 3% of pay plus 50 cents on the next 2%, the plan automatically satisfies the ADP, ACP, and top-heavy tests. The trade-off: safe harbor contributions must be fully vested immediately. For plans where owners or highly compensated employees want to maximize their own deferrals without the risk of corrective distributions, that trade-off is often worth it.

Deliver the Required Participant Notices

Participant Fee Disclosure (404a-5)

For plans where participants direct their own investments, the plan administrator must provide fee and investment information at regular intervals. The 404a-5 disclosure lists each investment option along with its total annual operating expenses as a percentage and as a dollar amount per $1,000 invested, plus historical performance for one-, five-, and ten-year periods, updated at least quarterly.¹¹ Verify every fund name and ticker matches your investment platform before distributing.

QDIA Notice

When a participant does not make an investment election, contributions go into the plan’s qualified default investment alternative. The QDIA notice must be sent at least 30 days before the first investment in the default option and at least 30 days before the start of each subsequent plan year.¹² It must describe the default fund’s objective, explain that participants can redirect their money at any time, and disclose any fees specific to the QDIA.¹³

Summary Annual Report

After filing Form 5500, the plan administrator must automatically send each participant a Summary Annual Report. The SAR summarizes the plan’s financial condition, including total assets, contributions received, benefits paid, and administrative expenses, based on the most recent annual report filed with the DOL.¹⁴¹⁵

File Form 5500 and Maintain the Fidelity Bond

Form 5500

Every 401(k) plan with participants must file a Form 5500 annually through the DOL’s EFAST2 electronic filing system.¹⁶ The filing is due by the last day of the seventh month after the plan year ends: July 31 for calendar-year plans.¹⁷ Filing Form 5558 before that deadline grants an automatic extension. The plan administrator digitally signs the form, certifying that the information is complete and accurate.

Missing the deadline without an extension triggers penalties of up to $2,739 per day.¹⁸ If you are already late, the DOL’s Delinquent Filer Voluntary Compliance Program lets you file overdue returns at sharply reduced penalties. Small plans pay $10 per day capped at $750 per late filing; large plans face the same daily rate capped at $2,000 per filing.¹⁹

ERISA Fidelity Bond

Every person who handles plan funds must be covered by a fidelity bond protecting the plan against losses from fraud or dishonesty. The bond must equal at least 10% of the plan funds handled during the preceding year, with a floor of $1,000 and a ceiling of $500,000. Plans that hold employer securities have a higher ceiling of $1,000,000.²⁰ Update the bond amount annually to reflect current asset levels. Operating without a bond is itself a fiduciary violation and can trigger DOL enforcement action.

Protect Plan Data

A 401(k) plan holds sensitive personal and financial data on every participant, which makes it a target. The DOL has published cybersecurity guidance that applies to all ERISA-covered plans, and fiduciaries are expected to evaluate their service providers against it. Recommended best practices include:²¹

A documented cybersecurity program approved by senior leadership and reviewed at least annually.
Annual risk assessments identifying threats to plan-related systems and data.
An independent third-party audit of security controls each year.
Role-based access controls, quarterly review of privileges, and multi-factor authentication wherever possible.
Encryption of sensitive data both in transit and at rest.
Periodic cybersecurity awareness training for personnel who interact with plan systems.
A business resiliency program covering continuity, disaster recovery, and breach response.

When evaluating or renewing recordkeeper contracts, ask how the provider addresses each of these areas and keep the answers on file. A vendor that cannot clearly explain its security posture is a signal worth acting on.

Correct Errors Quickly

Mistakes happen, and the DOL offers a structured path to fix them before they turn into enforcement actions. The Voluntary Fiduciary Correction Program lets plan officials self-report and correct specific ERISA violations, including late deposits of participant contributions, improper plan loans, and incorrect asset valuations. Applicants calculate and restore any losses with interest and distribute supplemental benefits to affected participants.²²

As of early 2025, the DOL added a self-correction component that lets plan officials fix delinquent participant contributions and certain loan repayment failures without submitting a full VFCP application.²² Auditors and plaintiffs’ attorneys are far less sympathetic to errors that sat uncorrected for years than to errors caught and fixed promptly.

1
U.S. Department of Labor. Fiduciary Responsibilities
2
Office of the Law Revision Counsel. 29 US Code 1104 – Fiduciary Duties
3
Internal Revenue Service. 401(k) Resource Guide Plan Participants Summary Plan Description
4
Office of the Law Revision Counsel. 29 USC 1027 – Retention of Records
5
U.S. Department of Labor. Meeting Your Fiduciary Responsibilities
6
U.S. Department of Labor. Final Regulation Service Provider Disclosures Under 408(b)(2)
7
eCFR. 29 CFR 2550.408b-2 – General Statutory Exemption for Services or Office Space
8
Internal Revenue Service. You Haven’t Timely Deposited Employee Elective Deferrals
9
Internal Revenue Service. 401(k) Limit Increases to $24,500 for 2026
10
Internal Revenue Service. 401(k) Plan Fix-It Guide – The Plan Failed the 401(k) ADP and ACP Nondiscrimination Tests
11
U.S. Department of Labor. Final Rule to Improve Transparency of Fees and Expenses to Workers in 401(k)-Type Retirement Plans
12
U.S. Department of Labor. Default Investment Alternatives Under Participant-Directed Individual Account Plans
13
eCFR. 29 CFR 2550.404c-5 – Fiduciary Relief for Investments in Qualified Default Investment Alternatives
14
U.S. Department of Labor. Plan Information
15
eCFR. 29 CFR 2520.104b-10 – Summary Annual Report
16
U.S. Department of Labor. Forms and Filing Instructions
17
Internal Revenue Service. Form 5500 Corner
18
U.S. Department of Labor. Adjusting ERISA Civil Monetary Penalties for Inflation
19
U.S. Department of Labor. Delinquent Filer Voluntary Compliance Program
20
U.S. Department of Labor. Protect Your Employee Benefit Plan With an ERISA Fidelity Bond
21
U.S. Department of Labor. Cybersecurity Program Best Practices
22
U.S. Department of Labor. Voluntary Fiduciary Correction Program