If your private-sector retirement or health plan covered 100 or more participants at the start of the plan year, the employee benefit plan audit requirements under ERISA apply: an independent qualified public accountant must audit the plan’s financial statements each year, and the report has to be attached to your Form 5500 filing.1Office of the Law Revision Counsel. 29 USC 1023 – Annual Reports The audit confirms contributions were deposited on time, benefits were calculated correctly, and plan assets were handled properly. The Department of Labor and the IRS both enforce these rules, and missing them can trigger daily penalties, personal liability for fiduciaries, and loss of the plan’s tax-favored status.
Who Must Get an Audit
The trigger is the participant count on the first day of the plan year. Hit 100, and you’re a “large plan” that owes an audit. Stay under, and you file the simplified small-plan report with no audit attached.2U.S. Department of Labor. Selecting an Auditor for Your Employee Benefit Plan
Who counts as a participant is where 401(k) and 403(b) sponsors need to pay attention. For plan years beginning on or after January 1, 2023, a DOL rule changed the count for defined contribution plans so that only participants with an account balance at the start of the plan year are included. Eligible employees who have never deferred and never received an employer contribution are excluded. That single change moved a meaningful number of plans back under the threshold and freed them from the audit obligation.
For defined benefit plans and health and welfare plans, participants still include active employees, former employees with remaining rights, and beneficiaries receiving payments. The count is fixed as of the first day of the plan year, so a calendar-year plan looks at January 1.
The 80-120 Rule
Plans that hover around the threshold get some stability. If your participant count is between 80 and 120 at the start of the plan year and you filed as a small plan the prior year, you can keep filing as a small plan.3eCFR. 29 CFR 2520.103-1 – Contents of the Annual Report A one-year staffing bump doesn’t force you to hire an auditor. Once your count exceeds 120 at the start of a plan year, large-plan status locks in and the audit is required.
Full-Scope vs. Limited-Scope Audits
There are two kinds of audit, and the difference is about who verifies the investments. Plans whose assets are held and certified by a regulated bank, trust company, or insurance carrier can elect a limited-scope audit under ERISA Section 103(a)(3)(C).1Office of the Law Revision Counsel. 29 USC 1023 – Annual Reports The custodian certifies the completeness and accuracy of the investment data, and the auditor accepts that certification instead of testing the investments independently.
Most large 401(k) and 403(b) plans go this route because their assets sit with a major recordkeeper that provides the certification. Everything else still gets tested: participant data, contribution timing, benefit calculations, loans, and internal controls. Full-scope audits, which do require independent testing of investment balances and transactions, are used when the custodian can’t provide the certification or when plan assets are held in less standard arrangements. Full-scope engagements cost more and take longer.
Choosing the Auditor
ERISA requires an independent qualified public accountant, and the DOL evaluates independence broadly. An accountant fails the test if, during the engagement period, they hold a direct financial interest in the plan or its sponsor, serve as an officer or director of the sponsor, or maintain the plan’s financial records.4eCFR. 29 CFR 2509.2022-01 – Interpretive Bulletin Relating to Guidance on Independence of Accountant Retained by Employee Benefit Plan A firm can provide other professional services to the sponsor, such as tax preparation, without automatically losing independence, but the DOL warns that layering services on top of an audit invites scrutiny, especially when those other services are themselves being audited.
Experience matters as much as independence. The DOL has found significant quality problems in benefit plan audits performed by firms that handle them only occasionally. A firm doing a handful of plan audits every year understands contribution timing tests and loan compliance in a way that a generalist accountant taking on one plan every few years does not. Ask any candidate how many employee benefit plan audits they complete annually and what training their staff receives specifically for ERISA engagements.
What the Auditor Will Test
Contribution Timing
Auditors look hard at how quickly employee deferrals reached the plan trust after each pay date. Employee money must be segregated from company assets as soon as reasonably possible, and no later than the 15th business day of the month following the paycheck.5Internal Revenue Service. You Haven’t Timely Deposited Employee Elective Deferrals That 15th-business-day rule is an outer limit, not a target. For employers running automated payroll, the DOL expects deposits within a few days. The 7-business-day safe harbor available to plans with fewer than 100 participants does not apply to large plans.
Late deposits are treated as prohibited transactions. They can trigger excise taxes under Internal Revenue Code Section 4975 and require the employer to make corrective contributions covering lost earnings for the affected participants.6Office of the Law Revision Counsel. 26 USC 4975 – Tax on Prohibited Transactions This is one of the most common findings in plan audit reports.
Distributions and Vesting
For every sampled distribution, the auditor checks that the participant received the right amount. That means confirming the vesting percentage against the plan document’s schedule and tracing how any forfeited portion was used, whether reallocated to remaining participants, applied against future employer contributions, or used to pay plan expenses. The paperwork gets reviewed too: participant authorization forms, spousal consent where required, correct tax withholding, and timely remittance of withheld amounts to the IRS.
Plan Document Compliance
The plan document is the yardstick. The auditor pulls a sample of participants and traces them through the year. Were they enrolled on time? Did payroll use the plan’s definition of compensation when calculating the employer match? Were hardship withdrawals documented as the plan requires? Any gap between what the document says and what actually happened becomes a finding.
Fidelity Bond Coverage
Everyone who handles plan funds must be covered by a fidelity bond equal to at least 10% of the funds they handled in the preceding year, with a minimum of $1,000 and a cap of $500,000. Plans that hold employer stock have a higher cap of $1,000,000.7Office of the Law Revision Counsel. 29 USC 1112 – Bonding The bond is measured by funds handled, not total plan assets, which matters when fiduciary responsibilities are split among multiple people.
Documents to Have Ready
Have these materials organized before the auditor arrives. Scrambling for documents mid-engagement is how audit fees climb.
Start with the plan document and every amendment adopted during the plan year. A missing amendment can distort the entire engagement because the auditor measures operations against what the document actually says. Add the summary plan description, any trust agreements, and insurance or annuity contracts.
For participant testing, prepare a census with names, Social Security numbers, dates of birth, hire and termination dates, and compensation. Payroll records showing gross pay and deferral amounts per pay period are essential for verifying that contributions matched the plan’s compensation definition.
On the financial side, pull monthly or quarterly trust statements covering investment activity, earnings, and fees. If the plan has outstanding participant loans, gather the promissory notes and repayment schedules so the auditor can confirm balances stayed within legal limits and repayments followed the required amortization.
Filing the Report and Meeting Deadlines
The auditor’s opinion and any supplemental schedules are attached as a PDF to the plan’s Form 5500 annual return/report. All Form 5500 filings go through the DOL’s EFAST2 system electronically, either through approved third-party software or the DOL’s IFILE tool.8U.S. Department of Labor. Form 5500 Series Paper is not accepted.
Form 5500 is due by the last day of the seventh month after the plan year ends.9Internal Revenue Service. Publication 509 (2026), Tax Calendars For a calendar-year plan, that’s July 31. Filing Form 5558 before the original deadline grants a one-time extension of two and a half months, moving the calendar-year deadline to October 15.8U.S. Department of Labor. Form 5500 Series
Missing the deadline is expensive. DOL civil penalties currently run approximately $2,739 per day for each late or incomplete filing and accumulate until the deficiency is corrected. The IRS can separately assess $250 per day, capped at $150,000. Those penalties run in parallel, not as alternatives, so a plan that drifts past the deadline for months can face a six-figure bill.
If You’re Late or Find Errors
Delinquent Filer Voluntary Compliance Program
p>Missed a Form 5500 deadline? The DOL’s Delinquent Filer Voluntary Compliance (DFVC) Program lets you come into compliance at sharply reduced penalties, but only if you self-report before the DOL sends a notice of intent to assess a penalty.10U.S. Department of Labor. Delinquent Filer Voluntary Compliance Program The DFVC caps are:
- Small plans: $750 per late filing, with a $1,500 cap per plan (or $750 per plan if the sponsor is a 501(c)(3) tax-exempt organization).
- Large plans: $2,000 per late filing, with a $4,000 cap per plan.
Compared with $2,739 per day under standard enforcement, self-reporting first is almost always the right move. The program is not available for amended filings, Form 5500-EZ filers, or one-participant plans.
Fixing Operational Errors
Audits regularly turn up operational mistakes: the wrong compensation definition was used, eligible employees weren’t enrolled on time, deferral limits were exceeded. The IRS handles these through the Employee Plans Compliance Resolution System (EPCRS), which has three tracks:11Internal Revenue Service. EPCRS Overview
- Self-Correction (SCP): Available to sponsors with established compliance procedures, with no IRS contact or user fee required. Significant failures must be corrected within two years of the end of the plan year in which they occurred.
- Voluntary Correction (VCP): For errors that don’t qualify for SCP, you submit a correction proposal, pay a user fee, and receive formal IRS approval. Correction must be completed within 150 days of receiving the compliance statement.
- Audit Closing Agreement (Audit CAP): Used when the IRS finds the error during an examination. Sanctions under Audit CAP are always higher than VCP fees, which is how the IRS rewards voluntary disclosure.
If your audit surfaces a problem, address it through SCP or VCP right away. Waiting until an IRS examination catches it costs meaningfully more.
Why Fiduciaries Should Care
Plan fiduciaries carry personal exposure. Under ERISA, any fiduciary who breaches their duties must personally make the plan whole for resulting losses and return any profits earned through misuse of plan assets.12Office of the Law Revision Counsel. 29 USC 1109 – Liability for Breach of Fiduciary Duty Courts can remove a fiduciary and order additional equitable relief. An audit that flags late deposits, botched benefit calculations, or missing bond coverage is the chance to fix those problems before they become enforcement actions. Fiduciaries who skip a required audit or shelve the findings aren’t just risking plan penalties. They’re risking their own assets.