Third-party administrator audit requirements apply to any ERISA-covered employee benefit plan with 100 or more participants at the start of the plan year: federal law requires you to attach an independent qualified public accountant’s report to your Form 5500 filing, and skipping it exposes the plan sponsor to penalties of up to $2,670 per day plus potential loss of the plan’s tax-qualified status.1 The audit itself is a formal review of how your outside administrator handles plan money, contributions, distributions, and recordkeeping. Most of the compliance pain comes from poor preparation, not from the audit itself.
When Your Plan Needs an Audit
Under ERISA, a plan that covers 100 or more participants at the beginning of the plan year must file as a “large plan” and include a report from an independent qualified public accountant with its annual return.1 The participant count includes everyone eligible to participate, not just those who chose to defer or who have account balances. A company with 110 eligible employees and only 60 actively contributing still crosses the threshold.
The 80-120 participant rule gives plans near the line some stability. If your plan has between 80 and 120 participants at the start of the year, you can keep filing in whichever category you used the previous year.1 A plan that filed as a small plan last year with 95 participants doesn’t need an audit just because headcount grew to 105. It can continue filing as a small plan until the count hits 121. A plan already filing as large stays large until the count drops below 80.
Full-Scope or ERISA Section 103(a)(3)(C) Audit
Sponsors who need an audit have two options, and the choice affects cost and complexity. A full-scope audit means the auditor examines everything: financial statements, investment holdings, contribution records, and benefit payments.
The alternative, historically called a “limited scope” audit, is now formally the ERISA Section 103(a)(3)(C) audit. Under this approach, the auditor does not examine investment information that has been certified as accurate by a qualifying institution such as a bank, trust company, or insurance carrier.1 The auditor still reviews all other financial data and internal controls but relies on the institution’s certification for the investment balances. Most 401(k) plans whose assets sit with a regulated custodian qualify.
Current auditing standards require the auditor performing a 103(a)(3)(C) audit to issue a two-part opinion rather than the old blanket disclaimer. The first part addresses whether the non-certified financial information is presented fairly. The second addresses whether the certified investment information agrees with or derives from the institution’s certified statements. Plan sponsors electing this route must confirm in writing that the certifying institution qualifies under ERISA and that the certified data is appropriately measured and disclosed.
Choosing a Qualified Auditor
ERISA requires the plan administrator to engage an “independent qualified public accountant” to conduct the examination.1 The auditor must be a licensed CPA, must follow generally accepted auditing standards, and must be independent from the plan and its sponsor. An accountant who also handles the company’s payroll or provides certain consulting services to the plan may not clear the independence bar.
The Department of Labor has repeatedly flagged auditor inexperience as a leading cause of substandard audits.1 Problems cluster around auditors with limited employee benefit plan expertise, inadequate familiarity with how plans operate, and weak understanding of the rules governing 103(a)(3)(C) audits. The AICPA’s Employee Benefit Plan Audit Quality Center is a voluntary membership organization for firms that specialize in ERISA audits, and the AICPA publishes a directory of member firms.1 Membership isn’t a guarantee of quality, but it signals that the firm invests in staying current.
When interviewing a prospective auditor, ask how many ERISA audits the firm performs each year, whether the engagement partner has direct benefit plan experience, and whether the firm has faced any peer review deficiencies related to benefit plan work. A firm that does dozens of these audits a year will move faster, ask fewer redundant questions, and spot problems a generalist might miss.
Documents to Have Ready Before Fieldwork
Preparation is where sponsors either save weeks or lose them. The auditor will need the formal plan document, any amendments, and the adoption agreement that governs how the plan operates, along with the summary plan description given to participants. Pull these from your document management system and confirm every amendment is accounted for.
Employee census data comes next: dates of birth, hire dates, termination dates, hours worked, and compensation for each participant. Payroll records are essential because the auditor will trace deductions from individual paychecks through to deposits in the plan trust. If the numbers don’t reconcile, the auditor will expand testing until they find the source of the discrepancy.
Request a Service Organization Control (SOC 1) report from your TPA. This document describes the TPA’s internal controls over financial transaction processing and whether those controls were designed effectively.1 A SOC 1 Type 2 report is more useful than a Type 1 because it covers how controls actually operated over a period, not just how they looked on a single date. If the TPA can’t produce a Type 2, that itself is worth discussing with your auditor.
Cross-reference your payroll totals against bank statements before the auditor arrives. Gaps between what payroll says was deducted and what actually hit the plan trust account are one of the most common findings, and catching them early avoids the cost of expanded testing.
What the Auditor Examines
During fieldwork, the auditor selects a sample of participants and traces each person’s contribution from the payroll deduction through to the final investment in the plan. The core question is whether the money got where it was supposed to go, in the right amount, within the required timeframe.
Contribution timing draws heavy scrutiny. Federal rules require that participant deferrals be deposited into the plan trust as soon as they can reasonably be separated from the employer’s general assets, and no later than the 15th business day of the month following the payroll date.1 That outer deadline is a ceiling, not a target. If the employer can reasonably deposit funds within a few days of payroll, that is the actual standard, and consistent delays to day 14 will draw findings even though they fall within the window.
Benefit payments to retirees and terminated employees get tested as well. The auditor verifies that distribution amounts match the plan’s formula, that required tax withholding was applied, that proper elections and spousal consents are on file, and that only eligible individuals received funds. Loan disbursements and repayments go through similar scrutiny.
The auditor also verifies fidelity bond coverage. Federal law requires every person who handles plan funds to be bonded for at least 10 percent of the funds they handled in the prior year, with a minimum bond of $1,000 and a maximum of $500,000. Plans that hold employer securities face a higher ceiling of $1,000,000.1 An expired bond, an undersized bond, or one that doesn’t name the correct fiduciaries will show up as a finding, and premiums at these amounts are modest enough that there’s no good reason to let it happen.
Internal controls receive attention throughout. The auditor assesses whether the TPA’s systems correctly calculate employer matching contributions, apply vesting schedules accurately, and restrict access to sensitive participant data. If the SOC 1 report flagged control weaknesses, the auditor will perform additional testing in those areas.
Reading the Audit Report
When fieldwork wraps up, the auditor produces the formal audit report with the opinion on the plan’s financial statements, along with a management letter detailing specific weaknesses found during the examination. Sponsors typically receive both within several weeks after fieldwork concludes.
The management letter categorizes problems by severity, and the distinction matters. A significant deficiency is a control gap that could allow financial misstatements to slip through undetected. A material weakness is more serious: it means there is a reasonable possibility that a material error in the financial statements won’t be prevented or detected at all. Material weaknesses demand immediate corrective action and will likely draw DOL attention if they appear on the filed report. Many audit observations don’t rise to either level and are simply recommendations for operational improvement.
The auditor’s opinion itself can come back as unmodified (clean), qualified, adverse, or a disclaimer. Anything other than an unmodified opinion should trigger a serious conversation with both the auditor and the TPA about remediation before the report is attached to Form 5500.
Filing Deadlines and Extensions
The completed audit report must be attached to Form 5500, the annual return filed with the Department of Labor.1 For calendar-year plans, Form 5500 is due July 31. Plans with a different fiscal year end must file by the last day of the seventh month following that year-end.
If the audit isn’t finished in time, you can get an automatic extension by filing Form 5558 on or before the original due date. The extension pushes the deadline to the 15th day of the third month after the normal due date, a 2½-month cushion.1 For a calendar-year plan, that works out to October 15. Approval is automatic as long as Form 5558 is filed by July 31 and the requested date doesn’t exceed the outer limit. There is no second extension if the audit still isn’t done by October 15.
Penalties for Missing or Incomplete Filings
Under ERISA Section 502(c)(2), failure to file a complete annual report, including the required audit, can result in penalties of up to $2,670 per day until the deficiency is corrected.1 A plan that goes six months without correcting is looking at nearly half a million dollars in exposure.
Sponsors who realize they’ve missed a filing deadline can reduce that exposure through the Delinquent Filer Voluntary Compliance Program (DFVCP). The program drops the daily penalty to $10 per day, with caps of $750 per filing for small plans and $2,000 per filing for large plans, and per-plan caps across all filings of $1,500 for small plans and $4,000 for large plans.1 Small plans sponsored by 501(c)(3) tax-exempt organizations get a per-plan cap of $750. The trade-off is waiving the right to contest the penalty amount.
Beyond DOL fines, chronic compliance failures can jeopardize the plan’s tax-qualified status with the IRS. If a plan is disqualified, the trust loses its tax-exempt status, participants may owe taxes on vested benefits, and the employer loses its deduction for contributions. That outcome is catastrophic compared to the cost of simply getting the audit done on time.
Correcting Errors the Audit Uncovers
Finding problems during an audit is unpleasant, but the correction infrastructure is well-developed. The path depends on what went wrong.
Late Participant Contributions
When an employer doesn’t deposit participant deferrals quickly enough, the delay is a prohibited transaction. The IRS imposes an excise tax of 15 percent of the amount involved for each year the transaction remains uncorrected, reported and paid on Form 5330.1
The DOL’s Voluntary Fiduciary Correction Program (VFCP) offers relief. If the employer corrects a late deposit by depositing the missing amount plus lost earnings, the program can waive the excise tax in certain circumstances.1 For small amounts where lost earnings total $1,000 or less and the correction happens within 180 days, the employer can self-correct without filing an application.
Operational and Document Errors
For broader operational mistakes such as failing to follow the plan’s eligibility or compensation definitions, using the wrong vesting schedule, or miscalculating required minimum distributions, the IRS offers the Employee Plans Compliance Resolution System (EPCRS).1 It has three tracks:
- The Self-Correction Program (SCP) lets you fix certain operational failures without contacting the IRS or paying a fee. Significant failures must be corrected within two years of the end of the plan year in which they occurred.
- The Voluntary Correction Program (VCP) is for problems that don’t qualify for self-correction or where you want IRS sign-off before acting. You file Form 8950, pay a user fee, and propose a correction. The IRS issues a compliance statement, and you have 150 days to implement the fix.
- The Audit Closing Agreement Program (Audit CAP) applies when the plan is already under IRS examination. The sponsor negotiates a sanction and correction with the IRS, based on factors including the number of affected employees, the impact on rank-and-file participants, and the quality of the plan’s internal controls.
These programs mean that most audit findings, even serious ones, can be resolved without plan disqualification. Acting promptly once problems surface is what preserves the correction options.
What a TPA Audit Costs
Sponsors budgeting for a first audit should expect to spend roughly $10,000 to $20,000 or more on auditing fees, depending on plan size, complexity, and the firm’s specialization. CPA firms that focus heavily on benefit plan audits often charge a flat fee, while generalist firms may bill hourly, which can lead to unpredictable costs. Remote audits save on travel, but the biggest variable is usually how organized the sponsor’s records are going in. Sloppy data means more auditor hours reconciling discrepancies.
The out-of-pocket fee doesn’t capture the full cost. Internal staff, typically in HR and finance, will spend meaningful time pulling records, answering questions, and coordinating with the TPA. For a well-prepared sponsor with clean records and a cooperative TPA, that time burden is manageable. For one scrambling to locate plan documents and reconcile payroll data, it can easily double the effective cost of the engagement.