An ERISA Section 103(a)(3)(C) audit is an employee benefit plan audit in which the independent auditor relies on a qualified bank or insurance carrier’s certification of the plan’s investment information instead of testing that data independently. The auditor still examines contributions, benefit payments, participant records, and plan operations. What changes is the investment piece: year-end market values, dividend and interest income, and realized and unrealized gains and losses are accepted as certified rather than traced to independent pricing sources. The election can shorten the audit and lower its cost, but it puts the plan administrator on the hook for making sure the certification is valid and the certifying institution actually qualifies under federal law.
What the Auditor Skips and What Stays
In a full-scope audit, investment testing is one of the most time-consuming procedures. The auditor confirms holdings with the custodian, verifies fair market values against independent pricing sources, and tests income and gain-loss activity across the year. Under a 103(a)(3)(C) election, that work drops out. The auditor instead reviews the certification and the attached investment schedule and confirms that the numbers flow correctly into the plan’s financial statements.
Everything outside the investment area stays in scope. Contributions in, benefits out, participant data, eligibility, vesting, distributions, loans, prohibited transactions, and internal controls all receive the same testing they would in any other audit. The election narrows one section of the engagement; it does not turn the audit into a review or a compilation.
Which Institutions Can Certify
The statute limits the election to investment data prepared by a “bank or similar institution or insurance carrier” that is “regulated and supervised and subject to periodic examination by a State or Federal agency.”1Office of the Law Revision Counsel. 29 USC 1023 – Annual Reports Three categories of institutions meet that test:
- Federally regulated banks, including national banks and federal thrift institutions supervised by the Office of the Comptroller of the Currency, and state-chartered banks that are members of the Federal Reserve System.
- State-chartered banks and trust companies supervised and periodically examined by a state banking department.
- Insurance carriers regulated by a state insurance commissioner or equivalent state authority.
Government oversight is the common thread. A brokerage firm, a registered investment adviser, or a third-party recordkeeper does not qualify on its own. Many recordkeepers hold plan assets through an affiliated trust company that does meet the test, but that arrangement is not automatic and should never be assumed. If the certifying entity turns out not to qualify, the election is invalid, and the plan may need a full-scope audit for the year.
What a Valid Certification Must Say
The certifying institution must provide a written statement that the investment information is both complete and accurate as of the plan’s year-end date, and that certification becomes part of the annual report.1Office of the Law Revision Counsel. 29 USC 1023 – Annual Reports The Department of Labor has emphasized that a proper certification addresses both accuracy and completeness, not just one.2U.S. Department of Labor. Advisory Council Report on Employee Benefit Plan Auditing and Financial Reporting Models
The certification usually accompanies a detailed schedule listing every investment the plan holds, with fair market value and cost basis as of the valuation date. It should be signed by someone actually authorized to represent the institution for this purpose. The DOL has cautioned that when a certification does not include an explicit statement of authority, the plan administrator must take steps to verify the signer is authorized before relying on the election.2U.S. Department of Labor. Advisory Council Report on Employee Benefit Plan Auditing and Financial Reporting Models
Coverage matters. A certification that covers only part of the plan year, or that omits an asset class held through a different custodian, does not support the election for the missing period or missing assets. The auditor then has to test those uncovered investments independently. That hybrid engagement is often more complicated, and sometimes more expensive, than a straightforward full-scope audit would have been in the first place.
What the Plan Administrator Has to Do
Electing the 103(a)(3)(C) approach does not shift responsibility to the bank. The plan administrator has a fiduciary duty to confirm that the conditions for the election are actually met: that the certifying institution qualifies under federal law, that the certification covers all plan assets and the full reporting period, and that the certified data is consistent with the plan’s own records.2U.S. Department of Labor. Advisory Council Report on Employee Benefit Plan Auditing and Financial Reporting Models
The practical work is reconciliation. Map the certified investment schedule against the plan’s trial balance. Confirm that dividends, interest, and realized gains or losses reported by the institution match the amounts running through the plan’s income statement. Discrepancies need to be resolved before the auditor starts fieldwork. This is where problems usually surface: a custodian transition mid-year, a self-directed brokerage window that falls outside the certification, or trades that settled after year-end. Catching those early prevents a qualified opinion or a rejected filing.
Fiduciaries who fail to carry out these responsibilities can face personal liability for losses to the plan.3U.S. Department of Labor. Fiduciary Responsibilities Courts can order fiduciaries to restore losses caused by a breach and can remove them from their positions. Documenting the review process, including committee minutes showing that financial reports were discussed and approved, creates a record that matters if the DOL ever investigates.
How SAS 136 Changed the Report
Auditors of employee benefit plans now follow Statement on Auditing Standards No. 136, effective for plan years ending on or after December 15, 2021. SAS 136 replaced the old “limited-scope audit” label with the formal designation “ERISA Section 103(a)(3)(C) audit.” The renaming reflects a real change in the report itself.
Under the old format, the auditor issued a disclaimer of opinion on the financial statements because of the scope limitation on investments. Under SAS 136, the auditor issues an actual opinion, with a separate section explaining that the certified investment information was not independently tested. The report has to clearly describe the responsibilities of both the auditor and the plan administrator, and it must include an “other matter” paragraph describing the procedures performed on the certified data.
For plan administrators, this means auditors ask more questions, request more documentation, and produce more detailed reports than they did before. The 103(a)(3)(C) election still reduces work compared to a full-scope audit, but the gap narrowed when SAS 136 took effect. Fee proposals should be evaluated against that reality.
Form 5500 Reporting and What Happens if the Election Fails
The completed audit report is attached to the plan’s Form 5500, filed electronically through EFAST2, and the Form 5500 itself has to indicate that the plan elected the 103(a)(3)(C) approach.4U.S. Department of Labor. Form 5500 Series Filings become part of the public record.
If the certifying institution did not qualify, or the certification was incomplete, the audit report attached to the filing can be rejected as deficient. A rejected filing is treated as if it were never submitted. That matters because the DOL and the IRS both impose daily penalties for late or missing Form 5500 filings, and those penalties keep accruing until an acceptable filing is on record.5Office of the Law Revision Counsel. 29 USC 1132 – Civil Enforcement A plan administrator who believed the filing was timely and complete can find out otherwise months later, with penalty exposure that traces back to a bad certification the administrator never verified.
That risk is the reason the election is worth taking seriously rather than treating as a routine box to check. The savings on the audit are real, but they depend on a chain of conditions the administrator, not the auditor, is responsible for confirming.