Three different entities can audit a 401(k) plan, and each looks at something different. An independent qualified public accountant, hired by the plan sponsor, examines the plan’s financial statements. The Department of Labor, through its Employee Benefits Security Administration (EBSA), investigates whether the people running the plan are handling participants’ money responsibly under ERISA. The IRS checks whether the plan qualifies for tax-favored treatment under the Internal Revenue Code. Not every plan faces all three every year, and the CPA audit is only mandatory once a plan reaches a certain size.
The Independent CPA Audit
Federal rules tie the CPA audit requirement to the number of participants with account balances at the start of the plan year. Once a plan has 100 or more participants, it must file as a “large plan” and attach a report from an independent qualified public accountant to its annual Form 5500.1eCFR. 29 CFR 2520.103-1 – Contents of the Annual Report The count includes active eligible employees and former employees who still hold a balance.
Plans sitting near that line get a buffer. Under the 80-120 participant rule, a plan that filed as a small plan the prior year can keep doing so until it starts a year with 121 or more participants. A plan already filing as a large plan can hold that status until it drops below 80.2U.S. Department of Labor. Employee Benefit Plan Auditor Selection The rule keeps small fluctuations in headcount from forcing a sponsor to hire and drop an auditor in alternating years.
What the CPA Actually Examines
ERISA Section 103 requires large plans to engage an independent qualified public accountant to examine the plan’s financial statements on behalf of all participants.3Office of the Law Revision Counsel. 29 USC 1023 – Annual Reports The sponsor pays for and selects the accountant, but the accountant must be independent of the company: not the plan’s recordkeeper, actuary, or internal bookkeeper.
The auditor samples transactions across the year. That means checking that payroll deferrals hit the trust on time, that benefit payments went to the right people in the right amounts, and that reported investment values are accurate. If the accountant finds material problems, the opinion letter attached to Form 5500 will flag them. A qualified or adverse opinion causes immediate trouble, because the DOL treats an incomplete or deficient filing as if no filing had been made, which triggers penalties.
Fees for a standard 401(k) audit typically run between $11,000 and $20,000, with complex investments, multiple service providers, or disorganized records pushing the number up. Clean payroll data and organized plan documents keep costs at the lower end.
Full-Scope and ERISA Section 103(a)(3)(C) Audits
Most 401(k) plans qualify for an ERISA Section 103(a)(3)(C) audit rather than a full-scope one. Under this option, the accountant relies on a certified statement from the plan’s bank, trust company, or insurance carrier for investment information instead of independently verifying every holding.3Office of the Law Revision Counsel. 29 USC 1023 – Annual Reports The qualified institution must certify in writing that the investment data is complete and accurate.
This was previously called a “limited scope audit,” and under the old version the auditor disclaimed any opinion on the financial statements. Under current rules the auditor issues an actual opinion, so participants get more meaningful assurance. Contribution accuracy, distributions, and participant data are still tested through normal audit procedures, since those areas are not covered by the investment certification.
The Department of Labor and EBSA
The Department of Labor oversees 401(k) plans through the Employee Benefits Security Administration, which enforces the fiduciary, reporting, and disclosure rules under Title I of ERISA.4U.S. Department of Labor. About EBSA Where the CPA audit asks whether the numbers are right, EBSA asks whether the people running the plan are following the rules.
EBSA looks for prohibited transactions: lending plan assets to the company, using plan money to cover business expenses, or letting insiders benefit from plan investments at participants’ expense. The agency also enforces timely deposit rules. Employers must deposit employee paycheck deductions into the plan trust as soon as reasonably possible, with an outer deadline of the 15th business day of the month following each payday. Plans with fewer than 100 participants get a safe harbor: deposits made within seven business days of withholding are treated as timely.5U.S. Department of Labor. 401(k) Plans For Small Businesses
Late deposits are one of the most common failures EBSA finds. Beyond making affected participants whole through lost-earnings contributions, the DOL can assess civil penalties. Failure to file a complete annual report can result in penalties exceeding $2,700 per day, a figure adjusted periodically for inflation.6U.S. Department of Labor. Enforcement Manual – Civil Penalties EBSA can also sue individual fiduciaries personally for losses caused by their mismanagement.
The IRS
The IRS examines 401(k) plans from a different angle: whether the plan qualifies for tax-favored treatment. A qualified plan lets employees defer income tax on contributions and investment growth until distribution. In exchange, the plan must respect contribution limits, pass nondiscrimination testing, and operate consistently with its written plan document.
Contribution Limits
For 2026, the employee elective deferral limit is $24,500. Participants aged 50 and older can add $8,000 in catch-up contributions, and under a SECURE 2.0 provision, participants aged 60 through 63 get an enhanced catch-up limit of $11,250 instead.7Internal Revenue Service. 401(k) Limit Increases to $24,500 for 2026, IRA Limit Increases to $7,500 Combined employer and employee contributions cannot exceed $72,000 for the year before catch-ups, the annual addition limit under Section 415(c).
Nondiscrimination and Top-Heavy Testing
Plans must pass nondiscrimination testing, which compares deferral rates and employer contribution rates between highly compensated and non-highly compensated employees.8Internal Revenue Service. Retirement Topics – 401(k) and Profit-Sharing Plan Contribution Limits A plan that fails typically has to refund excess contributions to highly compensated employees or make additional contributions for everyone else.
Top-heavy testing is separate. It looks at whether key employees (generally officers, certain owners, and high earners) hold more than 60% of the total accrued benefits in the plan.9eCFR. 26 CFR 1.416-1 – Questions and Answers on Top-Heavy Plans When a plan is top-heavy, the employer must make minimum contributions for non-key employees, typically at least 3% of compensation.
Operational Compliance
The IRS also checks whether the sponsor actually follows the plan document. If the document says loans are available and the sponsor has been denying them, or if hardship distributions are approved under criteria that don’t match the written terms, those operational failures can jeopardize the plan’s qualified status. Most IRS compliance issues start with this kind of mismatch between what the document says and what the sponsor does.
Fixing Errors: The IRS Correction Programs
When something goes wrong, the IRS generally prefers correction over disqualification. The Employee Plans Compliance Resolution System offers three paths, and which one applies depends on the severity of the error and whether the IRS has already started looking.10Internal Revenue Service. EPCRS Overview
The Self-Correction Program handles operational failures where the document is fine but the sponsor didn’t follow it. No IRS filing and no fee. The sponsor identifies the mistake, fixes it, and documents the correction internally.
The Voluntary Correction Program is for problems too serious for self-correction, or for document failures where the plan terms themselves need changing. The sponsor submits an application with a proposed fix and pays a user fee. For 2026, fees run from $2,000 for plans with up to $500,000 in assets to $4,000 for plans over $10 million.11Internal Revenue Service. Voluntary Correction Program (VCP) Fees VCP has to be used before the IRS starts an audit.
The Audit Closing Agreement Program applies when the IRS finds the error itself during an examination. The sponsor negotiates a closing agreement and pays a sanction, and those sanctions are significantly larger than VCP fees because the sponsor didn’t self-report.
What Disqualification Costs
If correction isn’t possible, or the sponsor refuses to cooperate, the IRS can disqualify the plan. The consequences hit both sides of the employment relationship hard.12Internal Revenue Service. Tax Consequences of Plan Disqualification
For employers, the immediate hit is losing the deduction for contributions. In a qualified plan, employer contributions are deductible when made. After disqualification, the employer can deduct contributions only when the amounts are included in employees’ taxable income, and only to the extent employees are vested.
For employees, vested employer contributions made during disqualified years become taxable income in the year contributed. Highly compensated employees face worse treatment: if disqualification results from failure to meet participation or coverage requirements, they must include their entire previously untaxed vested balance in income, not just contributions from the disqualified year. Non-highly compensated employees generally owe tax only on vested contributions from the disqualified years.12Internal Revenue Service. Tax Consequences of Plan Disqualification
Distributions from a disqualified plan cannot be rolled over to an IRA or another retirement plan. Every dollar coming out is taxable, with no chance to defer. That is why EPCRS exists as an alternative.
What Triggers a DOL or IRS Investigation
Neither agency audits every plan every year, so it helps to know what draws attention. Common triggers include:
- Late or incomplete Form 5500 filings. A missing return puts the plan on a DOL list almost immediately.
- Participant complaints. EBSA fields hundreds of thousands of inquiries each year through its website and hotline, and a complaint about unpaid deposits or a denied claim can escalate into a full investigation.13U.S. Department of Labor. What We Do
- Repeated failed nondiscrimination testing or unusual corrections reported on Form 5500.
- A consistent pattern of late employee deferral deposits, which shows up on the plan’s audit report and is a primary EBSA enforcement target.
- Large or unusual distributions, especially to owners or officers.
- Above-market fees paid to related-party service providers, a textbook prohibited transaction.
Most sponsors never see a full DOL or IRS examination. Those who do usually share one trait: they let a smaller compliance issue compound over time. Fixing late deposits, correcting failed tests, and filing on schedule are the strongest defense against ever appearing on an agency’s radar.