Employee benefit plan audits sit at the intersection of GAAS, the Employee Retirement Income Security Act of 1974 (ERISA), Department of Labor (DOL) regulations and the Form 5500 instructions. They are also must-select engagements in AICPA peer review, so the quality bar is visible.
This guide explains when a 401(k) or other defined contribution plan needs an audit, how participant counting changed in 2023, what an ERISA Section 103(a)(3)(C) audit is, and how SAS No. 136 shapes the engagement. It paraphrases the standards and regulations and is not a substitute for the Form 5500 instructions, DOL regulations or AU-C 703.
Which plans need an audit?
ERISA Section 103 generally requires the administrator of an employee benefit plan to engage an independent qualified public accountant (IQPA) to audit the plan's financial statements and attach the audit report to the plan's annual Form 5500 filing. DOL regulations exempt small plans from this requirement if they meet certain conditions.
In practice, the dividing line is whether the plan files as a large plan or a small plan:
- A plan that covers 100 or more participants at the beginning of the plan year generally files as a large plan, completes Schedule H, and must attach an IQPA audit report.
- A plan with fewer than 100 participants at the beginning of the plan year generally files as a small plan and is generally exempt from the audit requirement, provided it meets the conditions of the small plan audit waiver (including requirements about qualifying plan assets, or enhanced bonding and disclosure where assets are not qualifying).
How participants are counted since 2023
For plan years beginning on or after January 1, 2023, the Form 5500 instructions changed how defined contribution plans count participants for this purpose. A defined contribution plan, such as a 401(k) or 403(b) plan, now counts only participants with account balances at the beginning of the plan year, rather than every eligible employee whether or not they had enrolled.
The effect was to move many plans with high eligibility but low participation below the 100 threshold, removing the audit requirement for those plans. Defined benefit plans continue to count participants under the earlier method, which includes eligible participants regardless of account balance.
When planning a new engagement or reassessing an existing one, confirm the count from the recordkeeper's participant data as of the first day of the plan year, not the year-end census.
The 80-120 rule
The Form 5500 instructions include a long-standing transition rule. If a plan has between 80 and 120 participants at the beginning of the plan year, it may elect to complete the return in the same category (large or small) as it did the prior year. So a plan that filed as a small plan last year and has, say, 110 participants with account balances this year can generally continue to file as a small plan and avoid the audit requirement. Once the count exceeds 120, it must file as a large plan.
The election is the plan administrator's to make. The auditor's role is to understand the filing status and confirm whether an audit is required.
Types of ERISA plan audits
ERISA Section 103(a)(3)(C) audit
ERISA Section 103(a)(3)(C) permits the plan administrator to instruct the auditor not to perform audit procedures on investment information that is prepared and certified by a qualified institution, such as a bank, trust company or similarly regulated institution, or an insurance company regulated by a state. These were formerly called limited-scope audits. The certification must state that the information is complete and accurate.
Under SAS No. 136, an ERISA Section 103(a)(3)(C) audit is not a scope limitation in the traditional sense. The auditor still has defined responsibilities for the certified investment information:
- evaluate management's assessment of whether the certification is from a qualified institution and meets DOL requirements
- compare the certified information with the related information presented in the financial statements and disclosures
- read the disclosures related to the certified information to assess whether they are in accordance with the applicable framework
- perform audit procedures on information that is not covered by the certification, such as contributions, benefit payments, participant loans and any investment information the institution did not certify
The report is a modified form that describes the certified investment information, the procedures performed on it and the auditor's responsibilities for it.
Full-scope audit
Where the plan administrator does not elect the 103(a)(3)(C) approach, or where investments are not held by a qualified institution or not certified, the auditor performs a full-scope audit, including procedures on investments and their fair value measurements.
SAS 136 (AU-C 703)
SAS No. 136, Forming an Opinion and Reporting on Financial Statements of Employee Benefit Plans Subject to ERISA, is codified as AU-C 703. It applies to audits of single-employer, multiple-employer and multiemployer plans subject to ERISA. Its main features:
- Engagement acceptance. The auditor must obtain management's agreement that it acknowledges and understands its responsibilities, including maintaining a current plan instrument and administering the plan in accordance with its provisions, and, for 103(a)(3)(C) audits, determining whether the election is permissible and whether the certification meets the requirements.
- Plan provisions. The auditor obtains an understanding of the relevant plan provisions and, considering the assessed risks, designs and performs procedures on whether transactions and balances are in accordance with those provisions.
- Reportable findings. The auditor communicates reportable findings to those charged with governance in writing and on a timely basis. These include identified or suspected noncompliance with laws or regulations, findings the auditor judges significant and relevant to those charged with governance, and internal control deficiencies identified in the audit. Transactions found not to follow the plan instrument are evaluated to decide whether they are reportable findings.
- Supplemental schedules. The auditor performs procedures on the Form 5500 supplemental schedules, such as the schedule of assets held at end of year and the schedule of delinquent participant contributions, and reports on whether they are fairly stated in relation to the financial statements as a whole and in conformity with DOL rules.
- Form 5500. The Form 5500 is other information for the purposes of AU-C 720 when it is available, so the auditor considers it against the audited financial statements.
- Report format. The auditor's report follows a specified form, with distinct wording for 103(a)(3)(C) audits.
SAS No. 136 has been effective for audits of ERISA plan financial statements for periods ending on or after December 15, 2021.
Key audit areas in a 401(k) plan audit
Risk assessment under AU-C 315 still drives the audit, but some areas come up in nearly every defined contribution plan.
Contributions
- Definition of compensation. Plans define compensation for deferrals and employer contributions in the plan document. Payroll systems that exclude bonuses, commissions or other pay types the plan includes (or the reverse) are a common operational error.
- Timely remittance of participant deferrals. DOL rules require deferrals to be deposited as soon as they can reasonably be segregated from the employer's general assets, subject to an outer limit. For plans with fewer than 100 participants, the DOL provides a safe harbor of seven business days. For larger plans there is no safe harbor; the employer's own demonstrated remittance pattern is the yardstick. Late deposits are reported on the supplemental schedule of delinquent participant contributions and may be prohibited transactions.
- Employer matching and nonelective contributions recalculated against plan terms.
Eligibility and enrollment
Testing whether eligible employees were offered participation on time, whether automatic enrollment features were applied, and whether long-term part-time employee rules introduced by the SECURE and SECURE 2.0 Acts have been considered where relevant.
Benefit payments and distributions
Testing that distributions were properly authorized, calculated, and paid to eligible participants, including hardship distributions and required minimum distributions.
Participant loans
Testing compliance with plan loan provisions and handling of defaulted loans.
Investments and fair value
In a full-scope audit, testing existence, valuation and disclosures, including the fair value hierarchy. In a 103(a)(3)(C) audit, comparing certified information and testing uncertified amounts.
Service organizations
Most plans rely on recordkeepers, trustees and payroll providers. The auditor obtains and evaluates SOC 1 reports, including complementary user entity controls that the plan sponsor must have in place, under AU-C 402.
Sampling
Participant-level testing (contributions, distributions, loans) usually involves audit sampling under AU-C 530. Materiality under AU-C 320 for a plan is often based on net assets available for benefits, with lower thresholds for certain classes such as benefit payments considered.
Independence and qualifications
The auditor must be independent under both the AICPA Code of Professional Conduct and the DOL's independence requirements for plan auditors, which can be stricter in some respects. Partners and staff need appropriate competence for plan audits, including relevant CPE. The AICPA Employee Benefit Plan Audit Quality Center offers resources for firms with a plan practice.
Filing deadlines
The Form 5500 is generally due by the last day of the seventh month after the plan year ends, July 31 for a calendar-year plan, with a two-and-a-half month extension available by filing Form 5558. For a calendar-year plan, that puts the extended deadline in mid-October, which creates a second busy season for many firms.
Filing a Form 5500 without a required audit report, or with a report the DOL considers deficient, exposes the plan administrator to DOL penalties. The DOL's Delinquent Filer Voluntary Compliance Program provides a route to correct late filings.
Frequently asked questions
Does a 401(k) plan with 100 eligible employees need an audit?
Not necessarily. Since 2023, defined contribution plans count only participants with account balances at the beginning of the plan year. A plan with 100 eligible employees but fewer than 100 with balances generally files as a small plan and is generally exempt from the audit requirement, if it meets the small plan conditions.
What is the difference between a limited-scope audit and an ERISA 103(a)(3)(C) audit?
They describe the same election. "ERISA Section 103(a)(3)(C) audit" is the term used since SAS No. 136, which also defined the auditor's responsibilities for certified investment information more clearly than the old limited-scope approach.
Who chooses the 103(a)(3)(C) audit?
The plan administrator makes the election, and must determine that the certification is from a qualified institution and meets DOL requirements. The auditor evaluates management's assessment and reports accordingly.
Are 401(k) audits must-select in peer review?
Yes. Audits of employee benefit plans subject to ERISA are a must-select engagement type in AICPA peer review, so a firm that performs any can expect at least one to be selected for review.
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Sources
- AICPA, SAS No. 136, Forming an Opinion and Reporting on Financial Statements of Employee Benefit Plans Subject to ERISA (AU-C Section 703)
- AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization
- ERISA Section 103(a)(3), 29 U.S.C. 1023(a)(3)
- 29 CFR 2520.103-8 and 2520.103-12 (limited exemption for investments held by banks, insurance carriers and similar institutions): https://www.ecfr.gov/current/title-29/section-2520.103-8
- 29 CFR 2520.104-46 (small plan audit waiver): https://www.ecfr.gov/current/title-29/section-2520.104-46
- 29 CFR 2510.3-102 (participant contributions as plan assets, seven business day safe harbor for small plans): https://www.ecfr.gov/current/title-29/section-2510.3-102
- DOL EBSA, Form 5500 Series and instructions (participant counting, 80-120 rule, Form 5558 extension): https://www.dol.gov/agencies/ebsa/employers-and-advisers/plan-administration-and-compliance/reporting-and-filing/form-5500
- DOL EBSA, Delinquent Filer Voluntary Compliance Program
- AICPA Peer Review Program, must-select engagements
Part of CORAA University · Specialized engagements: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error