403(b) Plan Audit Considerations: Eligibility, Written Program and Deferral Timing

A 403(b) plan looks like a 401(k) plan to the participant and to the payroll clerk. To the plan auditor it is a different structure with its own failure points. The sponsor class is narrow, the plan must exist as a written program, and the rule on who must be allowed to defer is stricter than the 401(k) rule. This guide sets out the points the IRS itself publishes and turns them into audit tests.

Who may sponsor

The IRS lists public schools, Code Section 501(c)(3) tax-exempt organizations and churches as the employers that can set up 403(b) plans. The first audit question is therefore a gating one: is the sponsor an eligible employer? A nonprofit that has lost or never held exempt status, or a for-profit affiliate that participates in the sponsor's plan, is a threshold issue to raise with the sponsor and its counsel before any other testing.

Retain in the file the determination or exemption letter, or other evidence of the sponsor's status, and the list of participating employers.

The written program

A 403(b) plan must be maintained under a written program that sets out its terms. The IRS notes that the requirement does not mean the plan must sit in a single document. The program can be made of several bundled documents, so the auditor's first task is to collect all of them.

The mandatory terms the IRS lists are:

• Eligibility. Who can participate. If elective deferrals are allowed, the plan must satisfy universal availability.
• Benefits. Nondiscrimination rules apply to employer contributions, other than those in governmental plans, church plans or safe harbor plans.
• Limitations. Caps on compensation, total annual additions and elective deferrals.
• Investments. Individual accounts must be annuity contracts, custodial accounts or church retirement income accounts. The IRS states that 403(b) plans cannot be funded with life insurance issued after September 24, 2007.
• Distributions. Permitted only upon separation from service, hardship, disability or reaching age 59 and a half, with each form of payment stated.

The employer is responsible for operating the plan according to the written program, and the IRS says the employer should set up information-sharing procedures with all plan vendors. That last point is the audit's problem: 403(b) assets often sit with several vendors, and no single recordkeeper sees the whole picture.

Optional provisions, such as automatic enrollment, Roth accounts, plan-to-plan transfers, catch-up contributions, loans and hardship distributions, are in or out according to the document, and every one that is in must be tested in operation.

Universal availability

The IRS snapshot's examination points focus here. Under IRC 403(b)(12)(A)(ii), all employees of the employer must be eligible to make elective deferrals if any employee has the right to do so, including designated Roth contributions where offered. The IRS lists the permitted exclusions:

• employees who normally work fewer than 20 hours per week (a plan may set a lower threshold);
• students performing services described in IRC 3121(b)(10);
• nonresident aliens described in IRC 410(b)(3)(C); and
• employees already eligible to defer under another 401(k), 403(b) or 457(b) plan of the same employer.

The IRS is explicit that, unlike a 401(a) plan, a 403(b) plan cannot exclude part-time, temporary, seasonal, substitute teacher, adjunct professor or collectively bargained employees as categories. They can be excluded only if they meet the fewer-than-20-hours test.

An employee normally works fewer than 20 hours a week only if the employer reasonably expects fewer than 1,000 hours of service in the first 12 months of employment, and the employee actually works fewer than 1,000 hours in each later plan year. Once an employee reaches 1,000 hours in a year, the part-time exclusion is gone for later years. Churches and qualified church-controlled organizations are not subject to universal availability for elective deferrals.

A second rule applies to 403(b) plans subject to ERISA. For plan years beginning after December 31, 2024, such a plan must give the right to make elective deferrals to a part-time employee who qualifies as an ERISA long-term part-time employee, meaning two consecutive 12-month periods with at least 500 hours of service each (ERISA Section 202(c); IRS Notice 2024-73, Q&A-2). A part-time exclusion that is valid under the 1,000-hour test can still fail for an employee who has reached that 500-hour history. A 403(b) plan not subject to Title I of ERISA, such as a governmental plan, is not subject to it (Notice 2024-73, Q&A-1).

Worked example

Eastbrook Academy, a 501(c)(3) school, has a 403(b) plan whose document excludes "adjunct instructors." Payroll lists 62 adjuncts.

1. The auditor reads the exclusion. A category exclusion is not one of the permitted exclusions.
2. The auditor pulls hours for all 62 adjuncts. Fifty-one worked fewer than 1,000 hours in the plan year and had expected hours under 1,000 when hired, so they met the fewer-than-20-hours test.
3. Eleven worked 1,000 hours or more in at least one plan year. For those eleven, the exclusion could not apply in later years.
4. The auditor reports to the administrator that the plan document's category exclusion and the operation for the eleven are failures of universal availability, and records the amounts of missed deferral opportunity as far as they can be estimated. The correction route belongs to the sponsor and its counsel.

Deferral deposits

The IRS FAQ states that sponsors must send elective deferrals to the vendor within an administratively feasible period, which the FAQ describes as within 15 business days after the month in which the amounts would have been paid to the employee. For ERISA-covered plans, the FAQ points to the Department of Labor's rules, which can set a shorter period. A plan that is subject to ERISA also faces the late-deposit consequences covered in participant data, contributions and late deposits.

Whether a particular 403(b) plan is subject to ERISA is a Department of Labor question; the IRS FAQ defers to the Department's rules. ERISA Title I does not apply to a governmental plan or to a church plan that has not elected coverage (29 U.S.C. 1003(b)(1) and (2)). A salary-reduction 403(b) program is not an employer-established pension plan under 29 CFR 2510.3-2(f) only if it meets every condition there, including completely voluntary participation, rights enforceable solely by the employee, and employer involvement limited to the listed administrative steps. Settle it at planning, because it decides whether the plan files Form 5500 and whether the audit requirement applies. See Form 5500 filing guide.

Loans and hardship distributions

A plan may, but is not required to, allow loans and hardship distributions, and participants may take them to the extent and in the manner the plan allows. The audit test is to the document: if the plan does not allow a loan, no loan should exist; if it does, each tested loan matches the plan's terms.

Audit procedure summary

1. Obtain the sponsor's status evidence and the complete written program, with all vendor contracts.
2. Compare the document's eligibility, limit and distribution terms with the payroll system's configuration.
3. Test universal availability with hours data for every excluded group.
4. Test the timing of deferral deposits for a sample of payroll dates against the standard that applies.
5. Reconcile each vendor's statement to the plan's total, since no single vendor has the whole population.
6. Test loans and hardship distributions to the document.
7. Evaluate prohibited-transaction exposure. See ERISA prohibited transactions.
8. Document findings, and communicate to those charged with governance under AU-C 260.

Where CORAA fits

CORAA prepares ready-to-review audit files for US CPA firms, including eligibility exception schedules and vendor reconciliations. The firm keeps the client, the review and the signature. See /us.

Sources

• IRS, IRC 403(b) tax-sheltered annuity plans, written program: https://www.irs.gov/retirement-plans/irc-403b-tax-sheltered-annuity-plans-written-program
• IRS, Issue Snapshot, 403(b) plan, the universal availability requirement: https://www.irs.gov/retirement-plans/issue-snapshot-403b-plan-the-universal-availability-requirement
• IRS, Notice 2024-73, Additional Guidance with Respect to Long-Term, Part-Time Employees: https://www.irs.gov/pub/irs-drop/n-24-73.pdf
• IRS, Retirement plans FAQs regarding 403(b) tax-sheltered annuity plans: https://www.irs.gov/retirement-plans/retirement-plans-faqs-regarding-403b-tax-sheltered-annuity-plans
• Legal Information Institute, 29 U.S.C. 1003, Coverage: https://www.law.cornell.edu/uscode/text/29/1003
• Legal Information Institute, 29 CFR 2510.3-2, Employee pension benefit plan: https://www.law.cornell.edu/cfr/text/29/2510.3-2

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error