What EBSA Looks For in Employee Benefit Plan Audits: DOL Findings, Rejections and Quality Problems

The Department of Labor reads the audit reports attached to Form 5500 filings, and its Office of the Chief Accountant reviews the workpapers behind them. The clearest public record of what it finds is the May 2015 report, Assessing the Quality of Employee Benefit Plan Audits. It is the fourth EBSA baseline study, after those of 1988, 1997 and 2004, and it names the specific audit areas that fail. This guide reports what that document and the 2025 Form 5500 instructions state. For the audit mechanics, see the 401(k) audit requirements guide.

How the study was built

EBSA reviewed filings for the 2011 filing year. In that year, 81,162 Form 5500 filings carried CPA audit reports, performed by 7,330 CPA firms. EBSA drew a statistically valid sample of 400 audits, stratified into six groups by how many plan audits the firm performed, and measured each audit against the requirements of the AICPA Audit and Accounting Guide for employee benefit plans.

Each audit was placed in one of four categories: Acceptable, Acceptable with minor findings, Unacceptable with minor GAAS deficiencies, and Unacceptable with major deficiencies that adversely affect overall audit quality.

The headline numbers

• 39 percent of audits contained major deficiencies against one or more relevant GAAS requirements. EBSA stated that these deficiencies would lead to rejection of a Form 5500 filing, and put $653 billion in plan assets and 22.5 million participants and beneficiaries at risk.
• The deficiency rate across the four studies read 23 percent (1988), 19 percent (1997), 33 percent (2004) and 39 percent (the 2015 report, covering 2011 filings).
• Firms performing one or two plan audits a year had a 76 percent deficiency rate. The firms with the largest plan audit practices had 12 percent.
• 17 percent of the 400 reports (67) failed one or more ERISA reporting and disclosure requirements. Of those 67: 16 percent lacked the required supplemental schedules, 16 percent had incomplete or missing footnotes, 12 percent were not manually signed as DOL regulations require, and 10 percent failed to report or disclose delinquent employee contributions properly.

The signature finding is a mechanical one. Under 29 CFR 2520.103-1(b)(5), the accountant's report must be dated, manually signed, and show the city and state of issue. A large share of the reporting failures were avoidable on the day of issuance.

Where audits fail: the plan-specific areas

EBSA concluded that the audit areas unique to employee benefit plans, contributions, benefit payments, participant data and party-in-interest or prohibited transactions, continue to lead the list of deficiencies. The overall deficiency rate by audit area in the study:

Investments ranked near the bottom at 4.2 percent. The top failures were in areas the limited-scope election does not remove.

The study's lists of specific major findings show what the reviewers wanted to see:

• Contributions. The most frequent single finding, 53 occurrences, was failure to test timely remittance of employee contributions. Next came failure to test compliance with plan compensation provisions (35) and no or inadequate testing of the use of forfeitures (24).
• Participant data. Failure to adequately test allocations to participant accounts (89), no or insufficient testing of payroll data (73), no or inadequate testing of participant investment options (68), no reconciliation of total individual participant accounts to total plan assets (41), and failure to adequately test eligibility, terminations and forfeitures (35). Ten audits relied inappropriately on a SOC 1 report.

The limited-scope finding

EBSA reported that almost 60 percent of the limited-scope audits in the study contained major GAAS deficiencies in areas not related to investments. It tied the rising deficiency rate to the share of audits that were limited-scope, which went from 48 percent in 2001 to 83 percent in 2013, and recommended that Congress repeal the exemption. The exemption remains in ERISA 103(a)(3)(C). See the limited-scope audit guide.

What EBSA has done with deficient audits

The study lists the actions the Office of the Chief Accountant has taken to enforce reporting and disclosure:

• Letters rejecting deficient or incomplete Form 5500 filings that fail ERISA reporting and disclosure requirements.
• About 5,000 workpaper reviews to evaluate the audit work underlying CPA reports.
• Referral of practitioners to the AICPA Professional Ethics Division or the state board of accountancy for potential disciplinary action when the audit work is significantly deficient.
• Referrals between the Office of the Chief Accountant and the EBSA Office of Enforcement, in both directions, when reporting violations surface in a fiduciary investigation.

The cost to the plan is the filing penalty. The 2025 Form 5500 instructions state that a penalty of up to $2,739 a day is assessable for each day a plan administrator fails or refuses to file a complete and accurate report. The DOL did not raise civil monetary penalty amounts for 2026, so the $2,739 figure still applies. Until a rejected filing is corrected, that exposure runs against the plan administrator.

The study also recommended that the Labor Secretary be authorized to assess part of the annual reporting penalty against the accountant when a report is rejected for a deficient audit or because the accountant did not meet the qualification standard. That is a recommendation in the 2015 report, not a rule in force.

Peer review and training

Two findings concern the profession directly. First, in four of the six strata, a substantial number of firms received an acceptable peer review report yet had deficiencies in the audit work EBSA reviewed. EBSA concluded that peer review was not an effective tool for identifying deficient plan audit work. Second, firms that belonged to the AICPA Employee Benefit Plan Audit Quality Center had fewer audit deficiencies, and as plan-specific training increased, the share of deficient audits decreased.

What this means for the file

Convert the failure list into the planning checklist:

1. Contributions. Test timeliness of every deferral deposit in the sample against the pay date, test compensation definitions, and test forfeiture use against the plan document.
2. Participant data. Agree participant account totals to the trust, test allocations, and test payroll data against the recordkeeper's records.
3. Controls and SOC 1 reliance. Identify the complementary user entity controls and test the plan sponsor's controls; a SOC 1 report on the recordkeeper does not replace them.
4. Party in interest. Obtain the sponsor's list of parties in interest and test for transactions with them.
5. Supplemental schedules and notes. Include the schedule of assets, the schedule of delinquent participant contributions, and every required footnote in the report package.
6. Report mechanics. Date, sign manually, and show the city and state.

Limits of what is public

The 2015 report reviews 2011 filings and measures them against the AICPA guide in effect for that year. SAS 136 changed the report form for periods ending on or after December 15, 2021, after the study.

CORAA drafts the contribution timing schedule, the participant roll-forward and the supplemental schedules from the plan's books for your review. You keep the testing, the judgments and the signature.

Sources

• DOL EBSA Office of the Chief Accountant, Assessing the Quality of Employee Benefit Plan Audits (May 2015): https://www.dol.gov/sites/dolgov/files/EBSA/about-ebsa/our-activities/resource-center/publications/dol-report-assessing-quality-of-employee-benefit-plan-audits-2015.pdf
• DOL EBSA, 2025 Instructions for Form 5500 (Penalties): https://www.dol.gov/agencies/ebsa/employers-and-advisers/plan-administration-and-compliance/reporting-and-filing/form-5500
• Mercer, Civil monetary penalties won't increase for 2026: https://www.mercer.com/insights/law-and-policy/civil-monetary-penalties-wont-increase-for-2026/
• 29 CFR 2520.103-1, eCFR: https://www.ecfr.gov/current/title-29/section-2520.103-1

CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error