A limited-scope audit does not shrink the audit to a review of the investment statement. It removes one block of information from the audit and leaves everything else in place. Contributions, benefit payments, participant data, loans, and the supplemental schedules stay in scope in full. This guide covers where the exclusion comes from, what the certification must say, what the Form 5500 asks you to report, and how the report reads. For plan-size thresholds and the wider audit picture, start with the 401(k) audit requirements guide and the Form 5500 filing guide.
The statute and the two regulations
ERISA section 103(a)(3)(C) provides that the independent accountant's examination and report need not cover statements or information that a bank, similar institution, or insurance carrier prepares and certifies. Two DOL regulations in 29 CFR Part 2520 apply it.
29 CFR 2520.103-8 applies to a plan, trust, or other entity whose assets are held in whole or in part by a bank, similar institution, or insurance carrier. The institution must be regulated, supervised, and subject to periodic examination by a State or Federal agency. The accountant's examination can omit the statements or information that institution certifies about the assets it holds. The information must be prepared and certified in accordance with 29 CFR 2520.103-5.
29 CFR 2520.103-12 is a separate relief for plans invested in a 103-12 investment entity. The plan reports the current value of its investment or units of participation. The entity files its own Form 5500 with an audit by an independent qualified public accountant, and the plan's audit does not extend to the information the entity files directly with the Department. The entity must hold assets of two or more plans that are not members of a related group. The regulation does not reach insurance company pooled separate accounts or bank common or collective trusts.
Who qualifies as a certifying institution
The Form 5500 instructions state that "similar institution" does not extend to securities brokerage firms, citing DOL Advisory Opinion 93-21A. Investments held at a broker-dealer therefore fall outside 103-8 relief, and the audit covers them in full. This is the first check on any engagement that proposes the limited-scope route, because a custodian on the account statement is not enough. The holder must be a regulated bank, trust company, or insurance carrier.
What the certification must contain
29 CFR 2520.103-5 sets the certification requirements:
- The entity provides a written declaration signed by a person authorized to represent it.
- The certification attests to the accuracy and completeness of the information. The regulation's sample certification reads "complete and accurate."
- The information covers items such as asset statements, unit values, identifying numbers, and transaction listings.
- The entity transmits it within 120 days after the close of the plan year.
A certification that omits the completeness and accuracy statement, or that covers only a year-end balance while the plan also reports investment activity, leaves part of the investment information uncertified. Uncertified information is audited.
The election belongs to the plan administrator
The plan administrator decides whether to elect a 103(a)(3)(C) audit. The AU-C 703 report states that the election does not change management's responsibility for the financial statements. Under the standard, management determines that the election is permissible and that the institution meets the regulation, and the auditor evaluates that determination. Document both in the engagement file before fieldwork starts.
What the Form 5500 requires
The Schedule H instructions (line 3b) have the administrator check "DOL Regulation 2520.103-8" or "DOL Regulation 2520.103-12(d)", or both, when the accountant performed a 103(a)(3)(C) audit. If neither applies, the administrator checks the third box. The administrator must also check the opinion type on line 3a. The instructions are explicit that neither regulation exempts the administrator from engaging an independent qualified public accountant or from attaching that accountant's report to the Form 5500.
Line 3a treats an unmodified opinion on a 103(a)(3)(C) audit as an unmodified opinion under SAS 136. A plan with no modifications checks the unmodified box and the 103-8 box together.
What you still audit
Everything outside the certification is audited under the full standard. In practice that is:
- Contributions. Employee deferrals, employer match, and nonelective contributions recalculated against the plan document and payroll records. See participant data, contributions and late deposits for the testing detail.
- Participant data. Eligibility, compensation, vesting, and allocations to participant accounts, reconciled to the trust totals.
- Benefit payments and loans. Authorization, calculation, and compliance with plan terms.
- Uncertified investment items. Any investment, transaction, or income line the institution did not certify.
- Supplemental schedules and the 5500. The schedule of assets held at end of year, the schedule of delinquent participant contributions, and the draft Form 5500 against the financial statements.
What the DOL found when the limited scope hid the rest of the audit
The 2015 EBSA Office of the Chief Accountant report on plan audit quality reviewed 2011 filings. It reported that limited-scope audits rose from 48 percent of the audit population in 2001 to 83 percent in 2013. It also found that almost 60 percent of the limited-scope audits in the study contained major GAAS deficiencies in areas unrelated to investments, such as contributions, participant data, benefit payments, and internal controls. The report named one cause: plan auditors, knowing a limited-scope audit was being performed, were not as focused on all relevant audit areas. It recommended amending ERISA to repeal the exemption. The exemption remains in the statute. The practical lesson: the limited scope is a reason to put more attention on the non-investment areas, not less. The full findings are in what EBSA looks for in plan audits.
How the AU-C 703 report reads
SAS No. 136 (AU-C 703) applies to audits of periods ending on or after December 15, 2021. For a 103(a)(3)(C) audit it changes the report in three ways:
- A "Scope and Nature of the ERISA Section 103(a)(3)(C) Audit" section states that management elected the audit type after determining it was permissible, obtained a certification from a qualified institution, and that the audit did not extend to the certified information beyond obtaining and reading the certification, comparing it with the related financial statement information, and reading the related disclosures.
- The opinion has two parts. Published reports show the wording: the amounts and disclosures other than those agreed to or derived from the certified investment information are presented fairly in all material respects in accordance with GAAP, and the information related to assets held by qualified institutions agrees to, or is derived from, in all material respects, the information certified by institutions that management determined meet the requirements of ERISA section 103(a)(3)(C).
- The election is not a scope limitation, so it does not by itself produce a disclaimer. The auditor still issues a qualified, adverse, or disclaimer opinion if the audit results support one.
A file checklist for the engagement
- Management's written determination that the election is permissible and that each certifying institution meets 2520.103-8.
- The signed certification from each institution, with the complete-and-accurate statement and the covered periods.
- A tie-out of the certified information to the financial statements and to the disclosures.
- A list of any investment information not covered by the certification, with the audit procedures performed.
- The Form 5500 Schedule H line 3a and 3b selections agreed to the report.
CORAA prepares the investment tie-out, the contribution recalculation, and the schedule drafts from the client's records so the file reaches you ready to review. You decide the opinion and you sign.
Sources
- 29 CFR 2520.103-8, eCFR: https://www.ecfr.gov/current/title-29/section-2520.103-8
- 29 CFR 2520.103-12, eCFR: https://www.ecfr.gov/current/title-29/section-2520.103-12
- 29 CFR 2520.103-5, eCFR: https://www.ecfr.gov/current/title-29/section-2520.103-5
- 29 CFR 2520.103-1, eCFR: https://www.ecfr.gov/current/title-29/section-2520.103-1
- DOL EBSA, 2025 Instructions for Form 5500 and Schedule H: https://www.dol.gov/agencies/ebsa/employers-and-advisers/plan-administration-and-compliance/reporting-and-filing/form-5500
- DOL EBSA Office of the Chief Accountant, Assessing the Quality of Employee Benefit Plan Audits (May 2015): https://www.dol.gov/sites/dolgov/files/EBSA/about-ebsa/our-activities/resource-center/publications/dol-report-assessing-quality-of-employee-benefit-plan-audits-2015.pdf
- RSM US, SAS 136 changes to the auditor's report: https://www.rsmus.com/insights/financial-reporting/sas-136-changes-to-the-auditors-report
- Humboldt State University Foundation 403(b) DC Plan audited financial statements (published ERISA 103(a)(3)(C) report): https://www.humboldt.edu/sites/default/files/research/2025-04/hsufoundation403bplanfs.pdf
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error