A plan can hold the right assets, report the right balances and still fail, because it was not run the way its document says. The IRS calls that an operational failure, and the same fact pattern can also be a prohibited transaction. An auditor who tests balances only will miss both. This guide covers the operational tests that belong in a 401(k) plan audit file: whether the plan document was followed, the three areas where the IRS's own fix-it guides show the usual failures, and how the correction programs affect what the auditor should expect to see.
What the IRS means by operational failure
The IRS's overview of the Employee Plans Compliance Resolution System, or EPCRS, describes the program as a way for sponsors to correct mistakes and avoid disqualification, governed by Revenue Procedure 2021-30. It lists the failures covered, including operational failures, meaning the plan was not run according to its terms, and plan document problems such as failing to update the document for changes in law. It also covers participant loan problems: defaulted loans, loans over plan limits and missing spousal consent.
Three programs sit under EPCRS:
- Self-Correction Program (SCP). The sponsor fixes eligible failures without contacting the IRS or paying a fee.
- Voluntary Correction Program (VCP). Before an audit, the sponsor submits a request, pays a user fee and gets IRS approval for the corrections.
- Audit Closing Agreement Program (Audit CAP). The sponsor corrects failures while the plan is under audit and pays a negotiated sanction.
Self-correction depends on the sponsor having established practices and procedures, formal or informal, that promote compliance. The IRS states that the plan document alone does not count as evidence of them. Significant operational failures can be self-corrected within two years after the end of the plan year in which they occurred. SCP is not available for failures such as not adopting a written plan.
When the auditor finds an operational failure, the question is not only the dollar effect but whether the sponsor has the procedures that allow correction through the cheaper route.
Test 1: the plan document against the practice
Start with the current plan document and every amendment. For each key term on eligibility, deferrals, match, vesting, loans, hardships and distributions, record how the payroll or recordkeeping system implements it and which test covers it.
Test 2: deferral deposit timing
The IRS fix-it guide on late deposits says the plan terms come first. Some plan documents set a specific deposit time, and missing that schedule is an operational mistake. The guide gives the example of an employer that deposited 30 days after each payday when its plan required deposits within five days.
The Department of Labor requires employers to deposit deferrals as soon as they reasonably can. The IRS page says that in no event can the deposit be later than the 15th business day of the following month, and states that this is not a safe harbor but the maximum deadline. For small plans, the Department provides a seven-business-day safe harbor for plans with fewer than 100 participants.
A late deposit may be an operational mistake and also a prohibited transaction, which the IRS describes as a transaction between a plan and a disqualified person that the law prohibits. The guide states that an employer is a disqualified person, that the initial excise tax is 15 percent of the amount involved for each year, that an additional 100 percent tax may apply if the transaction is not corrected, and that a prohibited transaction cannot be corrected under EPCRS. The Department of Labor's Voluntary Fiduciary Correction Program is the route the guide names for resolving it. Correction means depositing the missed deferrals with lost earnings.
Audit procedure. Select payroll dates across the year. Compare the withholding date, the deposit date and the plan's stated deadline, and compute the lag. Where it exceeds the deadline, determine whether lost earnings were calculated and deposited. See participant data, contributions and late deposits and ERISA prohibited transactions.
Test 3: ADP and ACP
The IRS fix-it guide on ADP and ACP failures starts with the data. Sponsors should independently confirm that highly compensated and nonhighly compensated employees are classified correctly, including everyone eligible to defer, even those who did not. The guide points to prior-year compensation and to 5 percent owners, including family members, who may have different last names. If incorrect data was used, the tests may need to be rerun.
Corrections include qualified nonelective contributions to nonhighly compensated employees, which go to all eligible nonhighly compensated employees at the same percentage, and the one-to-one method, where excess contributions with earnings are distributed to highly compensated employees and an equal amount is contributed as a QNEC and allocated by compensation to eligible nonhighly compensated employees.
The deadlines are 2.5 months after the end of the plan year being tested, to correct by distribution or recharacterization without the excise tax, and 12 months, after which the cash or deferred arrangement loses qualified status and the entire plan may lose its tax-qualified status. If excess contributions are not distributed or recharacterized within 2.5 months, the employer owes a 10 percent excise tax. No tax applies if corrective QNECs are made within 12 months under current-year testing and are enough to pass.
Audit procedure. Re-perform the classification of highly compensated employees from payroll and ownership records, compare it with the testing vendor's census, and trace any refund or QNEC to the trust, checking dates against the 2.5-month and 12-month limits.
Test 4: hardship distributions
The IRS fix-it guide describes the requirement as an immediate and heavy financial need, with the distribution limited to the amount needed. The employer decides based on the facts and circumstances, and may rely on the employee's written statement that the need cannot be met from other sources unless it knows the statement is wrong. The guide lists safe harbor reasons, including medical expenses, costs of buying a principal residence, tuition for the next 12 months, payments to prevent eviction or foreclosure, funeral expenses and certain repairs to the principal residence. It tells sponsors to keep records of the information used to decide eligibility and to confirm the amount was necessary, and to look for abuse such as concentrated requests from one group or many near-identical requests.
Audit procedure. Confirm from the document that hardships are allowed. List every hardship distribution in the year. For a sample, inspect the application, the reason against the plan's criteria, the supporting documents and the amount. Look for patterns in the full list, not only the sample.
Worked example
Kestrel Logistics has a 401(k) plan with 140 participants and a plan document requiring deposits within five business days of payday.
- Deposits. Of 26 payrolls tested, 9 were deposited between 8 and 14 business days after payday. All 9 are beyond the plan's five-day rule. The seven-business-day safe harbor is not available because the plan has 140 participants. None crossed the 15th business day of the following month.
- Evaluation. Each late deposit is an operational failure under the plan terms. The auditor asks whether lost earnings were computed and deposited and whether the sponsor reported or intends to use the Department's correction program. The file records the amounts.
- ADP. The auditor re-performs HCE classification and finds that a 5 percent owner's daughter was coded as nonhighly compensated. Rerunning the test produces a failure. The sponsor's correction, a QNEC, was deposited eight months after year-end, which is within 12 months but beyond 2.5 months. The 10 percent excise tax does not apply if the plan uses current-year testing and the QNEC made within 12 months is enough to pass the test. The auditor confirms the testing method in the plan document and recomputes whether the QNEC was sufficient, and discusses any remaining exposure with the sponsor's counsel.
- Hardships. Of 11 hardship distributions, 3 lack documentation of the need. The auditor asks for the records and written procedures.
What the report and communications say
Findings reach those charged with governance under AU-C 260 and, where noncompliance is identified, AU-C 250. The file records the evaluation of each matter. See also what EBSA looks for.
Where CORAA fits
CORAA prepares ready-to-review audit files for US CPA firms, including deposit lag schedules and plan-term-to-test matrices. The firm keeps the client, the review and the signature. See /us.
Sources
- IRS, EPCRS overview: https://www.irs.gov/retirement-plans/epcrs-overview
- IRS, 401(k) Plan fix-it guide, you haven't timely deposited employee elective deferrals: https://www.irs.gov/retirement-plans/401k-plan-fix-it-guide-you-havent-timely-deposited-employee-elective-deferrals
- IRS, 401(k) Plan fix-it guide, the plan failed the 401(k) ADP and ACP nondiscrimination tests: https://www.irs.gov/retirement-plans/401k-plan-fix-it-guide-the-plan-failed-the-401k-adp-and-acp-nondiscrimination-tests
- IRS, 401(k) Plan fix-it guide, hardship distributions weren't made properly: https://www.irs.gov/retirement-plans/401k-plan-fix-it-guide-hardship-distributions-werent-made-properly
Part of CORAA University · US GAAP for private companies: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error