What it is
A plan audit starts with a few decisions that shape the rest of the work: whether the plan needs an audit at all, whether the plan administrator has elected the ERISA section 103(a)(3)(C) limitation (formerly called a limited-scope audit), and which service organizations hold the data and assets. This memo documents those decisions and the risk assessment that follows.
It covers the audit requirement and participant count, the type of audit and the certification conditions in 29 CFR 2520.103-8, understanding the plan and its documents, service organizations under AU-C 402, risks specific to plan audits including late participant contributions, plan-level materiality, planned procedures, the Form 5500 timeline and team independence.
When to use it
- Planning the audit of a 401(k), 403(b) or other defined contribution plan.
- Documenting the audit type decision and the reliance on certified investment information.
- Taking over a plan audit from another firm.
What’s inside
- Plan and engagement facts and the audit requirement check
- Type of audit: 103(a)(3)(C) election, certification and assets outside it
- Understanding the plan, service organizations and reliance
- Risk assessment table, materiality, planned procedures and timeline
- Team independence, communications and approval block
Standard cited
This template follows AU-C 703 / ERISA 103(a)(3)(C). It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What is an ERISA section 103(a)(3)(C) audit?
It is an audit in which the plan administrator elects that the auditor need not audit investment information prepared and certified by a qualifying bank, similar institution or insurance carrier. The auditor still audits the rest of the financial statements. The older name is a limited-scope audit. Use the report illustrations in AU-C 703 for the wording.
Which plans need an audit?
Generally plans with 100 or more participants at the beginning of the plan year. Under the 80-120 participant rule, a plan with 80 to 120 participants may file the same type of return it filed for the prior year. For defined contribution plans, plan years beginning in 2023 or later count only participants with account balances at the beginning of the plan year.
Why do late participant deposits matter?
Participant contributions become plan assets as of the earliest date they can reasonably be segregated from the employer’s general assets (29 CFR 2510.3-102). Depositing late is a prohibited transaction that is reported on Form 5500 and may require correction and lost earnings.
Related templates
- Contributions and Remittance Testing Workpaper (Retirement Plan)
- Employee Benefit Plan Participant Data Testing Workpaper
- Audit Planning Memo (AU-C 300)
Last updated 11/05/2026. All free templates.