ERISA section 103(a)(3)(C) audits and investment certifications

In this lesson you will

Explain the statutory basis for an ERISA section 103(a)(3)(C) audit
Identify what makes an institution and its certification qualify under 29 CFR 2520.103-8 and 2520.103-5
List management’s responsibilities when it elects a 103(a)(3)(C) audit
Perform the AU-C 703 procedures on certified investment information

The statute and the regulation

ERISA section 103(a)(3)(C) says the accountant's opinion need not extend to statements prepared by a bank or similar institution or insurance carrier that is regulated, supervised and subject to periodic examination by a state or federal agency, if those statements are certified by the institution as accurate and made part of the annual report. DOL regulation 29 CFR 2520.103-8 implements it: the IQPA's examination need not extend to statements or information prepared and certified by a qualifying bank, similar institution or insurance carrier in accordance with 2520.103-5.

Before SAS 136 this was called a "limited scope audit" and produced a disclaimer. AU-C 703 renamed it an ERISA section 103(a)(3)(C) audit and replaced the disclaimer with an opinion, because the election is no longer treated as a scope limitation.

Is the institution qualified?

Only a bank, trust company or similar institution, or an insurance carrier, regulated, supervised and subject to periodic examination by a state or federal agency, can certify. A recordkeeper or broker-dealer is not a qualified institution: DOL Advisory Opinion 93-21A concludes that "similar institution" in 29 CFR 2520.103-8 does not extend to securities brokerage firms. A certification from a recordkeeper, or a statement from a trustee that is not a regulated institution, does not support the election.

Is the certification valid?

Under 2520.103-5 the institution certifies the accuracy and completeness of the information by a written declaration signed by a person authorized to represent it. It is due within 120 days after the close of the plan year. A certification of "accuracy" alone, or one that is unsigned, does not meet the rule. The certification also covers only investment information. It never covers contributions, benefit payments, participant loans not held by the institution, or participant data.

Management's responsibilities

When management elects the audit, AU-C 703 requires the auditor to obtain management's acknowledgment that it is responsible for determining whether:

a 103(a)(3)(C) audit is permissible in the circumstances;
the investment information is prepared and certified by a qualified institution as described in 2520.103-8;
the certification meets the requirements of 2520.103-5; and
the certified investment information is appropriately measured, presented and disclosed under the applicable financial reporting framework.

Management's election does not reduce its responsibility for the financial statements, and the written representations repeat these points.

What the auditor still does

AU-C 703 requires the auditor to:

evaluate management's assessment that the certifying entity is a qualified institution;
identify which investment information is certified;
obtain and read the certification, compare the certified information to the financial statements and the ERISA-required supplemental schedules, and read the related disclosures for conformity with the framework; and
audit everything not covered by the certification based on assessed risk, including investments that are not certified.

The election does not reduce contribution, participant data, distribution or loan testing.

Common file mistakes

Accepting a recordkeeper's certification.
No evaluation of management's qualified-institution assessment.
Certified amounts that do not agree to Schedule H line 4i and nobody noticed.
Non-certified assets, such as a real estate interest or a private fund held outside the trust, left unaudited.

The limited scope audit guide and the limited scope engagement letter cover documentation.

Worked example

Ridgeview Dental Group 401(k) Plan: what the certification covers

Ridgeview Dental Group elects a 103(a)(3)(C) audit for its 2025 plan year. Net assets at December 31, 2025 are $14,200,000:

Item	Amount	Certified by trust company?
Mutual funds and collective trust held by the trust company	$13,100,000	Yes
Participant loans recorded by the recordkeeper	$620,000	No
Employer contribution receivable	$410,000	No
Limited partnership interest held outside the trust	$70,000	No

The trust company is a state-chartered bank subject to periodic examination, and its certification is signed by an authorized officer and states the information is accurate and complete. It is dated April 20, 2026, within 120 days of year-end.

Certified amount: $13,100,000. The team compares it to the statements and to Schedule H line 4i and reads the fair value disclosures.

Not certified: $620,000 + $410,000 + $70,000 = $1,100,000. Participant loans, the receivable and the partnership interest are audited under the risk assessment, because the certification does not cover them. The partnership interest is below performance materiality but still needs valuation evidence proportionate to its risk.

Contributions, benefit payments and participant data are tested as in any plan audit.

Self-check

Answer each question before you open the answer.

A plan’s recordkeeper, which is not a bank or insurance company, offers to certify investment balances. Can management elect a 103(a)(3)(C) audit based on it?
Show answer
No. Only a regulated bank, similar institution or insurance carrier can certify under 2520.103-8, and DOL Advisory Opinion 93-21A says brokerage firms are not similar institutions.
What must the certification state, and by when?
Show answer
It must certify the accuracy and completeness of the information in a written declaration signed by an authorized person, and it is due within 120 days after the plan year ends (29 CFR 2520.103-5).
Does a 103(a)(3)(C) election reduce testing of participant contributions?
Show answer
No. The certification covers only investment information held by the institution. Contributions, distributions, loans not certified and participant data are audited based on assessed risk.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error