- Identify the participant data elements that drive plan amounts
- Test eligibility and entry dates against the plan document
- Test allocations of contributions and earnings to participant accounts
- Use service organization reports without skipping sponsor-side controls
Why participant data matters
Almost every amount in a plan's financial statements comes from participant data: contributions depend on compensation and elections, vesting depends on service, distributions depend on termination dates and balances, and a defined benefit plan's obligation depends on census data the actuary receives. AU-C 703 also requires management to acknowledge responsibility for maintaining sufficient records of each participant to determine the benefits due or which may become due. If the data is wrong, the plan pays the wrong people the wrong amounts.
The data elements
For each participant selected, practitioners test the elements that feed plan calculations:
- Demographics: date of birth, date of hire, termination and rehire dates, employment status.
- Compensation: gross pay and the components the plan includes or excludes, such as bonuses, overtime, commissions and pre-tax benefit deductions.
- Elections: deferral percentages or amounts, Roth designations, automatic enrollment defaults and opt-outs.
- Service: hours of service or elapsed time for eligibility and vesting.
Source evidence is personnel files, payroll registers and election records. The recordkeeper's data is what you test against, not evidence in itself.
Eligibility and entry dates
The plan document sets eligibility (age and service) and entry dates. The Internal Revenue Code (section 410(a)) caps the age and service condition at age 21 and one year of service, with a year of service defined as a 12-month period with at least 1,000 hours of service, subject to limited exceptions such as the long-term part-time employee rules. Plans may be more generous. Test both directions:
- Late entry or exclusion: an eligible employee not given the chance to defer, or not auto-enrolled on time. This is an operational failure.
- Early entry: an ineligible employee allowed to defer or receive employer contributions.
For a sample of employees from the full payroll population (not just from the recordkeeper's participant list), compute the eligibility date from hire date, age and service, and compare it to the actual entry date. Sampling from the recordkeeper list cannot find employees who should be there but are not.
Allocations
For a sample of participant accounts, trace contributions from payroll to the account, recompute the employer match or profit sharing allocation under the plan formula, and test that investment earnings were allocated in proportion to balances in each fund. For daily-valued plans, the recordkeeper's SOC 1 report usually addresses earnings allocation; your work then focuses on the complementary user entity controls at the sponsor, such as the review of payroll files before transmission.
Vesting and forfeitures
Recompute vesting percentages for terminated participants under the plan's schedule, using years of vesting service. Test forfeiture balances and how they were used during the year (to pay expenses or reduce employer contributions, as the plan allows) and whether they were used timely under the plan's terms.
Using SOC 1 reports
Recordkeepers and payroll providers issue SOC 1 type 2 reports. Read the report, evaluate the opinion and exceptions, check the period of coverage against the plan year and any bridge letter, and map each complementary user entity control to the sponsor's procedures. See the SOC 1 review and CUEC mapping template.
Common file mistakes
- Eligibility samples drawn from the recordkeeper's list.
- Compensation tested at gross wages when the plan excludes bonuses.
- No test of rehired employees, who often get the wrong eligibility or vesting service.
- SOC 1 report filed with no CUEC evaluation.
The participant data testing workpaper and the plan operational compliance guide cover the tests.
Sandstone Medical Group 401(k) Plan: eligibility from the payroll file
Sandstone Medical Group's plan allows entry on the first day of the month after an employee reaches age 21 and completes 3 months of service, and auto-enrolls at 4 percent. The team samples 25 employees from the full 2025 payroll register of 640 employees.
Results:
- 21 entered on the correct date.
- 2 were hired in 2025 and had not yet met the 3-month requirement at year-end; correctly not enrolled.
- 1 employee, hired January 13, 2025, became eligible April 13, 2025 and should have entered May 1, 2025. The recordkeeper enrolled her on August 1, 2025. Missed auto-enrollment deferrals for May through July: 4 percent x $15,600 compensation = $624, plus the related employer match.
- 1 rehired employee was treated as new, although the plan credits prior service. He should have entered on his rehire date of March 3, 2025, but entered June 1, 2025.
Two exceptions in 25 items is an 8 percent sample rate, suggesting a process problem with enrollment feeds. The team communicates a reportable finding, management corrects under the IRS program, and the team extends testing of new hires and rehires. Because the missed amounts are small relative to net assets, there is no material misstatement, but the operational failures threaten the plan's tax-qualified status if left uncorrected.
Self-check
Answer each question before you open the answer.
Why should eligibility samples be drawn from payroll rather than the recordkeeper’s participant list?
Show answer
Because the error that matters most is an eligible employee who was left out, and a sample from the participant list cannot find someone who is not on it.
What participant record responsibility does AU-C 703 ask management to acknowledge?
Show answer
Maintaining sufficient records with respect to each participant to determine the benefits due or which may become due, as part of administering the plan in conformity with its provisions.
A plan excludes bonuses from compensation. The sponsor deducts deferrals from bonuses. What is the issue?
Show answer
An operational failure: deferrals were taken on pay the plan excludes. It must be corrected and evaluated as a reportable finding.
Use it on the file
- TemplateEmployee Benefit Plan Participant Data Testing Workpaper
- GuidePlan Document and Operational Compliance Testing in a 401(k) Audit
- TemplateSOC 1 Report Review and User Entity Controls Mapping
- GuideReviewing SOC Reports: Complementary User Entity Controls and the User Auditor's Work
- Template401(k) and ERISA Defined Contribution Plan Audit Checklist
Sources
- AICPA, SAS No. 136 (AU-C 703), Forming an Opinion and Reporting on Financial Statements of Employee Benefit Plans Subject to ERISA
- DOL EBSA, 2025 Instructions for Form 5500
Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error