401(k) Audit Requirements: Is Your Company Ready?

A 401(k) audit can be a challenge, but with the right preparation, you can get your company ready. If you’re the plan administrator or CFO, you might get questions from your TPA—or worse, a notice from the DOL. Suddenly, it’s time to prep for a 401(k) audit you didn’t even see coming.

401(k) audit readiness isn’t really optional. Missing the requirement comes with real penalties. But don’t panic! An audit doesn’t mean something is wrong. It’s a standard ERISA compliance requirement for plans above a certain size. It protects your employees who have retirement savings in the plan.

Key Takeaways

An audit doesn’t mean you did something wrong. It’s a routine part of ERISA compliance, based on account size.
The 2023 rule change shifted participant counting from eligible employees to employees with an account balance.
The 80/120 rule works both ways. If you’re growing, it can buy you time. But it can also lock you into a large plan filing if your count dips. This is especially important for sponsors near the 80/120 threshold.
The fines and fees for late filing are expensive, but you can voluntarily report a delinquent filing to avoid the fees.
Look for a CPA firm with EBP audit experience, DOL familiarity, and a partnership mindset year-round.

Why 401(k) Plans Require Independent Audits

The landscape of 401(k) audits can be confusing. This confusion is only compounded by the changing rules. The DOL changed the audit requirements under the Employee Retirement Income Security Act of 1974 (ERISA) in 2023, when the threshold rules shifted. So even sponsors who thought they knew the rules may be working with outdated information.

ERISA requires independent audits to protect plan participants. The DOL oversees business compliance and sets the filing requirements. Should your 401(k) plan be audited, they will verify that contributions are being handled correctly, investments are allocated to the right accounts, and that the plan is being administered per its own terms as well as the ERISA rules.

The term “audit” is what sometimes drives fear into the heart of plan administrators and HR managers, but it’s important to note—a 401(k) audit isn’t a tax audit. It’s not triggered by suspected non-compliance or wrongdoing. It’s a routine requirement based solely on the plan size.

The audit will result in a filing with the DOL (Form 5500). Under current standards, this includes an auditor’s opinion on the plan’s financial statements. The opinion piece is actually a very meaningful document that carries real weight.

The 100-Participant Threshold for 401(k) Plans

So, what triggers these audits? It’s purely a numbers issue. Once a plan reaches 100 participants (or more) with an account balance, the DOL requires the plan to undergo an independent audit. This has been the rule as of 2023, and it’s quite different from the old rule. The older rule was based on the number of employees eligible to participate, regardless of enrollment or their balance.

The new rule is based only on participants with an account balance. So, this covers active employees who are contributing, along with terminated employees, who may carry remaining balances. However, employees who are eligible but not enrolled and have no balance don’t count towards the 100 participant threshold.

From a practical point of view, this especially matters for companies close to the threshold. For example, a company with 150 eligible employees, but only 85 with account balances, may not trigger the audit requirement. Under the old rule, they would have.

The best way to stay on top of the requirement is to run your count at the beginning of each plan year. Don’t wait until you’re preparing your 5500 to figure out where you stand. Once you cross the threshold, the audit requirement is annual unless or until your participant count drops below the threshold. It doesn’t automatically reset after one year.

The 80/120 Rule: A 401(k) Audit Exception Worth Knowing

There is an exception to the audit requirements called the 80/120 rule, which many plan sponsors are unaware of. The rule is that if your participant count falls between the 80-120 range, you can file the same way you did the previous year.

So, if you filed as a small plan using Form 5500-SF last year, you can continue to do so, even if your count is now just over 100 (but not over 120). But the rule also applies in reverse. If you filed as a large plan (and had an audit last year), you must continue to do so, even if your count dipped below 100 over the course of the year.

The 80/120 rule is one of the most misunderstood aspects of 401(k) audit requirements.

To give you an example of the rule, say your plan had 95 participants last year, and you filed as a small plan. This year, your participant count has been upped to 108. Under the 80/120 rule, you can still file as a small plan this year. But if your participant count is over the 120 threshold next year, you will need to meet the audit requirement.

In the reverse, it also applies. If you filed as a large plan the prior year, you must continue to file as a large plan, even if your participant count has dropped into the 80-120 range. If you fall below 80 participants, you may file a small plan.

The bottom line is that sponsors who hover near the threshold need to track their participant count very carefully year over year. The 80/120 rule can buy you some extra time, but it’s not a permanent exemption.

The Current Audit Standard Under ERISA Section 103(a)(3)(C)

As of 2023, most 401(k) audits follow ERISA Section 103(a)(3)(C) methodology. If that term sounds like a bunch of gibberish, here’s what it means for you.

The ERISA standard replaces the old “limited scope” vs. “full scope” audit distinction. The DOL closed this standard because the older terminology often confused plan sponsors and created a loophole.

The old, limited scope audit standard meant auditors essentially disclaimed responsibility for investment information certified by the record keeper. In other words, a pretty significant portion of plan assets weren’t being examined.

In the new standard, auditors issue an opinion on the plan’s financial statements. Full stop. The DOL tightened up requirements to make sure auditors were examining the correct information and could stand behind their conclusions.

Record keepers, such as Fidelity, Vanguard, and Empower, still certify the completeness and accuracy of the investment transaction. This confirmation removes the auditor’s burden on investment testing. However, it doesn’t eliminate auditor responsibility.

For plan sponsors, this means that the audit your plan receives today is more robust, rigorous, and meaningful than what was required before 2023. The opinion that comes out of that audit carries more weight with the DOL, compared to before.

What Auditors Actually Review in a 401(k) Plan

Before we dive into the pitfalls and what can go wrong with your audit, it helps to understand what the auditors are actually looking at and how they work.

When an auditor assesses your 401(k), they typically test a sample of the participants. The number is usually around 25 people. They aren’t looking at every employee on the plan. This helps to keep the audit process manageable, without sacrificing the rigor of the audit.

What gets tested for those twenty-five 401(k) participants? There are a number of factors auditors assess.

Eligibility

Are the right employees being enrolled based on the plan’s age and service requirements (e.g., for a plan with a 3-month waiting period, they would look at when employees are being enrolled—if it’s the right time, or if there are some gaps)?

Deferrals

Does the percentage of withholdings from each paycheck match what’s actually deposited in the participant’s account?

Investment Allocations

Are contributions going to the investment vehicles that each participant actually selected? Are there any mismatches?

Distributions and Loans

Are hardship withdrawals, retirement distributions, and loans being processed correctly? Are they documented properly?

Contribution Timing

Are deposits reaching the plan within the DOL-required timeframes after each payroll run? (We’ll explore more about why this is important in the next section.)

When an auditor accesses information, they usually have read-only access to the 401(k) platform and pull reports directly from there. This methodology significantly reduces how much you have to manually pull and send out to the auditor.

In the audit response packet, you’ll need to include records of:

Payroll registers
Timecards
I-9 forms
HR documentation
Plan documents and adoption agreements (including elected provisions like eligibility rules, vesting schedules, and contribution structures)
Additional documents and specific requests from the auditor

It also matters if you’re a first-year or a returning client. Initial audits test at least one prior year to establish a baseline. So, first-year audits take a little longer. Expect the audit to take 4-5 weeks for straightforward plans and even longer when prior-year data is complex or spans multiple providers. Returning clients need only focus on the current year.

On your side of the audit, the plan administrator is the main point of contact. The audit also may require input from 401(k) committee members, including the CFO, HR, and relevant members of management. No individual employee involvement is required during an audit.

How to Get Ahead of Some Common 401(k) Audit Findings

For a plan administrator, knowing what auditors commonly find is one of the most useful things to know. The good news is that once you’re aware, most of these issues are preventable.

Untimely Contribution Deposits

This is the most common filing, especially for those going through an initial audit. The DOL’s expectation is that deposits should hit the plan as soon as administratively feasible after payroll withholding. But in practice, of course, delays happen. For example, a payroll staff member is on vacation, a process breaks down, or someone assumes someone else is handling it. Even a 10-day delay triggers a lost earnings penalty, and that must be paid back into the plan on behalf of the affected participants.

The best fix for this issue is to automate the deposit process, so that nothing depends on manual action or individual availability.

Deferral Errors

Another common issue is deferral errors. A participant may elect 5%, but only 4% is actually being withheld due to a payroll system mistake or error that slowly, quietly compounds over time.

Deferral issues are often caught during audit testing, but are avoidable with periodic internal reviews comparing deferral elections to actual withholdings.

Documentation Gaps

The biggest culprit for this issue is paper. Manual, paper-based systems are subject to all kinds of issues. Missing records slow the audit process way down and create compliance exposure.

Your best prevention move here is to make sure your payroll and 401(k) systems are integrated. Automating the data trail almost always reduces the risk significantly.

Provider Transition Complications

If you’ve changed payroll or 401(k) providers over the last 2-3 years, historical data can end up fragmented and harder to access. First-year audits are significantly more complex when your records span multiple systems.

The best practice is to flag any provider transitions to your auditor at the beginning of their work. This way, they can plan accordingly and watch for issues proactively.

Beat Filing Deadlines by Starting Earlier than You Think

The standard Form 5500 filing deadline is July 31st, annually for typical calendar year-end plans. The extension deadline is October 15th. It’s important to note that the extensions aren’t automatic. You must file for the extension to have it apply.

How bad is it to miss the deadlines? Fines apply if you miss the October 15th deadline, and they can be significant. The DOL can penalize you up to $2,739 per day for a late Form 5500 filing (there’s no maximum cap on that number either). The DOL has moved away from the informal $50,000 cap and now regularly imposes penalties of over $200,000 for filing as little as eight months late.

The IRS also imposes a penalty of up to $250 per day, capped at $150,000 per plan year. Both agencies—the IRS and the DOL—can impose penalties on the same missed filing.

The numbers are jarring, but there is a relief option. The DOL’s Delinquent Filer Voluntary Compliance Program (DFVCP) lets sponsors self-report before the DOL initiates contact. This can help turn a six-figure assessment into a more manageable resolution, so it’s important to be proactive.

If your plan uses a fiscal year-end of 6/30 or 9/30, then your deadline is 7 months after your fiscal year-end (or 9.5 months with an extension).

Keep in mind that most plans end with the year. Audit season typically starts in early April, and summer fills up fast. A 4-5 week audit timeline sounds manageable until you factor in document gathering, scheduling, and firm capacity. So, it’s advisable to engage with your auditor in Q1, rather than waiting for Q2, so the best firms aren’t booked up. If it’s spring, and you haven’t started yet, the time is now.

How to Find a CPA Firm That Does Employee Benefit Plan Audits

Not every CPA firm can handle EBP audits. It’s a specialization that requires specific expertise. The difference between a generalist firm and a dedicated EBP practice is quickly evident in both the process and the outcome.

So, look for a partner firm that’s well-experienced with the EBP audit process. It isn’t a time when you want to go with a firm that occasionally does them as a favor for existing clients. The firm needs to have a deep familiarity with DOL requirements and ERISA Section 103(a)(3)(C) standards. They should also have experience with plans of your size and complexity.

Clear, proactive communication should happen throughout the entire process, between you and your partner firm; you aren’t just looking for a report that’s handed over at the end. You need a management-level communication letter that summarizes the findings and recommendations, not just checks of a compliance action on a to-do list.

At Chortek, we have the experience, year-round availability, and support to give you proactive assistance. We’re not a pop-up firm that only helps during peak audit season. We know that proactive check-ins on prior findings and corrections are crucial. If you need additional resources, we can help.

We have an advisory mindset. Our goal is partnership and long-term improvement, not just annual compliance delivery. We’ll help you determine if your plan requires an audit and help you get prepared if it does.

To learn more, contact the Chortek team. We’ll help you determine what your plan needs to stay audit-compliant so you’re never caught off guard.