401(k) and 403(b) plans · ERISA
Not sure whether your plan needs an audit?
The answer turns on two things, not one: the participant count at the beginning of the plan year, and the category the plan filed under last year. Checking only the first is what leads people to the wrong conclusion in both directions.
Generally, a plan with 100 or more participants at the beginning of the plan year is a large plan: it files the long-form Form 5500 with Schedule H and attaches the report of an independent qualified public accountant. For plan years beginning on or after January 1, 2023, a defined contribution plan counts only participants with account balances — not everyone eligible — for purposes of the filing category and the audit requirement.
But the count alone does not settle it. Under 29 CFR 2520.103-1(d), a plan whose count at the beginning of the plan year falls between 80 and 120 may elect to file in the same category it used for the prior year. That election is available in any year the count stays within the band — it is not a one-time deferral, and a plan can remain on the small-plan category for more than one year while it sits in that range. Above 120 the election is not available.
The small-plan audit waiver (29 CFR 2520.104-46) is available only to small plans and carries its own conditions; a large plan cannot rely on it and cannot use Form 5500-SF.
Plans cross this line for an ordinary reason: they grow. Because the classification depends on both the current count and the prior-year filing, it is worth confirming rather than assuming — in either direction. If a return was filed in the wrong category, the correction steps available depend on the facts and on the filing status.
What the audit covers
- Full-scope and ERISA Section 103(a)(3)(C) engagements under SAS 136 — the latter a distinct form of ERISA audit, not a limited scope
- Participant eligibility, deferral elections, and headcount analysis
- Employee and employer contributions, match, and profit sharing
- Timeliness of remittances — payroll-to-custodian analysis across the available population, evaluating exceptions for potential late deposits and prohibited transactions
- Distributions, participant loans, hardship distributions, required minimum distributions, forfeitures, and vesting
- SOC 1 report evaluation and reliance; investment certification assessment
- Form 5500 reporting and coordination, including amended returns
- Plan corrections — missed deferrals and corrective QNECs, late loan repayments, conversion accounts, and operational compliance with the plan document, coordinated with recordkeepers, third-party administrators, custodians, and ERISA counsel
- Plan life-cycle events: amendments, mergers, service-provider conversions, terminations, and final Form 5500 filings
If your custodian sends a certification
An ERISA §103(a)(3)(C) audit is an ordinary, common form of plan audit — not a lesser one, and not a scope limitation. What it requires is a certification that actually qualifies, and a surprising number of the certifications that arrive each year do not. The election itself belongs to the plan administrator: the DOL said so in its information letter of May 17, 2002, and it is the administrator, not the custodian and not the auditor, who determines that the conditions are satisfied. Our role is to evaluate whether they are.
Five things decide it, and each one has failed a real engagement:
- Who certified. A bank, a similar institution such as a trust company, or an insurance company — regulated, supervised, and subject to periodic examination by a state or federal agency (29 CFR 2520.103-8). Recordkeepers, broker-dealers, and investment companies are not qualified institutions, though an affiliated trust company may be.
- What was certified. Both the completeness and the accuracy of the investment information (29 CFR 2520.103-5). One without the other does not qualify, and that omission is common enough to be worth reading for every year.
- Who signed it. A person authorized to represent the institution. Where the certification carries no explicit statement of authority, the question has to be resolved before the election is made rather than after the report is drafted.
- What it covers. The entire period under audit and all of the investments. A change of custodian mid-year is where coverage most often falls through the gap between two institutions, each assuming the other certified.
- What it takes back. Disclaimer language — values drawn from sources believed reliable, prices that may be stale, values that are not what an asset would sell for — can contradict the assertion the certification is supposed to make.
One point is worth stating plainly because it is where plan administrators are most often surprised: a proper certification does not do the valuation work. Certifying institutions generally do not perform the fair value analysis GAAP requires. For investments without a readily determinable fair value, the trust statement is usually passing through a number from the fund or a third party, which may not be fair value at the plan’s year end. That analysis remains management’s responsibility whichever form of audit is elected, and where investments turn out to be improperly certified, they are audited.
The AICPA Employee Benefit Plan Audit Quality Center publishes an assessment tool that walks plan management through each of these conditions and records the conclusion. As a member firm we provide it and work through it with the administrator, so the election rests on a documented determination rather than an assumption. Note also that a §103(a)(3)(C) audit is not available to plans that file Form 11-K with the SEC.
What a first-year audit looks like
| Now | A short call. We confirm the count on the filed return against the recordkeeper’s records and the prior-year filing category, and establish whether a proper certification from a qualified institution is available — and whether plan management intends to elect an ERISA §103(a)(3)(C) audit. That election belongs to the plan administrator; our role is to evaluate whether the conditions for it are met. |
|---|---|
| Week 1 | Engagement letter signed. The request list is issued and we go directly to the recordkeeper for trust reports, the SOC 1 Type 2 report, and the plan document with amendments. We coordinate directly with the recordkeeper and TPA where authorized; management remains responsible for the financial statements, the Form 5500, and written representations. |
| Weeks 2–5 | Fieldwork: participant data and eligibility, contributions and their remittance timing, distributions, participant loans, and investment balances. A first-year audit also covers opening balances that were not previously audited. |
| Weeks 6–7 | Draft financial statements, the supplemental schedules Schedule H requires, and the accountant’s report. You review; we finalize. |
| Then | Your TPA files the Form 5500 — long form, Schedule H, audit report attached. We coordinate directly with the recordkeeper so the return and the report agree line for line. |
A typical target is six to eight weeks from signature to a signed report, once complete records are available — subject to third-party response times and the resolution of any matters identified along the way.
Why this firm
- Membership in the AICPA audit-quality centre for employee benefit plans
- An unusual dual perspective: an experienced plan auditor who has also served as trustee of a 401(k) plan with more than 150 participants
- Contribution, remittance-timeliness and participant-data testing scaled to the plan, with automated reconciliation and exception reporting where the records support it
- Every hour of fieldwork performed by a licensed CPA — nothing delegated to staff auditors or CPA candidates — with a documented second-CPA review before any report is released
- A risk-based approach built around the plan’s actual structure — defined contribution, defined benefit, or health and welfare — rather than a single checklist applied to all of them
Where the firm is lean on headcount it makes up for it in technology: modern, cloud-based audit software and data analytics carry the testing and documentation work, so CPA time goes to judgment and communication instead of paperwork. That is what lets one experienced CPA cover the ground a larger team would.
While Texas is home, the practice is borderless — plan sponsors are served nationwide, wherever they are located.
What it costs
The fee depends on the form of ERISA audit performed, the size and complexity of the plan, the condition of the records, the additional procedures a first-year audit requires, the timing, and how much coordination with the recordkeeper and third-party administrator is expected. We will not guess a number before those are known.
Note that an ERISA §103(a)(3)(C) audit is not a lesser or limited-scope engagement. Under SAS 136 it is a distinct form of ERISA plan audit with its own reporting, available when plan management elects it and a qualified institution has properly certified the investment information.
What settles it
A participant count cannot be confirmed from a public filing alone. What settles it is the participant census behind line 6g(1) and the most recent trust or custodial statement — either from you, or sent directly by your recordkeeper.
Send those documents securely — no account, no registration, and nothing sensitive traveling as an email attachment. If the count turns out to be a keying error, or that the prior-year filing category permits the election, we will explain the basis and recommend confirming the filing position with your TPA or ERISA counsel.