Navigating Your 401(k) Plan Audit: Best Practices for a Painless and Profitable Process

Under the Employee Retirement Income Security Act (ERISA), “large” retirement plans must attach an independent auditor’s report to their annual Form 5500 filing. Historically, a plan was considered “large” if it had 100 or more eligible employees, regardless of whether they actually participated in the plan.

However, recent legislative changes (starting with the SECURE 2.0 Act) have altered this landscape significantly. The threshold is now based on the number of participants with account balances at the beginning of the plan year.

• The 80-120 Rule: If your plan fluctuates around the 100-participant mark, the DOL offers a transition rule. If you filed as a “small plan” last year, you can generally continue to do so until your participant count (with balances) reaches 121 on the first day of the plan year.

• Best Practice: Don’t wait until the end of the year to check your participant count. Work with your Third-Party Administrator (TPA) in Q4 to project your participant numbers for the upcoming year so you can budget and plan for an audit well in advance.

A 401(k) audit involves multiple parties: your internal HR/payroll team, your TPA, your recordkeeper (custodian), and your independent auditor. When communication is siloed, document requests get duplicated, lost, or ignored.

• Best Practice: Designate one internal project manager—typically a Controller, HR Director, or CFO—to be the liaison for the audit. Furthermore, grant your auditor direct, “read-only” access to your recordkeeper’s online portal. This allows the audit team to pull standard financial reports, trust statements, and compliance testing results themselves, saving your internal team dozens of hours.

The foundation of any ERISA audit is the Plan Document. Auditors are required to test whether your company’s actual day-to-day operations match the legal text of your plan.

• Best Practice: Create a centralized, secure digital folder containing your permanent plan documents. This should include:

  • The base Plan Document and the current Adoption Agreement.

  • All executed plan amendments.

  • The latest Summary Plan Description (SPD).

  • IRS Determination or Opinion Letters.

  • Minutes from your retirement plan committee meetings.

The most common—and costly—errors uncovered during a 401(k) audit revolve around payroll. Specifically, discrepancies often arise in how “eligible compensation” is defined in the plan document versus how it is coded in your payroll software.

For example, does your plan document state that bonuses, overtime, or commissions are excluded from 401(k) deferrals? If so, is your payroll system actually excluding them?

• Best Practice: Before the audit begins, conduct a miniature internal review. Pull a payroll summary for the year and compare the gross wages to the plan’s definition of eligible compensation. Ensure that all eligible employees were offered entry into the plan on the correct dates and that employer matching contributions were calculated using the correct formulas.

Your TPA and recordkeeper handle the bulk of your plan’s daily transactions. Because your auditor cannot audit those massive financial institutions directly, they rely on a System and Organization Controls (SOC 1) Report.

• Best Practice: As a plan sponsor, it is your fiduciary duty to obtain and review the SOC 1 reports from your service providers annually. Your auditor will ask for these reports, as well as documentation showing that your management team reviewed them and implemented any required “User Entity Controls” (the internal steps your company must take to ensure the provider’s systems work correctly).

The Department of Labor is notoriously strict about how quickly employee 401(k) contributions are deposited into the plan trust. The rule states that deferrals must be deposited “as soon as administratively feasible.”

• Best Practice: During the audit, the CPA will test a sample of payroll cycles to track the exact number of days between the pay date and the date the funds hit the plan trust. Establish a rigid, documented schedule for processing deferrals (e.g., “Funds are always wired within 48 hours of payroll processing”) and stick to it year-round. If you have late deposits, work with your advisor to calculate lost earnings and self-correct the error before the auditor finds it.

Choosing the right auditor makes all the difference. You need a firm with deep technical expertise in ERISA compliance, not just a generalist who views your benefit plan as an afterthought to your corporate tax return.

At Wilson & Associates CPA, we specialize in high-net-worth accounting and complex corporate compliance. We provide comprehensive, white-glove 401(k) Plan Audit services to growing businesses across San Diego, Los Angeles, and Orange County. We don’t just check the boxes; we identify operational weaknesses, optimize your internal controls, and ensure your fiduciary duties are flawlessly executed.

Proactive financial strategy is the key to protecting your business. Schedule a Consultation Today to discuss your 401(k) audit needs with our expert team.