An employee benefit plan audit is triggered by a headcount, and the way that headcount is taken changed for plan years beginning in 2023. Defined contribution plans now count participants with account balances at the start of the plan year rather than everyone eligible to join.
The Labor Department, the IRS and the Pension Benefit Guaranty Corporation adopted that change together in their final Form 5500 forms revisions. For a defined contribution plan the new method can only return the same count or a smaller one.
The rest comes down to when the audit is owed, what the small plan waiver actually costs to claim, what your own team has to settle before an auditor can start work, and what filing late costs.
Which Plans Owe an Employee Benefit Plan Audit
The line sits at 100 participants. The agencies' final Form 5500 forms revisions state that pension plans and funded welfare plans with 100 or more participants are generally required to have an audit of the plan's financial statements performed by an independent qualified public accountant, which the agencies shorten to IQPA.
What changed is the counting. The same document says that instead of using all those eligible to participate, defined contribution plan filers look at the number of participants and beneficiaries with account balances as of the beginning of the plan year when deciding whether they qualify for small plan reporting, with an end of year measure used in a plan's first year. Those revisions are effective for plan years beginning on or after January 1, 2023, and the agencies conformed the "80-120" participant rule instructions to the new method at the same time.
Read that against your own enrollment pattern, because the relief it gives is uneven. An eligible employee who never deferred has no account balance and drops out of the count, so a plan with wide eligibility and thin participation gains the most room. A plan with automatic enrollment gains the least, since automatic enrollment turns eligible employees into account holders and pulls the balance count back toward the eligibility count.
Below the line, the simplified rules take over. Section 2520.104-41 covers the administrator of an employee pension or welfare benefit plan that covers fewer than 100 participants at the beginning of the plan year, and it extends the same treatment to the administrator of a plan described in section 2520.103-1(d). That second class is the one plans forget, and it is the gateway to both the short form and the audit waiver.
Section 2520.103-1(d) is the special rule everyone calls 80-120. If a plan has between 80 and 120 participants, inclusive, as of the beginning of the plan year, the plan administrator may elect to file the same category of annual report that was filed for the previous plan year. So crossing 100 for the first time is not the trigger on its own. Crossing it above 120 is, and so is crossing it with no prior year filing to hold on to.
The waiver regulation then treats a pension plan that elects to file as a small plan under section 2520.103-1(d) as one for which simplified annual reporting has been prescribed, and says the same of a welfare plan, so the election carries the waiver with it.
The Small Plan Waiver Is Conditional, and the Conditions Are Real
Being small does not by itself excuse the audit. The waiver at section 2520.104-46 applies only if, for each plan year claimed, at least 95 percent of the assets of the plan constitute qualifying plan assets, or any person who handles assets that are not qualifying plan assets is bonded under section 412 of the Act, with that bond set at not less than the value of those assets.
The second branch reaches further than sponsors expect. The regulation's own worked example makes the point plainly: where a plan has more than 5% of its assets in non-qualifying plan assets, the bond is for the total amount of the non-qualifying plan assets, not just the amount in excess of 5%.
There is a disclosure price on top of the bond. Claiming the waiver obliges the summary annual report to name each regulated financial institution holding qualifying plan assets, other than the categories the rule excepts, together with the amount that institution reported as of the end of the plan year, and to name the surety company issuing the bond where more than 5% of plan assets are non-qualifying. The same report has to tell participants they may examine or obtain copies of the bond evidence and the institution statements without charge, and tell them to contact the regional office of the Employee Benefits Security Administration if they cannot get them.
Waiver or not, the return still goes in. The regulation is explicit that the waiver does not affect the plan's obligation to file a Form 5500 with its required schedules, and a plan that elects to file as a large plan cannot then claim the waiver.
So work out your qualifying asset percentage before you assume you are exempt. A single real estate holding or a private note can put the whole waiver on a bond you have not bought yet.
Two Different Lists Decide Two Different Things
Qualifying plan assets and qualified institutions are not the same list, and confusing them is how a plan ends up holding a certification its auditor cannot use.
For the waiver test, section 2520.104-46 counts assets held by a bank or similar financial institution, an insurance company qualified to do business under the laws of a state, an organization registered as a broker-dealer under the Securities Exchange Act of 1934, or any other organization authorized to act as a trustee for individual retirement accounts. It also counts shares issued by an investment company registered under the Investment Company Act of 1940, investment and annuity contracts issued by any insurance company qualified to do business under the laws of a state, qualifying employer securities, any loan meeting the requirements of section 408(b)(1) of the Act, and, in an individual account plan, assets in a participant's own account that the participant can control and gets a statement on at least annually from one of those institutions.
For the certification that supports an ERISA section 103(a)(3)(C) audit, the list narrows. The AICPA's Center for Plain English Accounting records that investment companies and broker-dealers are not considered qualified institutions for the purpose of providing a certification, although some of them have established separate trust companies that could meet the requirement.
A plan whose assets sit at a mutual fund company can therefore satisfy the qualifying asset test one year and, the year it crosses the participant line, find that the same fund company cannot give its auditor a usable certification. Find out which legal entity signs before you build a timetable around the certification.
Limited Scope Is Gone. What Replaced It
The phrase limited scope audit is out of date, though the election behind it never went anywhere. ERISA section 103(a)(3)(C) says the opinion required by subparagraph (A) need not be expressed as to any statements required by subsection (b)(3)(G) and prepared by a bank or similar institution or insurance carrier regulated and supervised and subject to periodic examination by a State or Federal agency, if those statements are certified by that institution as accurate and are made part of the annual report.
What changed is the auditing standard. SAS No. 136 is codified in AU-C section 703 and is effective for audits of financial statements for periods ending on or after December 15, 2021.
The renaming carries a substantive point. Under the standard, the scope of such an audit is no longer considered limited even though the auditor does not audit the certified investment information, and the auditor no longer issues the disclaimer of opinion that used to come with it.
The report now carries a two-part opinion instead. One part addresses whether the information not covered by the certification is presented fairly. The other addresses whether the certified investment information in the financial statements agrees to, or is derived from, the certification.
What Your Team Has to Determine Before Electing It
The election belongs to plan management, and so do four determinations that travel with it. The AICPA's Center for Plain English Accounting sets them out as engagement acceptance requirements under AU-C section 703, and on the second of them your auditor is required to ask how you reached the conclusion.
- That the election is permissible at all. AU-C 703 has management determine whether an ERISA section 103(a)(3)(C) audit is permissible under the circumstances. Answer that in writing before the engagement letter is signed, because it decides the shape of everything after it.
- That the certifier qualifies. Management determines that the investment information is prepared and certified by a qualified institution as described in section 2520.103-8. Name the legal entity on the certification, not the brand on the statement.
- That the certification itself holds up. Management determines that the certification meets the requirements in section 2520.103-5. A list of holdings with no signed declaration of accuracy and completeness behind it is a statement, not a certification.
- That the certified numbers are reported properly. Management determines that the certified investment information is appropriately measured, presented and disclosed under the applicable financial reporting framework. That is a financial reporting judgment, and it needs somebody who can make one.
Read those four as a job description on your side of the table. Where management has relied on service providers, or even on the auditor, to determine or obtain these items, the AICPA's Center for Plain English Accounting notes that the requirements may pose a burden to management. Budget that time before the engagement letter, not during fieldwork.
The institution holding your plan's assets is on a clock too. Under section 2520.103-5, an insurance carrier or other organization that provides benefits or holds plan assets, a bank or similar institution holding plan assets, or a plan sponsor has to transmit and certify the information the administrator needs for the annual report within 120 days after the close of the plan year. Put that date in the calendar next to the filing deadline. Everything after it, the fieldwork and the Form 5500 preparation both, has to fit in the months that remain.
What Gets Audited Even When the Investments Are Certified
Electing the certification narrows what is audited, not what is tested. For every ERISA plan audit including a section 103(a)(3)(C) audit, the auditor performs procedures to become satisfied that the amounts the trustee or custodian reports as received and disbursed, employer and employee contributions and benefit payments among them, were determined in accordance with the plan provisions.
That makes the plan document itself audit evidence. AU-C section 703 has the auditor obtain and read the most current plan instrument for the audit period, including effective amendments, and consider relevant plan provisions when designing procedures.
Testing those provisions is the expected outcome, not the exception. The AICPA's Center for Plain English Accounting puts it in a practice note: because of the nature of ERISA audits, it would be rare for the auditor, based on the assessed risks of material misstatement at the relevant assertion level, not to test any relevant plan provisions. Where the auditor does conclude that no testing is needed, the same report points to AU-C 703.26 for the duty to document the considerations behind that conclusion.
Findings now have a name and a route. Matters that are noncompliance or suspected noncompliance with laws or regulations, findings significant and relevant to those charged with governance, and control deficiencies of sufficient importance are evaluated as reportable findings and communicated in writing.
The Draft Return Comes Before the Report Is Dated
The auditor obtains agreement from management or those charged with governance to provide a draft Form 5500 that is substantially complete before the auditor's report is dated.
How hard that lands depends on who prepares the return. The AICPA's Center for Plain English Accounting reports anecdotally that the magnitude of the change is largely predicated on the prior processes of the Form 5500 preparers.
Substantially complete is defined, not left to taste. Paragraph 2.47 of the AICPA Audit and Accounting Guide, Employee Benefit Plans, defines such a draft as one that includes the forms and schedules that could have a material effect, involving both qualitative and quantitative considerations, on the information in the financial statements and the ERISA-required supplemental schedules.
If your third-party administrator has always prepared the return after the audit report arrived, that order has to flip. Ask the preparer for a dated commitment during planning, not a promise in the seventh month.
Filing Deadlines, and What Late Filing Costs
The annual report is due seven months after the close of the plan year, unless extended. The extension request is Form 5558, the Application for Extension of Time to File Certain Employee Plan Returns.
Missing the deadline is priced by the day. Section 2560.502c-2 provides that the amount assessed under ERISA section 502(c)(2) shall not exceed $1,000 a day, adjusted for inflation under the Federal Civil Penalties Inflation Adjustment Act of 1990, computed from the date of the administrator's failure or refusal to file and continuing until an annual report satisfactory to the Secretary is filed.
The figure in the regulation is not the figure a plan pays. The Labor Department's 2025 inflation adjustment set the ERISA section 502(c)(2) maximum for failure or refusal to properly file a plan annual report at $2,739 a day, applying to penalties assessed after January 15, 2025.
That is still the live number. The Department published no adjustment for the following year, because the Bureau of Labor Statistics did not publish the October 2025 Consumer Price Index for All Urban Consumers that the statute requires the calculation to use, and the Office of Management and Budget instructed agencies to keep using the prior year's civil monetary penalties.
Assessment is not automatic either. The same section has the Department set the amount taking the degree and willfulness of the failure into account, and where the administrator responds to a notice of intent with a statement of reasonable cause, no penalty is assessed for any day from the date the Department serves that notice until the day after it serves notice of its determination on reasonable cause.
The start of that clock is easy to misread. The same section sets the date of failure as the date the annual report was due, determined without regard to any extension for filing, so an extension you obtain and then miss does not move the starting line. A report rejected for failing to provide material information is treated as a failure to file when a revised report satisfactory to the Department is not filed within 45 days of the notice of rejection.
How to Be Ready Before the Auditor Arrives
Start with the choice of auditor, because it moves the odds more than anything you assemble afterwards. The Labor Department's Office of the Chief Accountant took a statistically valid sample of 307 plan audits from the 2020 form year and found that 30 percent contained major deficiencies with respect to one or more relevant generally accepted auditing standards requirements, putting $927 billion and 11.7 million plan participants and beneficiaries at risk. The deficiency rate sorts by the size of the auditor's plan practice. CPA firms auditing 1 to 2 plans a year carried a rate of 70 percent, against 17 percent among firms auditing 100 or more.
EBSA puts the same point to sponsors as a duty. Hiring the accountant is one of the plan administrator's most important fiduciary responsibilities, and the agency tells you not to weigh one factor, such as a lowest fee bid, to the exclusion of any other. Ask how many plan audits the firm performs in a year, ask whether that work has been peer reviewed, and request the results.
Preparation is mostly evidence you either kept during the year or did not. Six things carry the most weight.
- A reconciled participant count. Pull the count on the current basis, participants and beneficiaries with account balances at the start of the plan year, and reconcile it to the recordkeeper's report and to your payroll census. Run it early in the plan year rather than at filing time, because that count decides whether you are buying an audit at all.
- The plan instrument with every amendment. Assemble one executed copy covering the whole audit period, amendments included, and confirm the version your recordkeeper administers matches it. A provision the auditor reads and the recordkeeper never implemented is an operational failure with a correction attached.
- The certification and the date it arrived. Keep the signed declaration, not just the statement of holdings, and record when it came in. If it habitually arrives late, renegotiate that in the service agreement rather than absorbing it in fieldwork.
- The contribution trail from payroll to trust. For each payroll, keep the register, the remittance file and the trust posting, so deferrals can be traced end to end without reconstruction. Reconstructing that trail during fieldwork is the expensive way to produce it. Keeping it as you go is the cheap way.
- A draft annual return on the audit's timetable. Agree with the preparer, in writing, when the substantially complete draft lands, and hold that date the way you hold the filing date. The report cannot be dated ahead of it.
- Last year's findings, closed with evidence. Take each prior finding, write what was changed, and keep the artifact that proves it. Closing each one with a dated artifact is cheaper than reopening the question a year later.
Be honest about when preparation will not save you. If the underlying bookkeeping was caught up in the weeks before fieldwork, the audit will surface that, and no amount of document assembly hides a reconciliation that was performed once a year.
One more thing sits outside this list. Who may perform work on a plan's files, and what a CPA firm has to tell its clients before those files move to an outside provider, is governed by a separate set of rules in the AICPA Code and the FTC Safeguards Rule, so settle that before you widen the circle of people touching plan data.
Questions Plan Sponsors Ask
What Is an Employee Benefit Plan Audit?
It is an audit of the plan's financial statements performed by an independent qualified public accountant. The plan is the entity under audit rather than the employer, so the plan document, the participant records and the flow of contributions into the trust are what the work is built on.
What Triggers an Employee Benefit Plan Audit?
Crossing the participant threshold does. Pension plans and funded welfare plans with 100 or more participants generally have to attach an IQPA audit of the plan's financial statements to the annual return, and for defined contribution plans that count is taken on participants with account balances at the beginning of the plan year.
What Triggers a 401(k) Audit?
The same threshold and the same counting method. A 401(k) plan is a defined contribution plan, so the account balance count applies to it, which is why an automatic enrollment plan sees less relief from the counting change than a plan where employees opt in.
What Triggers a DOL Audit?
That question usually mixes up two different things. The annual examination by an independent qualified public accountant is a financial statement audit the plan buys in any year it is over the line and outside the waiver. An investigation by the Employee Benefits Security Administration is an enforcement matter the agency opens, and it is not the annual financial statement audit at all.
Do Health and Welfare Plans Need an Audit?
Only the funded ones over the line. The waiver regulation relieves the administrator of an employee welfare benefit plan that covers fewer than 100 participants at the beginning of the plan year from the annual reporting requirements it describes, and the qualifying asset and bonding conditions that apply to pension plans are not imposed on that branch of the waiver.
Above the line, funding decides it rather than headcount. Section 2520.104-44 exempts a welfare plan whose benefits are paid solely from the general assets of the employer or employee organization, or exclusively through insurance contracts whose premiums the employer pays from its general assets, from engaging an independent qualified public accountant, subject to the conditions that section sets on forwarding participant contributions and returning refunds. Its own example is a welfare plan funded entirely with insurance contracts that covers 100 or more participants: it files Form 5500 including Schedule A and is not required to engage an accountant. The section applies only to those arrangements, so a welfare plan funded through a trust is outside it.
Start Where the Evidence Is Made
The audit does not create the work. It reads a year of bookkeeping back to you, and books assembled at the end of the year get read back that way. The threshold decides whether you buy an audit. Your monthly discipline decides what it costs.
So start with the count, then the waiver conditions, then the four determinations, and put the certification date and the draft return date in the same calendar as the filing deadline. Everything else in an audit follows those four moves.
If you are on the other side of this, running the firm that carries the year-round accounting behind client plans, the constraint is usually capacity in the months before fieldwork. Accountably places trained offshore accountants and tax preparers inside US CPA, EA and accounting firms, working on the firm's software and SOPs, and the signature and the final judgment stay with the firm. The scope is accounting and tax work rather than audit fieldwork. Since 2022 that has meant 20+ US firms and 30+ placements.
The way in is small on purpose. A Free 40-Hour Proof Pilot puts a fixed block of your own representative work through the offshore team and your review chain, so your reviewer grades real output before a client file is committed. If a placement is not the right fit inside the first 30 days, the 30-Day Fit Guarantee replaces them free.
Don't trust us. Test us.