401(k) plan audit readiness is not something you build in March. If your plan is above the participant-count threshold that triggers an independent audit, the quality of your audit is decided by the records you kept all year — payroll files, signed amendments, trust statements, distribution paperwork. Employers who treat the audit as a document-retrieval project in the spring pay for it twice: once in HR hours, and again in auditor findings that have to be explained to the Department of Labor on the Form 5500.
This checklist is written for employer plan sponsors, not for individual savers. It walks through what your independent qualified public accountant will request, why each item matters, and what “ready” actually looks like.
Why the audit exists at all
ERISA requires larger plans to file audited financial statements with the annual Form 5500. The auditor is not there to check whether your investments performed well. They are testing whether the plan operated according to its own written document: that eligible employees were enrolled on time, that deferrals matched elections, that contributions were remitted promptly, that distributions were authorized and calculated correctly, and that the plan’s financial statements fairly present what happened.
Almost every finding traces back to the same root cause: the plan document says one thing and payroll does another. Audit readiness, in practice, means being able to prove alignment between the document, the payroll system and the recordkeeper.
The plan document file
Start here, because everything else is tested against it. Your auditor will ask for the currently effective document and the full paper trail behind it.
1. Executed plan document and adoption agreement
Signed and dated. An unsigned adoption agreement is one of the most common — and most avoidable — findings.
2. Every amendment, with signatures
Including restatements and any interim amendments adopted for legislative changes. Keep them in effective-date order so a reader can reconstruct the plan’s terms for any given year.
3. Summary Plan Description and any Summaries of Material Modifications
Plus evidence of distribution to participants.
4. IRS opinion or determination letter
For pre-approved documents, the provider’s opinion letter covering the current cycle.
5. Service agreements and fee disclosures
Recordkeeper, third-party administrator, advisor and custodian agreements, plus the 408(b)(2) fee disclosures you received. These also feed your fiduciary benchmarking file.
Payroll and eligibility records
This is where auditors spend most of their testing time, and where sponsors are most often surprised. The auditor selects a sample of employees and traces each one end to end.
6. A full-year census of everyone who worked
Not just plan participants. Every employee, with hire date, termination date, date of birth, hours, compensation by type, and deferral elections. Excluded classes need to be identifiable and consistent with the document.
7. Deferral election forms or system records
For each sampled participant, the election in force and the date it took effect — matched to the amount actually withheld. Mismatches become operational failures.
8. Payroll registers for every pay period
Detailed enough to tie compensation used for deferrals and match back to the plan’s definition of compensation. Bonuses, commissions, fringe benefits and severance are the usual trouble spots.
9. Evidence of timely eligibility and entry
Show that each newly eligible employee was offered enrollment at the correct entry date, including automatic enrollment notices if your plan has that feature.
Contributions and remittance timing
10. A deposit log reconciling withholding to trust deposits
By pay date: amount withheld, date deposited, date the recordkeeper allocated it. Late deferral deposits are the single most frequently reported ERISA operational error, and they must be disclosed on the Form 5500 whether or not you have corrected them. If you find late deposits, correct them and document lost-earnings calculations rather than hoping the auditor misses the pattern.
11. Employer contribution calculations
Match, safe harbor, profit sharing or true-up computations, tied to the document’s formula and to the general ledger.
12. Compliance testing results
ADP/ACP testing, coverage and top-heavy testing, annual additions and deferral limit checks, plus documentation of any corrective distributions and when they were made.
Trust, investments and distributions
13. Trust statements and a certification, if you are using one
Certified investment information from a qualifying institution narrows the audit scope. Confirm early whether your custodian will provide a certification for the year, because that decision changes the work plan.
14. Participant-level reconciliation
Total participant accounts must reconcile to trust assets. Unallocated or forfeiture accounts need an explanation and a documented use consistent with the plan document.
15. Distribution and loan files
Requests, approvals, spousal consents where required, tax withholding and Form 1099-R support, plus loan amortization schedules and evidence of repayments through payroll. Defaulted loans need dates and deemed-distribution treatment.
16. Forfeiture activity
How forfeitures arose and how they were applied. Leaving forfeitures parked for years is a common finding.
Governance and fiduciary evidence
Auditors and, more importantly, regulators want to see that decisions were made by someone with authority, on a record.
17. Fiduciary appointments in writing
Who is the named fiduciary under ERISA 402(a)? Who is the 3(16) plan administrator? Who, if anyone, holds 3(21) or 3(38) investment authority? If you cannot name them from a signed document, the default answer is usually the company and its officers. Our breakdown of what each fiduciary role actually covers is the fastest way to check your structure.
18. Committee minutes and meeting materials
Investment reviews, fee discussions, provider decisions, and any corrections approved during the year.
19. Fidelity bond
ERISA requires a bond covering persons handling plan funds. Confirm coverage is current and adequate before the auditor asks.
20. Prior-year Form 5500, audit report and any open items
Including how last year’s findings were resolved. Unresolved repeat findings are what turn a routine audit into a compliance problem. See our guide to who signs the Form 5500 for the signature and filing responsibilities that go with it.
Turning the checklist into a year-round system
Sponsors who audit well do four unglamorous things. They reconcile deferral withholding to trust deposits every pay period instead of every spring. They keep a single, current fiduciary file — document, amendments, appointments, bond, service agreements — rather than reassembling it annually. They log every operational correction as it happens, with the calculation attached. And they close the loop on last year’s findings before the next audit begins.
None of that requires new technology. It requires an owner. When the owner is an HR generalist with a dozen other priorities, the file drifts, and the drift shows up as findings. That is the real argument for delegating plan administration: not that outsourcing is cheaper per hour, but that a delegated 3(16) administrator is contractually responsible for keeping these records audit-ready. If you are weighing that tradeoff, our comparison of outsourcing cost versus in-house HR time and our list of signs you need a 3(16) fiduciary are good next reads.
Where Admin316 fits
Admin316 provides 3(16) plan administration and supports sponsors through the 401(k) audit process — assembling the census, reconciling deposits, documenting corrections and responding to auditor requests, so your HR team is not the bottleneck. And unlike most providers, Admin316 will accept the ERISA 402(a) named-fiduciary appointment in writing. That is the appointment most administrators decline, and it is the one that determines who is answerable when an auditor or the Department of Labor asks who was responsible.
If you want a second set of eyes on your audit file before the deadline pressure starts, book a plan review with Admin316 and we will walk the checklist with you.
Keep reading: browse the full 401(k) & Retirement Plan Resource Library — every Admin316 guide on ERISA fiduciary duties, plan administration, defined benefit plans and retirement income.
