Choosing a 401(k) auditor is one of the few plan decisions where the sponsor hires the person who will check the sponsor’s own work. Most guides treat it as a shopping exercise: compare fees, pick a firm, sign the engagement letter. That misses the point. The audit is only as good as the records the employer hands over, and selecting and monitoring the auditor is a fiduciary act, not a procurement task. This guide covers what to ask before you hire, what the auditor will need from you, and where audits go wrong for sponsors.
Why the auditor choice is a fiduciary decision
Plans above the participant-count threshold generally must attach an audit report from an independent qualified public accountant to their Form 5500. The plan administrator is responsible for engaging that accountant. If the audit is deficient, the Department of Labor can reject the filing, and the consequences land on the plan administrator, not on the CPA firm.
That makes the hire subject to the same prudence standard as any other service provider: a documented process, a reasoned choice, and ongoing monitoring. A firm that audits a handful of benefit plans a year as a sideline to its tax practice may be cheaper, but cheaper is not the test. The test is whether a prudent fiduciary, familiar with these matters, would have hired them.
What to ask before you hire
1. How many employee benefit plan audits does the firm perform?
Benefit plan audits are a specialty. Ask how many the firm completes each year, how many are 401(k) plans similar to yours in size and recordkeeper, and who on the engagement team has done them before. Ask whether the firm is a member of the AICPA Employee Benefit Plan Audit Quality Center, which focuses on benefit plan audit quality.
2. Is the firm independent of the plan and the company?
The DOL applies its own independence rules on top of professional standards. A firm that keeps your company’s books, prepares the plan’s Form 5500, or has a financial interest in the sponsor may have a conflict. Ask the firm to confirm independence in writing and to tell you what other services it provides to the company.
3. Which type of audit will it perform, and why?
Many plans qualify for an ERISA section 103(a)(3)(C) audit (formerly called a “limited-scope” audit), where the auditor relies on investment information certified by a qualified bank or insurer. That reduces investment testing, but not the testing of contributions, distributions, participant data and plan operations. Ask the firm to explain which option fits your plan and what it will still test either way.
4. What does the firm need from the employer, and when?
A good firm sends a detailed request list and timeline at the start. A vague answer here predicts a late, painful audit. The rest of this guide is about that list.
What the auditor needs from the sponsor
The recordkeeper can supply trust statements and transaction reports. It cannot supply the employer’s side of the plan, and that is where most audit findings come from. Under the current auditing standard for ERISA plans, management also acknowledges in writing its responsibility for administering the plan in line with the plan document. Expect to provide:
- The governing documents. Signed adoption agreement, basic plan document, every amendment, and the current SPD. The auditor tests operations against these, so an unsigned amendment is a finding waiting to happen.
- Payroll registers for the full plan year. The auditor samples participants and traces deferrals and match from the payroll record to the trust. Gross pay, plan compensation and deferral amounts must tie.
- A complete census. Everyone paid during the year, including terminations and rehires, with hire, termination and rehire dates, birth dates and hours. Eligibility testing depends on it.
- Deposit timing evidence. Pay dates matched to the dates deferrals reached the trust. Auditors test this every year, and late deferral deposits are among the most common findings.
- Distribution and loan files. Election forms, spousal consents where the plan requires them, hardship documentation, and loan agreements for sampled transactions.
- Personnel files for sampled participants. Proof that the deferral rate in payroll matches what the employee elected.
- Prior-year audit findings and how they were fixed. Repeat findings are a red flag for the auditor and for the DOL.
Our audit readiness checklist breaks these items into a working file you can build ahead of fieldwork.
How 401(k) audits go wrong for sponsors
- Payroll and recordkeeper totals don’t reconcile. If contributions on the payroll register don’t match deposits on the trust statement, the auditor has to find out why. Regular participant data reconciliation prevents most of this.
- The compensation definition used in payroll differs from the document. Bonuses, commissions or fringe items included or excluded incorrectly will show up in the sample.
- Eligible employees were never enrolled. The auditor will flag missed entrants, which then require a missed deferral correction.
- Nobody owns the request list. HR assumes the recordkeeper is handling it; the recordkeeper assumes HR is. Fieldwork stalls and the filing deadline gets close.
- Hard-to-value assets have no support. If the plan holds anything without a daily price, the auditor will ask how it was valued. See our guide to plan asset valuation.
Monitoring the auditor after you hire
Hiring is not the end of the duty. Each year, the plan administrator should:
- Read the auditor’s report and any management letter, not just file them.
- Record the findings and the response in committee minutes.
- Confirm corrections were actually completed before the next audit.
- Review the firm’s performance, fees and independence periodically, and document the review.
- Read the completed Form 5500 with the audit report attached before signing it.
A quick self-check before your next audit
- Do we have a written record of why we chose this auditor?
- Has the firm confirmed its independence in writing this year?
- Do we know which audit type applies and why?
- Is every plan amendment signed and on file?
- Do payroll contributions tie to trust deposits for the full year?
- Is our census complete, including terminations and rehires?
- Were last year’s findings corrected and documented?
- Is one named person responsible for the request list?
What you can delegate, and what you can’t
A 3(16) plan administrator can own most of the audit process: coordinating the request list, pulling recordkeeper reports, reconciling payroll to the trust, answering auditor questions, and tracking corrections. Our retirement plan audit support is built around exactly that work.
What stays with the employer is the data only the employer has: payroll records, hire and termination dates, hours, personnel files, and decisions about plan design. A provider can collect and check those records; it cannot create them.
Where Admin316 fits
Most providers will help with an audit and then step back from the responsibility for who was hired and how the plan was run. Admin316 goes further. We accept appointment as the plan’s ERISA 402(a) named fiduciary, the role most providers decline, alongside our 3(16) administration. That means a fiduciary with a stake in the outcome is helping you choose and monitor the auditor and prepare the records it will test.
If your next audit is coming up, or the last one surfaced findings you’d rather not see again, book a conversation with our team.
