Hardship withdrawal documentation is the easiest thing for a plan sponsor to get wrong and the easiest thing for an auditor to test. Loans are close behind. Both move money out of the trust, and both leave a paper trail that either supports the distribution or does not. If your 401(k) plan allows hardships or loans, the question is not whether these transactions happen — it is whether you can produce a clean file for each one, years later.
This is a fiduciary issue, not a payroll issue. The plan document defines when a hardship or loan is permitted; someone has to apply it consistently, keep evidence, and reconcile what left the trust against what was approved. That sits with the employer as plan sponsor unless it has been formally delegated.
Why hardships and loans get tested first
Distributions are the cleanest audit target because they are binary: either the participant was eligible under the plan’s terms and the paperwork exists, or the plan made an impermissible distribution. Auditors pull a sample of hardship and loan transactions, ask for the file, and see what comes back.
What usually comes back is a recordkeeper transaction report and nothing else. The approval logic — who checked what against which section of the plan document — lives in an inbox, in someone’s memory, or nowhere. That gap is the finding.
What the plan document actually controls
Before you build a file, read your adoption agreement. Hardship and loan features are optional and vary widely between plans. Confirm in writing:
- Whether hardships are permitted at all, and from which money sources (deferrals, match, profit sharing, rollover).
- Whether the plan uses the safe-harbor list of deemed-immediate-and-heavy financial needs, or a facts-and-circumstances standard.
- Whether loans are permitted, how many may be outstanding at once, the amount limits, and the repayment terms.
- Whether loans require spousal consent, and whether a primary-residence loan gets an extended term (if so, the file needs evidence supporting that classification).
- Who is designated to approve these requests — the plan administrator, a committee, or a delegated service provider.
Everything downstream is measured against those answers. A distribution that would be fine under a typical plan is still an operational failure if your document does not allow it.
The hardship file: what to collect
1. The participant’s written request
Dated, signed (electronic signatures are fine), stating the category of need and the amount requested. A phone call followed by a wire is not a file.
2. The participant certification
Plans may generally rely on a participant’s written certification that the need qualifies and the amount does not exceed it — but only if the plan administrator has no actual knowledge to the contrary, and only if the certification is obtained and retained. “We use the certification method” is not a defense when there is no certification in the file.
3. Evidence of the amount
The distribution cannot exceed the amount necessary to satisfy the need, and may include amounts needed to cover taxes on the distribution. The file should show how the approved figure was derived, not a round number with no arithmetic behind it.
4. The eligibility check against the document
A short internal record showing the request was matched to a permitted category and money source. Most often missing, easiest to add: one line, one reviewer, one date.
5. The approval and the transaction confirmation
Who approved it, when, and the recordkeeper confirmation showing the amount distributed and withholding applied. Then reconcile approved versus distributed. Mismatches happen more often than sponsors expect.
6. Notice and tax reporting
Retain the tax notice given to the participant and confirm the distribution was reported correctly on the year-end tax form. Coding errors surface here.
The loan file: what to collect
1. The loan application and promissory note
Signed, with principal, interest rate, repayment frequency, and term. The note is the enforceable document; without it the loan is exposed.
2. The amortization schedule
Level amortization over the stated term, generated at origination and retained — this is what you compare payroll deductions against later.
3. The limit calculation
Show the math: vested balance, outstanding loan balance, prior loans within the applicable lookback, and the resulting maximum. Loans exceeding plan or statutory limits become taxable to the participant — and the correction lands on the employer.
4. Repayment records tied to payroll
Loan repayments start in payroll and end in the trust. Retain the deduction setup and periodically compare the payroll register to the recordkeeper’s loan balance. Same discipline that prevents late deferral deposits, and it fails for the same reason: nobody owns the reconciliation.
5. Leave, termination and default handling
Document what happens when a participant goes on unpaid leave, military leave, or terminates with a loan outstanding. Missed payments that go untracked drift into deemed distributions — and the sponsor usually hears about it from a confused participant rather than from a control.
The failures that actually show up
- No certification on file. The employer assumed the recordkeeper collected it, and vice versa.
- Distributions from money sources the document does not permit. Especially match or safe-harbor sources.
- Loan repayments that stop and never restart after a leave or a payroll system change.
- Records purged too early. Plan records must be retained long enough to support the filings and transactions they underlie — longer than most HR retention schedules assume.
- Distribution activity that does not tie to the Form 5500 — the same numbers you confirm when you review the Form 5500 before signing it.
A self-audit you can run this quarter
- Pull every hardship and loan transaction from the recordkeeper for the last two plan years.
- Take a sample, or all of them if volume is small, and request the full file for each.
- For each hardship: is there a dated request, a certification, an amount rationale, a named approver, and a matching transaction confirmation?
- For each loan: is there a signed note, an amortization schedule, a limit calculation, and a payroll deduction that matches the schedule?
- Compare outstanding loan balances in payroll against the recordkeeper’s. Investigate every difference.
- Check each transaction against the document’s permitted sources and limits.
- Write down what was missing, fix the process, and correct operational failures through the appropriate correction program rather than leaving them open.
If step 3 or 4 fails on more than a couple of files, the issue is not the files — no one has been assigned to own them. That is also the fix.
Controls that keep the file clean
- A single intake path for every hardship and loan request, with a named approver and backup whose portal permissions match.
- A one-page checklist tied to your actual plan document, completed and saved for every transaction.
- A monthly payroll-to-recordkeeper reconciliation covering deferrals and loan repayments.
- A retention location that survives staff turnover and HRIS migrations — the same folder structure you use for audit readiness.
- An annual review of hardship and loan activity against the document, folded into your year-end compliance calendar.
What you can delegate — and what you cannot
A full-scope 3(16) plan administrator can own the operational side: intake, eligibility review against the document, certification collection, approval, retention, and payroll reconciliation. Be specific in the service agreement, though — some providers process what you send them without reviewing it against your document, which leaves the exposure exactly where it was. That is why not all 3(16) providers are the same.
What you cannot delegate is choosing and monitoring whoever does the work, or the plan document terms themselves. If your hardship and loan provisions no longer match how your workforce uses the plan, that is a sponsor decision to make with your advisor.
Where Admin316 fits
Admin316 provides full-scope 3(16) administration and — unlike most providers, who decline it — accepts the ERISA 402(a) named fiduciary appointment. Hardship and loan administration is not just processed on your behalf; the named-fiduciary responsibility for administering the plan according to its terms moves with it, including keeping a file that holds up when someone asks for it. That is what prevents a plan from drifting out of compliance one undocumented transaction at a time, and what keeps eligibility and entry dates aligned with the document.
If you cannot produce a complete file for the last hardship your plan approved, that is worth twenty minutes. Book a time with Admin316 and we will walk your process, show you what an auditor would ask for, and tell you plainly what is missing.
