Employee Benefit Plan Audit: When ERISA Requires an Independent Audit

What is an employee benefit plan audit?

An employee benefit plan audit is an examination of the plan's financial statements by an Independent Qualified Public Accountant (IQPA) — a licensed CPA firm that's independent of the plan and its sponsor. The auditor's report is attached to the plan's Form 5500 along with Schedule H (the detailed financial schedule) and filed with the Department of Labor. It exists so participants and the DOL can rely on the plan's reported assets, contributions, and benefit payments.

The audit requirement is a function of plan size, not plan type: it applies to large plans, generally those with 100 or more participants at the beginning of the plan year. Eligible small plans (under 100) file the short Form 5500-SF and are usually exempt.

Which plans need an audit

The audit attaches to any large ERISA-covered plan. The common cases:

The 100-participant line (and the 2023 change)

For defined-contribution plans, the count changed for plan years beginning on or after January 1, 2023: only participants with an account balance at the start of the year count toward the 100 threshold — not every eligible employee. Many small-business 401(k)s dropped below 100 balances and no longer need an audit. The 80-120 rule lets a plan near the boundary keep filing in the same category as the prior year until it tops 120, and the small-plan audit waiver can exempt some otherwise-large plans that hold 95% qualifying assets or bond the difference.

The full mechanics — the balance-count change, the 80-120 buffer, and the waiver — are covered in the 401(k) audit requirements guide. This page covers what the audit itself involves.

Full-scope vs. ERISA Section 103(a)(3)(C) audits

There are two audit scopes. In a full-scope audit, the IQPA audits all of the plan's financial information, including investments. In an ERISA Section 103(a)(3)(C) audit (the engagement formerly called a "limited-scope audit"), the auditor does not audit certain investment information that a qualifying institution — a bank or insurance carrier — has certified as complete and accurate. Plan management elects this scope when a qualifying certification is available; the auditor still tests contributions, benefit payments, participant data, and the rest of the financial statements.

This terminology came from SAS 136, the auditing standard effective for plan-year-end audits after December 15, 2021, which also added explicit plan-management responsibilities (maintaining the plan document, the certification, and a substantially complete draft Form 5500 for the auditor).

What the auditor examines

• Net assets available for benefits and the changes in them (Schedule H).
• Contributions — that employee deferrals and employer contributions were remitted accurately and on time (late deferrals are a frequent finding).
• Benefit payments and distributions to participants and beneficiaries.
• Participant data — eligibility, vesting, and allocations.
• Investments and fair value, in a full-scope audit (or the non-certified portion in a 103(a)(3)(C) audit).
• Party-in-interest / prohibited transactions and the ERISA fidelity bond.

Deadline and how the fee is disclosed

The audit report is due with the Form 5500 — generally the last day of the seventh month after the plan year ends (July 31 for a calendar-year plan), plus 2½ months with a Form 5558 extension. Work out your exact date with the deadline calculator.

The auditor's fee is reported on Schedule C for large plans, under the accounting/audit service codes — so you can see what plans paid their IQPA straight from the public filing.