Employee Benefit Plan Audit Requirements Under ERISA and DOL Rules

ERISA requires an independent audit for most benefit plans once they cross a certain size, and the obligation exists to make sure money set aside for workers' retirement and health benefits is actually there when they need it. This piece walks through who triggers that requirement, what the audit covers, who bears responsibility when it fails, and the procedural relief and technical elections that shape how sponsors actually live with the rule.

Why ERISA imposes an audit obligation on employee benefit plans

The Employee Retirement Income Security Act exists because benefit plans hold other people's money, often for decades, and the people who manage that money are not always the people who depend on it. The law's audit requirement is the mechanism that checks whether the money is where it is supposed to be.

The Department of Labor treats this audit as a legal obligation resting on the plan administrator. The statute lays out fiduciary responsibilities, minimum eligibility and vesting standards, reporting and disclosure requirements, and enforcement mechanisms, and the audit is the point where all four of those obligations intersect, which makes this obligation almost inevitable. An audit tests whether the fiduciaries acted properly, whether eligibility and vesting were calculated correctly, and whether the reporting is accurate, and it also generates the evidence enforcement depends on.

Two federal agencies oversee that evidence, and each has a different stake in the same filing. The IRS looks at whether the plan keeps its tax-qualified status, and that status matters to the sponsor and to every participant whose contributions depend on it. Both agencies rely on the same audited Form 5500, which is part of why the audit carries the weight it does: one document, two sets of regulatory stakes.

The scope of plans covered is broad. ERISA applies to pension plans, both defined benefit and defined contribution, which includes 401(k) plans, profit-sharing plans, ESOPs, and 403(b) plans. Governmental plans and church plans sit outside Title I, so they are exempt, but if you sponsor nearly any private-sector plan, the audit obligation is not optional once the plan reaches the size that triggers it.

The specific statutory trigger: ERISA Section 103(a)(3)(A) and the 100-participant threshold

ERISA Section 103(a)(3)(A) sets the trigger: plans with more than 100 participants must retain an Independent Qualified Public Accountant to audit the plan's financial statements under Generally Accepted Auditing Standards, and that audit report attaches to the Form 5500 filed jointly with the DOL and IRS. Plan sponsors get tripped up on the counting method behind it.

Why exactly does this happen? The threshold was never about how many people work at the company; it is about participant count as ERISA defines it, and that definition has shifted in ways that catch administrators off guard. Under the current rule, it may not. This single change has moved a meaningful number of plans below the audit threshold that would previously have required one, and sponsors who have not recounted under the new method may be budgeting for an audit they no longer need, or worse, assuming they are exempt when they are not.

The 80-120 transition rule softens the edges for plans hovering near the line. So borderline plans get roughly one year of cushion before a filing-category change becomes mandatory, which matters if a sponsor would otherwise face a sudden, unbudgeted audit engagement.

SECURE 2.0 complicates the headcount further. A sponsor cannot wait for the amendment deadline to start behaving as though the rule applies.

What the audit examines and who is involved in producing it

An EBP audit is not one firm reviewing one set of books. It requires coordinated financial reporting from several parties who each hold a piece of the plan's financial picture, and the auditor has to test across all of them before reaching any conclusion about the plan's financial condition. The plan sponsor's financial accounting and human resources departments supply the plan-level data. All of that feeds into the independent auditor's work.

The Department of Labor specifies what a compliant audit has to cover, and the list is substantive rather than procedural: fair valuation of plan assets, a proper statement of plan obligations, timely receipt of contributions, benefit payments made according to plan terms, a fair statement of participant accounts, identification of any issues affecting the plan's tax status, and identification of prohibited transactions under ERISA.

The standards governing this work come from the AICPA's Auditing Standards Board, and the AICPA's Professional Ethics Executive Committee interprets and enforces the Code of Professional Conduct that auditors operate under. Auditors must be licensed or certified as public accountants by a state regulatory authority, and they must be independent of both the plan and the plan sponsor. What is unique is the environment the audit operates in: it intersects IRS regulations, DOL regulations, federal and state law, specialized reporting requirements, and the operational mechanics of how the plan actually runs day to day. A standard corporate financial statement audit does not carry that same regulatory layering.

That complexity has a practical consequence. One of the most common reasons an EBP audit turns out deficient is that the auditor failed to test the areas unique to benefit plans, relying instead on general audit procedures that do not capture what ERISA and the DOL specifically require. General audit experience and benefit plan audit experience are not interchangeable skills, and the gap between them is exactly where deficient audits originate. That single fact has direct consequences for how a plan administrator should think about hiring an auditor. Fiduciary responsibility enters the picture at the point of hiring.

Fiduciary responsibility that attaches to audit selection and record-keeping

A fiduciary under ERISA is anyone with discretionary control or authority over plan management or assets, or anyone responsible for plan administration. That definition covers plan trustees, plan administrators, and members of a plan's investment committee, and it comes with specific duties: acting solely in the interest of participants and beneficiaries, carrying out responsibilities prudently, following plan documents except where they conflict with ERISA, diversifying plan investments, and paying only reasonable plan expenses.

The Department of Labor treats the selection of an auditor as one of those fiduciary acts. Hiring an auditor who lacks the experience or competence to perform the work properly is treated as a breach of fiduciary duty in its own right, because the administrator had a duty to select someone capable of doing the job correctly. That duty extends to recordkeeping as well: the administrator is legally responsible for maintaining complete and accurate plan records and making them available to the auditor, including records held by third-party service providers such as recordkeepers or claims administrators. A plan administrator cannot point to a vendor's failure to produce records as a defense; the obligation to produce them sits with the administrator.

So plan administrators have specific questions to ask before they engage an auditor. Cutting costs in a way that degrades audit quality does not just risk a weaker audit. It creates personal fiduciary exposure for the administrator who approved it.

Sponsors looking for a starting point in vetting auditors have a resource built for exactly this purpose: the AICPA's Employee Benefit Plans Audit Quality Center maintains a directory of auditors who have agreed to meet specific experience, training, and practice-monitoring requirements particular to this kind of work.

The penalties for noncompliance and the enforcement posture sponsors face

If the audit report is not complete, adequate, and timely, it carries real financial consequences, and those penalties can be assessed against the plan administrator personally rather than against the plan as an abstract entity.

The enforcement environment around these penalties has shifted. Field Assistance Bulletin 2026-01 from EBSA signals that enforcement will concentrate more heavily on serious violations causing real harm to workers and retirees, targeting what the bulletin describes as "the most egregious conduct and significant harm," rather than scrutinizing routine fiduciary decisions that carry little practical risk to participants.

One might argue that this sounds like a loosening of standards, a signal that audit quality matters less than it used to. The shift redirects enforcement resources toward violations with real participant impact, and a weak or missing audit is precisely the kind of failure that allows that impact to go undetected. A plan that skips its audit obligation, or produces a deficient one, is more exposed under an enforcement posture aimed at egregious harm, because the audit is the mechanism that would have caught the harm before it reached the level EBSA is now prioritizing.

Self-correction relief available under the updated VFCP

Not every lapse requires a full regulatory proceeding, and the Voluntary Fiduciary Correction Program now reflects that distinction more clearly than it used to. The VFCP includes a self-correction component, referred to as the SCC, which allows sponsors to correct certain violations without filing a full formal application to the Department of Labor. Sponsors still have to submit an online SCC Notice to EBSA, so the correction is not invisible to regulators, but it avoids the longer formal review process.

The SCC applies to a specific, narrow category of errors: delinquent participant contributions and delinquent loan repayments. Eligibility depends on defined conditions. Lost earnings from the late deposit cannot exceed $1,000, and you must remit the funds within a defined window after the withholding occurred.

That raises an important question for sponsors wondering whether the SCC applies to their situation: is the error small, isolated, and quickly caught, or does it reflect a pattern? The SCC is built for genuinely minor, time-limited lapses, like when a payroll deposit runs a few days late because of an administrative hiccup. It is not designed for systemic or recurring failures, and sponsors who try to use it as a workaround for a chronic deposit-timing problem are not using the program as intended.

SOC 1 Reports and the EBP Audit

Most employee benefit plans rely on outside institutions, bank trustees, insurance companies, third-party administrators, to actually process transactions and maintain the underlying records the plan depends on. The plan's own auditor cannot directly observe controls operating inside those outside institutions, so the auditor has to evaluate those controls another way, and the SOC 1 report is the main tool for that.

SOC reports let the EBP auditor understand what controls exist at the service organization and, where those controls are sound, reduce the amount of direct substantive testing the auditor has to perform. Without a SOC 1 report, the auditor has no shortcut; direct testing has to fill the gap instead. So plan sponsors should look for a SOC 1, Type 2 report: it addresses controls relevant to a user entity's internal control over financial reporting, and it is built specifically to meet the needs of user entities and the auditors examining their financial statements.

A clean SOC 1 report does not mean the service organization has its cybersecurity risk under control. SOC 1 covers controls relevant to financial reporting only. SOC 2 is the framework that evaluates controls against the five Trust Services Criteria, security, availability, confidentiality, processing integrity, and privacy, with security mandatory and the remaining four selected based on contractual need. The two reports answer different questions, and conflating them leaves a real gap in what the sponsor actually knows about its vendor.

The ERISA Section 103(a)(3)(C) election

Plan administrators whose investment assets are certified by a qualified institution have the option to elect a limited audit scope under ERISA Section 103(a)(3)(C), and this election is misunderstood often enough that it deserves plain explanation. What used to be called a "limited-scope audit" is now commonly described, under current auditing standards, as an ERISA Section 103(a)(3)(C) audit. The terminology shift reflects updated auditing standards, and sponsors should know which term their own auditor uses so that conversations about scope do not talk past each other.

The election becomes available when a qualified institution, a bank, trust company, similar regulated institution, or an insurance company, each subject to periodic examination by a state or federal agency, certifies certain investment information as complete and accurate. Once that certification exists, you can instruct the auditor not to perform auditing procedures on the certified investment information. The Department of Labor treats this as a judgment call, not a default choice: administrators should consult their accountant, attorney, or plan advisor about whether limiting audit scope makes sense for their particular plan. It is not automatically the right election for every sponsor, and plans with complex or less transparent investment structures may get more value from a full-scope audit than from the narrower election.

What the election does not do matters as much as what it does. A 103(a)(3)(C) election does not eliminate the audit. If sponsors elect the limited scope, they narrow where the auditor focuses, but they do not step outside the audit requirement itself.

Common audit findings

Across the areas this piece has walked through, the recurring pattern in deficient audits traces back to the same handful of causes: participant counts calculated under outdated methodology, auditors without genuine EBP-specific experience performing tests that miss what ERISA actually requires, contributions deposited late without triggering the self-correction process available for exactly that problem, and service organization controls assumed to be adequate because a SOC 1 report existed without anyone checking what that report actually covered. None of these failures require bad faith. They require a plan administrator who treated the audit as a once-a-year formality rather than as the fiduciary obligation ERISA actually makes it.