For plan sponsors, the change is a welcome relief. Some, however, have mistakenly interpreted self-certification to mean no documentation is needed at all.

That assumption can create risk.

As the IRS begins examining hardship distributions processed under the new rules, an important message is emerging: although the process has been streamlined, plan sponsors must still maintain appropriate documentation and records. Put simply,  the need for prudent recordkeeping has not been eliminated.

What Actually Changed?

Before SECURE 2.0, participants typically had to provide documentation, such as invoices, bills, or contracts to support a hardship withdrawal request and substantiate the amount needed.

Today, plan administrators may generally rely on a participant’s self-certification that they have an immediate and heavy financial need and that the requested distribution is necessary to satisfy . That change reduces administrative burden and can speed up processing.

What has not changed is the plan sponsor’s responsibility to administer hardship distributions in accordance with the plan document and applicable IRS rules.

The Sponsor Still Owns the Compliance Risk

Many hardship withdrawals are processed by a recordkeeper or third-party administrator (TPA). While these service providers may administer the process, they generally do not assume fiduciary responsibility for compliance unless specifically agreed to under their service arrangement.

As a result, plan sponsors remain responsible for demonstrating that hardship distributions were in accordance with the plan document and applicable IRS requirements. If an IRS auditor requests documentation, the sponsor ultimately bears that responsibility.

Outsourcing administration does not outsource accountability. Plan fiduciaries should periodically confirm thar their recordkeeper or TPA is administering hardship distributions properly by documenting that they are following IRS procedures.

That distinction often becomes apparent during an audit, when a sponsor assumes the service provider has retained the necessary documentation only to discover that key records are incomplete, unavailable, or difficult to retrieve.

What Documentation Should Sponsors Retain?

Plan sponsors should work with their recordkeeper or TPA to confirm that hardship certifications are maintained in written or electronic form and can be readily produced if requested. Sponsors should also verify that they have access to documentation related to the transaction, including:

The objective is straightforward: if an auditor asks questions years later, the sponsor should be able to clearly demonstrate what occurred and why the distribution was approved.

A Word of Caution About Telephone Transactions

Plan sponsors should pay particular attention to hardship withdrawals initiated by telephone.

Many recordkeepers allow participants to complete hardship requests through a call center rather than a paper or online form. Although this approach can improve efficiency, sponsors should confirm that the recordkeeper is capturing and retaining the participant’s certification in a form that can be produced if requested.

A phone call alone is not sufficient documentation. The key question is whether there is a written or electronic record of the participant’s certification and the resulting distribution.

Now Is a Good Time for a Process Review

Sponsors that rely on hardship self-certification should take the opportunity to review their procedures and confirm that appropriate records are being maintained. Key questions to consider include:

These are relatively simple questions, but they may help uncover gaps before an auditor does.

The Bottom Line

Hardship self-certification is one of SECURE 2.0’s most significant administrative simplifications. It reduces paperwork, streamlines processing, and makes hardship withdrawals easier for both participants and plan sponsors. But self-certification is not a documentation-free process.

Although plan sponsors generally no longer need to collect supporting documents from participants, they must still be able to demonstrate that hardship distributions were properly administered and that participant certifications were obtained and retained.

The lesson is simple: document, document, document!

A brief review of your hardship withdrawal procedures today can help identify gaps in documentation and recordkeeping before they become issues during an IRS audit.

We’ll also discuss optional provisions, implementation considerations, and steps plan sponsors can take to coordinate with payroll teams, recordkeepers, and other service providers. Leave with practical insights to help prepare your plan for what’s ahead.

To register for the webinar, click here.

When? Wednesday, November 4, 2026, 4 p.m. ET

Speakers: Lisa Caito (CAPTRUST) and Jennifer K. Kiffmeyer (Retirement Learning Center)

Who Should Attend: Plan sponsors, fiduciaries, financial advisors, and anyone responsible for retirement plan governance.

CE Credit:

This session qualifies for continuing education credit. To receive credit, attendees must remain for the entire session and answer three polling questions during the webinar.

CE offered:


Field of Study: Specialized Knowledge

Additional Information:

Prerequisites: 3-5 year’ experience in the industry
Who should attend: Plan sponsors, financial professionals, and accountants; others are welcome.
Advanced Preparations: None
Program Level: Intermediate
Delivery Method: Group Internet Based

Retirement Learning Center, LLC registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have the final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website: www.NASBARegistry.org

Retirement plan sponsors are invited to join CIO Mike Vogelzang and members of the CAPTRUST Investment Group for a live Office Hours conversation focused on the market and investment trends shaping retirement plan oversight, investment menus, and participant outcomes.

During this interactive session, CAPTRUST’s investment team will address timely topics, including:

To register, click here.

When? October 28, 2026, at 4 p.m. ET

Join Mark Hurley, CEO of Digital Privacy and Protection for a timely discussion on today’s evolving cyber landscape and the individuals can take to help protect your wealth, personal information, and family.

Register by clicking here.

When? October 27, 2026, at 4 p.m. ET

The webinar will explore:

Speakers:

Mark Hurley, CEO, Digital Privacy and Protection, which provides digital security and privacy services to wealth management firms and their clients.

Eddie Welch, Managing Director and Head of Wealth Management, CAPTRUST

The survey included 144 total respondents, with the largest cohorts represented by operating nonprofits, community foundations, private foundations, higher education, and faith-based organizations. See additional demographics details in the appendix.

The survey findings reveal several notable trends shaping how nonprofits manage investments, respond to growing complexity, and position their organizations for the future. Five key themes emerged:

  1. Portfolio sophistication is increasing as organizations face growing operational and governance demands.
  2. Private markets are reshaping liquidity management. 
  3. OCIO adoption is rising as organizations seek help managing complexity.
  4. AI adoption remains limited as organizations weigh time-saving opportunities against governance considerations.
  5. Risk management is extending beyond the portfolio.
Download the 2026 Endowment and Foundation Survey Executive Summary Here

To download a copy of the transcript, click here.

Additional Materials:

Speakers:

Interest in impact investing continues to grow, but success requires more than finding the right opportunity. It requires strategy, governance, and a realistic understanding of what’s possible.

In a recent episode of Mission +Markets, CAPTRUST’s Heather Shanahan and James Ross joined Spectrum Impact Founder and CEO Rehana Nathoo to discuss how nonprofit organizations can pursue both financial returns and mission outcomes. One message stood out: Before making the first investment, organizations need to understand themselves.

What Is Impact Investing?

Impact investing refers to investments made with the intention of generating both financial returns and measurable social or environmental outcomes. Nathoo describes it as investments in companies, funds, or organizations that seek to produce “not just financial returns, but then impact returns” as well.

For nonprofit organizations, this can create chances to support initiatives that align with their mission while still participating in investment markets. Examples may include affordable housing, community development, small-business growth, workforce development, renewable energy projects, or healthcare access initiatives.

Many nonprofits are hopping onboard. As Ross explained, organizations increasingly want “95 or 96 percent of their money supporting mission,” not just the 4 or 5 percent distributed through grants.

A Common Misconception

One of the most common misconceptions is that impact investing requires organizations to choose between doing good and earning a return.

Boards might initially view impact investing as a tradeoff—one where they either generate impact or generate investment returns. But the reality is more nuanced.

Like any investment strategy, impact investing involves evaluating risk, return objectives, liquidity requirements, and long-term portfolio goals. Some investments may offer market-rate returns. Others may involve compromises that organizations intentionally accept because they support a specific mission objective. The key is establishing clear expectations before capital is deployed.

As Nathoo explains, successful impact investors spend significant time understanding their goals, constraints, risk tolerance, liquidity needs, and definitions of success before evaluating specific opportunities.

Before Investing, Know What Success Looks Like

Many boards are intrigued by impact investing but struggle to move from curiosity to implementation. According to Nathoo, organizations considering an impact investing strategy should focus on three foundational elements:

“If this was possible easily,” Nathoo says, “impact investing would be all investing.”

Unlike traditional investments that may be evaluated largely on financial metrics, impact investments often require organizations to measure both financial performance and mission outcomes over time.

Results may not be immediate, and some initiatives may take years to demonstrate impact. For nonprofits accustomed to annual grant cycles or shorter board terms, that can require a different mindset.

Strategy Over Individual Investment

When organizations first explore impact investing, the conversation often centers on finding the right opportunity. Ross argues that approach can be risky. Instead, nonprofit leaders should first focus on developing a clear framework for how impact investments will support their mission. That means defining goals, identifying acceptable levels of risk and liquidity constraints, determining how success will be measured, and establishing a governance process for evaluating opportunities.

“It’s the strategy that protects you in both cases, in the upturns and the downswings,” Ross says.

A well-defined goal helps organizations assess investments consistently, align decisions with their mission and financial objectives, and stay on course when leadership, market conditions, or individual opportunities change.

Place-Based Investing: Opportunity and Complexity

For community foundations and organizations with deep local ties, place-based investing can be especially appealing.

“The place-based approach is basically saying, ‘We’d like to have our cake and eat it too, but we’d specifically like to do it in the communities that we serve,’” says Nathoo.

The challenge, however, is that narrowing the investment universe also narrows the pool of opportunities. In many communities, organizations may need to help build the local ecosystem before meaningful investments emerge.

Grants and Investments Shouldn’t Operate in Separate Silos

Nonprofits don’t have to choose between grantmaking and impact investing. In fact, the two can work well together.

Nathoo notes that many foundations forget that grants are often their greatest asset and source of expertise. Grantmaking can help strengthen ecosystems, build organizational capacity, and create the conditions necessary for future investments to succeed.

For example, a foundation focused on affordable housing might use grants to support community organizations, technical assistance providers, or early-stage development efforts. Over time, those investments can help create a stronger pipeline of projects capable of attracting mission-aligned investment capital.

Rather than viewing grants and investments as separate activities, nonprofit leaders may find greater success when they treat them as complementary tools working toward the same mission.

Looking Ahead

There is no one-size-fits-all approach. The most successful efforts tend to begin with clear goals, a well-defined strategy, and a realistic understanding of the trade-offs involved. For nonprofit leaders willing to take that first step, impact investing offers an opportunity to put more capital to work in service of the mission they already champion every day.

For many nongovernmental 401(k) plans and 403(b) plans, the December 31, 2026, SECURE 2.0 amendment deadline is quickly approaching. While the deadline is often viewed as a plan document exercise, retirement plan sponsors should view it as a broader opportunity to review plan operations, confirm compliance, and evaluate whether recent legislative changes align with their organization’s retirement benefits strategy.

The deadline generally applies to amendments related to the CARES Act, SECURE Act, SECURE 2.0 Act, the Bipartisan American Miners Act, and the Taxpayer Certainty and Disaster Tax Relief Act of 2020.

Why the 2026 Retirement Plan Amendment Deadline Matters

Many retirement plan provisions introduced since 2020 have already been implemented operationally. The amendment process is an opportunity to ensure those decisions are accurately reflected in plan documents and supported by administrative processes.

Plan sponsors should confirm their:

Failure to align documentation and operations can create unnecessary compliance risks and administrative challenges.

Key SECURE 2.0 Provisions to Review

As part of the amendment process, plan sponsors may want to revisit several provisions that can have a meaningful impact on plan administration and participant outcomes, including:

Not every provision applies to every plan, but reviewing these changes can help sponsors ensure their plan design remains aligned with organizational goals and workforce needs.

Questions Plan Sponsors Should Be Asking Now

With the deadline approaching, plan fiduciaries should begin evaluating several key questions:

  1. Which required and optional provisions has the plan already implemented?
  2. Are plan documents, payroll systems, and recordkeeper administration fully aligned?
  3. Has the plan’s document provider, recordkeeper, or TPA provided an amendment timeline?
  4. Are there optional provisions worth reconsidering as part of a broader plan design review?
  5. Has ERISA counsel reviewed the amendment before execution?

Addressing these questions early can help avoid last-minute issues and create more time for thoughtful decision-making.

Start Planning Early

Retirement plan amendments often require coordination among multiple service providers, including recordkeepers, TPAs, payroll vendors, and ERISA counsel. Waiting until the end of 2026 could limit flexibility and create unnecessary administrative pressure.

Instead, plan sponsors should begin reviewing their amendment requirements now, confirm past operational decisions, and work with their advisors and legal counsel to develop a clear implementation strategy.

The upcoming SECURE 2.0 amendment deadline for 401(k) and 403(b) plans is more than a compliance requirement. It’s an opportunity to verify plan administration, evaluate plan design enhancements, and position the retirement plan to better serve participants in the years ahead.

Source:

www.irs.com

Over the years, through regulation changes and plan design mandates, the three predominant types of defined contribution retirement plans—403(b), 401(k), and 457(b)—have grown more similar.

However, a number of key distinctions remain.

Understanding the nuances between these plan types can be daunting. But for those plan sponsors with a choice, like private tax-exempt 501(c)(3) charitable organizations, digging into the differences may help clarify which plan type, or combination of plan types, to offer. Below are the most significant distinctions among the three types of plans, in order of importance.

Employer Eligibility 

One of the primary differences is the type of employer eligible to sponsor a particular type of plan. For example, state and local governments, public colleges, and universities may not offer a 401(k) plan unless their state maintained a 401(k) plan that was established before 1987.

Likewise, private tax-exempt organizations that are not 501(c)(3) educational or charitable organizations, such as associations and clubs, may not maintain a 403(b) plan. And while public and private colleges and universities may maintain a 457(b) plan, the rules governing these plans vary widely depending on employer type.

Employer eligibility chart for 403(b), 401(k), and 457(b) plans

Nondiscrimination Testing

Nondiscrimination testing in 401(k) plans requires that highly compensated employees (HCEs), defined in 2026 as those earning more than $160,000 in 2025, stay within a specific contribution rate determined by the average contribution rate of non-highly compensated employees (NHCEs).

This testing is one of the key reasons why many private tax-exempt 501(c)(3) charitable entities, such as hospitals and colleges and universities, continue to use 403(b) plans instead of 401(k) plans. For 403(b) plans, it is unnecessary to test salary-deferred employee contributions. As a result, these HCEs have no additional limitations imposed on their ability to save other than the overall IRS 402(g) restrictions.

For example, in a typical private 501(c)(3) tax-exempt organization, unmatched elective deferrals for NHCEs average 2 percent (this average includes individuals not deferring anything). At this level, HCEs in a 401(k) plan are limited to approximately 5 percent of pay rather than the 2026 IRS limit of 100 percent of pay up to $24,500 per year (or $32,500 if age 50 or older, $35,750 if age 60-63). Thus, these higher-compensated plan participants face significantly restricted deferral limits, which are otherwise moot in a 403(b) plan.

A 457(b) plan presents the opposite problem for private tax-exempt entities. A 457(b) plan, sponsored by a private college or university that is not a 414(e) religious organization, is of limited use, since these top-hat plans are required to discriminate in favor of HCEs. Thus, they do not serve as the primary retirement plan for these organizations but are instead used as a supplemental plan for select groups of management employees.

An advantage of 457(b) plans is that employer contributions of any type can be discriminatory, whereas in 401(k) and 403(b) plans, employer contributions must be tested for nondiscrimination (with the exception of certain organization types exempt from testing).

Nondiscrimination testing is not a consideration for certain types of organizations. For example, governmental plans, such as those sponsored by public universities, are not subject to nondiscrimination testing, and 457(b) plans can be offered to all employees at these organizations.

401(a)(4) general nondiscrimination testing chart

ERISA Coverage

Another defining feature of 403(b) and 457(b) plans is that elective deferral-only plans of private 501(c)(3) charitable organizations are generally exempt from the Employee Retirement Income Security Act (ERISA). While this is uncommon among 403(b) plans, ERISA exemptions are not a possibility for 401(k) plans. Note, however, that public entities and churches are not subject to ERISA, regardless of plan type; churches may elect ERISA coverage, but it is rare. 

Private education employer 457(b) plans are technically subject to ERISA, but a single top-hat filing with the government essentially exempts the plan from ERISA requirements. 

For 403(b) plans to be exempt, plan sponsors must only permit elective deferrals (no employer contributions) and satisfy several other requirements that generally restrict employer involvement in the plan. This exemption means that for these plans, no summary plan descriptions are required, no annual Form 5500s or summary annual reports are required to be filed and distributed, and an annual audit is unnecessary—the audit alone can be a significant cost factor as well as an administrative burden. While the 403(b) exemption is not as attractive as it once was due to new regulatory requirements, the ERISA exemption remains an important option for 403(b) and 457(b) plans, one that is unavailable in the 401(k) world.  

ERISA compliance for 403(b), 401(k), and 457(b) plans

Universal Availability

The universal availability requirement is unique to 403(b) plans. Universal availability requires that all employees, with limited exceptions, be permitted to make elective deferrals from the date of hire. This contrasts with 401(k) plans, for which eligibility to make elective deferrals can be restricted, subject to nondiscrimination testing requirements. It is important to note that the recently enacted Setting Every Community Up for Retirement Enhancement (SECURE) Act now requires the inclusion of certain part-time employees in these 401(k) plans. 

Public 457(b) plans have no eligibility requirements, meaning that plan sponsors can allow all or any employees of their choosing to participate. As previously noted, private tax-exempt 457(b) plans can only permit select management and HCEs to participate. Additionally, independent contractors are permitted to participate in 457(b) plans, but not in 401(k) or 403(b) plans. 

Allowable exclusions in 403(b), 401(k), and 457(b) plans

Contribution Limits

While elective deferral limits to all three plan types are $24,500 in 2026, there are some other important contribution limit distinctions. In 457(b) plans, the limit on combined elective deferral and employer contributions is the same as the elective deferral limit ($24,500). In both 401(k) and 403(b) plans, the combined elective deferral, and employer contribution limit is significantly larger—up to $72,000 in 2026, depending on compensation.

While the combined 457(b) limits are lower, the 457(b) elective deferral limit is not offset by 401(k) or 403(b) deferrals. Thus, the maximum deferral limit of $24,500 may be contributed to a 457(b) plan, regardless of whether any deferrals or employer contributions have been made to a 403(b) or 401(k) plan. For organizations offering a combination of these plans, this presents an opportunity for a participant to contribute to both.

Special elections allow additional elective deferrals based on certain factors. The age 50 catch-up election, which expands the $24,500 limit in 2026 to $32,500, is available in 403(b), 401(k), and public 457(b) plans but is unavailable for 457(b) plans of private tax-exempt organizations. The same is true for the new Age 60-63 catch-up election under SECURE 2.0, which expands the $24,500 limit to $35,750.

Unique to 403(b) plans is the 15-year catch-up election, which allows a plan to permit employees who have 15 or more years of service and who satisfy additional requirements to defer up to an additional $3,000 beyond the 402(g) limit of $24,500 ($32,500 if age 50 or older, $35,750 if age 60-63) in 2025. However, this election can be complicated to calculate. The 457(b) election permits those in their final three years of employment prior to retirement to defer up to an additional $24,500 in 2026.

Contribution limits Chart 2026 for 403(b), 401(k), and 457(b) plans

Distributions

The 403(b) and 401(k) plans generally mirror each other in terms of distribution restrictions. For example, elective deferrals may not be withdrawn in either plan type until the attainment of age 59 1/2, termination of employment, hardship, death, or disability. 

However, 457(b) plans have different restrictions. Contributions may not be withdrawn until severance of employment, attainment of age 59 1/2 (70 1/2 for private tax-exempt organizations), or occurrence of an unforeseeable emergency (different rules than hardship withdrawals). For 457(b) plans at private tax-exempt organizations, there are additional restrictions as to the type of distributions that can be taken, and rollovers are not permitted. One advantage of 457(b) plans, however, is that the 10 percent excise tax for distributions prior to age 59 1/2 does not apply. 

Distribution restrictions in 403(b), 401(k), and 457(b) plans

Transfers and Exchanges

In 401(k) plans, the most common reason for plan-asset movement is employer-directed transfers due to the transition to a new recordkeeper. The situation is similar for 457(b) plans; however, some participants use plan-to-plan transfer provisions for cases in which a rollover is not permitted (i.e., private tax-exempt plans).

For 403(b) plans, there is more flexibility; however, even this has been somewhat restricted by the final 403(b) regulations that became effective a few years ago. Employers may transfer plan assets from one provider to another, but these transfers are more likely to be restricted at the provider contract level than in the case of a 401(k) plan. Plan participants may transfer plan assets in the form of an exchange to any approved provider in a 403(b) plan. Plan-to-plan transfers are also permitted, though employees often opt for a rollover instead.

Plan-to-plan transfers for 403(b), 401(k), and 457(b) plans

Payroll Taxes

Contributions from employers with 401(k) and 403(b) plans are generally not subject to payroll taxes, such as FICA or Medicare. Since 457(b) plans are deferred compensation plans rather than retirement plans, employer contributions are treated as compensation that is subject to payroll taxes.

FICA tax treatment chart for 403(b), 401(k), and 457(b) plans

Provider Availability

A myriad of recordkeepers service 401(k) plans. Meanwhile, 403(b) and 457(b) plan assets are concentrated among a smaller selection of vendors. While this relative lack of competition can affect pricing and marketplace advancements for larger plans, 401(k), 403(b), and 457(b) product and service offerings are often comparable. While it is not uncommon for multiple recordkeepers to be offered within a 403(b) plan, it is less frequent in 457(b) plans and rare in 401(k) plans. 

Investments

Another important distinction for 403(b) plans is their limitation in terms of the investment types that can be offered. In these plans, investment types are limited to 403(b)(1) fixed and variable annuities and 403(b)(7) custodial accounts (known more commonly as mutual funds). Investments that are permitted in 401(k) and 457(b) plans, like individual securities, are prohibited in 403(b) plans. As of this writing, there is legislation pending that would permit Collective Investment Trusts, or CITs in 403(b) plans, but that legislation has not been passed as yet. It should also be noted that some 457(b) plans are subject to investment-type restrictions by law. 

Investment options chart for 403(b), 401(k), and 457(b) plans

Providing a competitive retirement plan benefit is often an important component of an organization’s recruitment and retention efforts. Understanding the availability, benefits, and limitations of the different plan types can help plan sponsors craft and maintain the most impactful retirement plan offering.

In addition to the key distinctions listed above, Figure One provides a comprehensive comparison of the remaining similarities and differences between 403(b), 401(k), and 457(b) plans.  

Figure One: Digging Deeper into the Similarities and Differences of 403(b), 401(k), and 457(b) Plans

Plan document requirements and allowable coverage for 403(b), 401(k), and 457(b) plans
Maximum waiting period for 403(b), 401(k), and 457(b) plans
Elective deferrals and vesting options for 403(b), 401(k), and 457(b) plans
Loans and rollovers for 403(b), 401(k), and 457(b) plans

Automatic enrollment and Roth contributions for 403(b), 401(k), and 457(b) plans
Post-Employment Contributions Chart for 403(b), 401(k), and 457(b) plans
Catch-Up Contributions Chart for 403(b), 401(k), and 457(b) plans
Distribution options for 403(b), 401(k), and 457(b) plans
Distribution taxation on 403(b), 401(k), and 457(b) plans
Distribution tax reporting and required minimum distributions for 403(b), 401(k), and 457(b) plans
Deferrals to state income tax and excise tax on excess contributions for 403(b), 401(k), and 457(b) plans
ADP and ACP Testing on 403(b), 401(k), and 457(b) plans
401(b) coverage testing and 402(a)(17) compensation limit for 403(b), 401(k), and 457(b) plans
Trust requirement for 403(b), 401(k), and 457(b) plans
Compensation for 4980 excise tax on excess renumeration for nonprofit executives and uncorrected plan defect consequences on 403(b), 401(k), and 457(b) plans
Other important notes on 403(b), 401(k), and 457(b) plans
Plan document requirements for 403(b), 401(k), and 457(b) plans

For many plan sponsors, the word audit carries a sense of dread—images of errors and potential penalties. But in reality, a 401(k) audit is something much more constructive.

As Brad Bartels, CPA and partner at MUN CPAs, explains, “The audit is really about protecting the participants’ accounts… and it helps the plan sponsor and fiduciaries sleep better at night knowing that everything is in place.” It’s less about catching mistakes and more about ensuring the plan is operating as intended.

In a recent episode of Revamping Retirement, Bartels joined CAPTRUST’s Jennifer Doss and Pete Ruffel to unpack what audits involve, where sponsors tend to go wrong, and how to approach the process with confidence.

A Different Way to Think About Audits

A 401(k) audit serves three groups:

Rather than acting as an enforcer, auditors play more of an advisory role—providing an independent check that systems, processes, and reporting are functioning appropriately.

“The auditors are not coming in to get you in trouble,” says Bartels. “The goal is to help make the plan better and identify issues before they become bigger problems.”

What Audits Are—And Aren’t

One of the biggest challenges plan sponsors face is understanding the scope of an audit.

An audit does not:

Instead, auditors work through sampling and testing, reviewing select transactions and processes to assess whether controls are working as expected. A clean audit opinion reflects no material findings, not a flawless plan.

The 401(k) Audit Process

Plan sponsors might underestimate how much work happens before the audit begins. The process starts weeks in advance, with auditors gathering data, reviewing prior activity, and selecting samples for testing. Typically, they will request an audit package from custodians and administrators three to four weeks before fieldwork begins.

Auditors rely heavily on plan sponsors for information—especially when it comes to payroll, employee records, and plan operations. That means plan sponsors should expect to be actively involved, particularly during audit days.

“A lot of questions come up about compensation and payroll,” says Bartels. “We need plan sponsors to be available so we can keep things moving.”

What a Well-Prepared Plan Sponsor Looks Like

Preparation can dramatically influence the audit experience. The most effective sponsors tend to share a few common traits:

Records of committee decisions, fiduciary reviews, and fee monitoring help establish a strong governance and helps establish a compliant foundation.

Common Pitfalls to Watch For

While every plan is different, a handful of issues come up consistently during audits. Many are preventable with a bit more coordination and oversight.

1. Late contributions

Employee deferrals must be remitted to the plan as soon as administratively feasible. In practice, that standard is based on the plan sponsor’s track record.

2. Compensation definition errors

Mismatches between plan documents and payroll operations are a frequent source of trouble. For example:

Because many plans define eligible compensation broadly (e.g., all W-2 wages), these inconsistencies can lead to underfunded contributions and required corrections.

3. Lack of documentation

Failing to document oversight activities, such as committee meetings or investment reviews, creates unnecessary risk. Without documentation, it’s difficult to demonstrate fiduciary diligence, particularly in the case of a regulatory inquiry.

4. Ignoring SOC 1 reports

Service providers such as recordkeepers and payroll vendors issue SOC 1 reports to outline their internal financial processing controls. Reviewing these reports and documenting that review is part of a sponsor’s fiduciary responsibility.

Choosing the Right Audit Partner

For sponsors selecting an auditor, specialization matters. Retirement plan audits are highly technical, and experience in the space can make a difference. Key considerations include:

A knowledgeable auditor not only improves audit efficiency but can also help identify emerging risks and best practices.

The Case for Starting Early

If there’s one consistent piece of advice from auditors, start early. Waiting too long can create scheduling challenges, limit preparation time, and increase the likelihood of delays or issues.

“The sponsors who are proactive have a much smoother experience,” says Bartels. “They identify potential issues sooner, and they’re better positioned to resolve them.”

A Process Designed to Protect

401(k) audits function as a built-in checkpoint. They help plan sponsors validate their processes, strengthen oversight, and protect plan participants. And while they may never be anyone’s favorite task, they offer something valuable in return… confidence.