Rethinking 401(k) Audits

For many plan sponsors, the word audit carries a sense of dread—images of errors and potential penalties. But in reality, a 401(k) audit is something much more constructive.

As Brad Bartels, CPA and partner at MUN CPAs, explains, “The audit is really about protecting the participants’ accounts… and it helps the plan sponsor and fiduciaries sleep better at night knowing that everything is in place.” It’s less about catching mistakes and more about ensuring the plan is operating as intended.

In a recent episode of Revamping Retirement, Bartels joined CAPTRUST’s Jennifer Doss and Pete Ruffel to unpack what audits  involve, where sponsors tend to go wrong, and how to approach the process with confidence.

A Different Way to Think About Audits

A 401(k) audit serves three groups:

• Participants, by protecting the integrity of their accounts
• Plan sponsors, by supporting compliance with ERISA
• Regulators, by reinforcing plan oversight and controls

Rather than acting as an enforcer, auditors play more of an advisory role—providing an independent check that systems, processes, and reporting are functioning appropriately.

“The auditors are not coming in to get you in trouble,” says Bartels. “The goal is to help make the plan better and identify issues before they become bigger problems.”

What Audits Are—And Aren’t

One of the biggest challenges plan sponsors face is understanding the scope of an audit.

An audit does not:

• Guarantee full ERISA compliance
• Evaluate the quality or performance of investments
• Review every participant account
• Fix plan errors on behalf of the sponsor

Instead, auditors work through sampling and testing, reviewing select transactions and processes to assess whether controls are working as expected. A clean audit opinion reflects no material findings, not a flawless plan.

The 401(k) Audit Process

Plan sponsors might underestimate how much work happens before the audit begins. The process starts weeks in advance, with auditors gathering data, reviewing prior activity, and selecting samples for testing. Typically, they will request an audit package from custodians and administrators three to four weeks before fieldwork begins.

Auditors rely heavily on plan sponsors for information—especially when it comes to payroll, employee records, and plan operations. That means plan sponsors should expect to be actively involved, particularly during audit days.

“A lot of questions come up about compensation and payroll,” says Bartels. “We need plan sponsors to be available so we can keep things moving.”

What a Well-Prepared Plan Sponsor Looks Like

Preparation can dramatically influence the audit experience. The most effective sponsors tend to share a few common traits:

• They treat auditors as partners, not adversaries
• They assign a single point person to manage communication
• They verify key data early, especially payroll-based census reports
• They meet deadlines for document requests
• They maintain organized oversight records, including committee minutes

Records of committee decisions, fiduciary reviews, and fee monitoring help establish a strong governance and helps establish a compliant foundation.

Common Pitfalls to Watch For

While every plan is different, a handful of issues come up consistently during audits. Many are preventable with a bit more coordination and oversight.

1. Late contributions

Employee deferrals must be remitted to the plan as soon as administratively feasible. In practice, that standard is based on the plan sponsor’s track record.

2. Compensation definition errors

Mismatches between plan documents and payroll operations are a frequent source of trouble. For example:

• Bonuses not included in deferrals
• PTO payouts excluded
• Off-cycle payroll runs missing contributions

Because many plans define eligible compensation broadly (e.g., all W-2 wages), these inconsistencies can lead to underfunded contributions and required corrections.

3. Lack of documentation

Failing to document oversight activities, such as committee meetings or investment reviews, creates unnecessary risk. Without documentation, it’s difficult to demonstrate fiduciary diligence, particularly in the case of a regulatory inquiry.

4. Ignoring SOC 1 reports

Service providers such as recordkeepers and payroll vendors issue SOC 1 reports to outline their internal financial processing controls. Reviewing these reports and documenting that review is part of a sponsor’s fiduciary responsibility.

Choosing the Right Audit Partner

For sponsors selecting an auditor, specialization matters. Retirement plan audits are highly technical, and experience in the space can make a difference. Key considerations include:

• The firm’s volume of retirement plan audits
• Participation in the AICPA Employee Benefit Plan Audit Quality Center
• Results of peer reviews and audit quality checks
• Ongoing staff training in ERISA and regulatory updates
• Involvement in industry groups and education

A knowledgeable auditor not only improves audit efficiency but can also help identify emerging risks and best practices.

The Case for Starting Early

If there’s one consistent piece of advice from auditors, start early. Waiting too long can create scheduling challenges, limit preparation time, and increase the likelihood of delays or issues.

“The sponsors who are proactive have a much smoother experience,” says Bartels. “They identify potential issues sooner, and they’re better positioned to resolve them.”

A Process Designed to Protect

401(k) audits function as a built-in checkpoint. They help plan sponsors validate their processes, strengthen oversight, and protect plan participants. And while they may never be anyone’s favorite task, they offer something valuable in return… confidence.