401(k) Audit Requirements: When Is Your Plan Required to File?

If your company sponsors a 401(k) plan, you are likely required to file Form 5500 with the Department of Labor each year. What many plan sponsors do not realize is that plans classified as "large plans" must attach an independent auditor's report to that filing. Failing to include a required audit -- or including an inadequate one -- exposes the plan sponsor to significant civil penalties. Understanding when the audit requirement kicks in, how the participant counting rules work, and what the DOL looks for is essential for any HR director or CFO managing a company retirement plan.

The 100-Participant Threshold

Under ERISA regulations, a 401(k) plan is classified as a "large plan" and must include an independent audit with its Form 5500 when it has 100 or more eligible participants at the beginning of the plan year. The critical word is "eligible" -- not active contributors or current employees. Eligible participants include: current employees eligible to participate in the plan (whether or not they have chosen to contribute), former employees with vested account balances, and beneficiaries of deceased participants who are receiving or entitled to receive benefits. This definition is broader than many plan sponsors realize. A company with 85 active employees who all contribute to the 401(k) might still cross 100 eligible participants once former employees with lingering balances are counted.

The 80-120 Rule: A Safe Harbor for Growing Plans

ERISA provides a practical transition rule for plans hovering near the 100-participant threshold. If your plan had fewer than 121 eligible participants at the beginning of the prior plan year and you filed as a small plan last year, you may continue to file as a small plan this year -- even if participant count has grown above 100. This "80-120 rule" allows plans to avoid the audit requirement until they clearly and consistently exceed 120 participants. Importantly, this is a one-time, renewable election: if your plan drops back below 100 eligible participants, you can revert to small plan status. Once you cross 121 participants for two consecutive years, however, you become a large plan and must obtain an audit.

DOL Penalties for Missing the Required Audit

The Department of Labor takes plan audit requirements seriously. Under ERISA Section 502(c)(2), the DOL may assess civil penalties of up to $250 per day for each day a Form 5500 is late or deficient, with a maximum penalty of $150,000 per filing. A Form 5500 filed without a required audit opinion is treated as an incomplete filing -- which triggers these penalties. In addition to civil penalties, the DOL may reject the filing entirely, leaving the plan technically non-compliant. Plan sponsors who discover they missed several years of required audits face the challenge of filing delinquent returns through the DOL's Delinquent Filer Voluntary Compliance (DFVC) Program, which offers reduced penalties for voluntary correction.

Limited Scope vs. Full Scope Audit

Until recent standards changes, most 401(k) audits were performed as "limited scope" audits under DOL regulations, meaning the auditor did not audit investment information certified by a qualified institution (such as a bank or insurance company holding plan assets). This certification exception significantly reduced audit scope and cost. The AICPA's Statement on Auditing Standards No. 136 (SAS 136), effective for plan years ending on or after December 15, 2021, fundamentally changed this. The old "limited scope" terminology was replaced with "ERISA Section 103(a)(3)(C) audit," but more importantly, SAS 136 significantly expanded auditor procedures even when the certified institution exception is used. Auditors must now perform more extensive testing of participant data, plan provisions, and internal controls regardless of whether the certified institution exception applies.

Form 5500 Deadline

The Form 5500 is due seven months after the close of the plan year. For calendar-year plans (the most common), the deadline is July 31. Plan sponsors can request a 2.5-month extension using Form 5558, extending the deadline to October 15. The plan audit must be completed and the auditor's report attached before the 5500 is filed -- which means starting the audit engagement well before the filing deadline. Most plan sponsors begin working with their auditor in March or April for calendar-year plans, with fieldwork in May or June to allow time for the audit to be finalized before the October extension deadline.

Common DOL Audit Findings

When the DOL reviews Form 5500 filings and selected plan audits, certain deficiencies appear repeatedly. Timely remittance failures are the most common: employee deferrals and loan repayments must be deposited to the plan as soon as administratively feasible, generally within three to five business days for smaller employers. Late deposits require correction through the DOL's Voluntary Correction Program and may require the employer to pay lost earnings. Eligibility and enrollment errors occur when employees are enrolled late or excluded from participation. Loan administration failures include loans that exceed the maximum permitted amount (the lesser of $50,000 or 50% of the vested account balance), missing promissory notes, or loans with incorrect repayment terms. Missing or outdated plan documents are a frequent finding: plan documents must reflect all plan amendments and be updated for law changes.

How to Prepare for a 401(k) Audit

Preparation for a plan audit starts with your plan administrator and record-keeper. Your auditor will request the plan document and all amendments, the plan's trust agreement, the prior year Form 5500 and audit report, participant census data as of the beginning and end of the year, payroll records supporting deferral calculations, evidence of timely remittance of contributions, loan documentation, and distribution records. Many plan sponsors find that their record-keepers can provide most of this information directly to the auditor, which significantly reduces the administrative burden on HR and accounting staff. Working with an auditor who specializes in employee benefit plan audits -- one who understands the specific requirements of ERISA and has experience with the DOL's audit focus areas -- is essential for a smooth, efficient engagement.