401(k) Audit Requirements: When Is Your Plan Required to File?

If your company sponsors a 401(k) plan, you are likely required to file Form 5500 with the Department of Labor each year. What many plan sponsors do not realize is that plans classified as "large plans" must attach an independent auditor's report to that filing. Failing to include a required audit -- or including an inadequate one -- exposes the plan sponsor to significant civil penalties. Understanding when the audit requirement kicks in, how the participant counting rules work, and what the DOL looks for is essential for any HR director or CFO managing a company retirement plan.

The 100-Participant Threshold

Under ERISA regulations, a 401(k) plan is classified as a "large plan" and must include an independent audit with its Form 5500 when it has 100 or more participants at the beginning of the plan year. For defined contribution plans, plan years beginning on or after January 1, 2023 count only participants with account balances -- current employees, former employees and beneficiaries who still have money in the plan. Employees who are eligible but have never contributed no longer count. Former employees with small lingering balances still do, which is why many sponsors cross 100 sooner than expected; distributing or rolling over small balances can keep the count down.

The 80-120 Rule: A Safe Harbor for Growing Plans

ERISA provides a practical transition rule for plans hovering near the 100-participant threshold. Under the 80-120 rule (29 CFR 2520.103-1(d)), if your plan has between 80 and 120 participants with account balances at the beginning of the plan year, you may file in the same category -- small or large -- that you used for the prior year. A plan that filed as a small plan last year can therefore keep filing as a small plan, without an audit, while it stays at 120 participants or fewer. Once the count at the start of a plan year exceeds 120, the plan must file as a large plan and obtain an audit.

DOL Penalties for Missing the Required Audit

The Department of Labor takes plan audit requirements seriously. Under ERISA Section 502(c)(2), the DOL may assess civil penalties of up to $250 per day for each day a Form 5500 is late or deficient, with a maximum penalty of $150,000 per filing. A Form 5500 filed without a required audit opinion is treated as an incomplete filing -- which triggers these penalties. In addition to civil penalties, the DOL may reject the filing entirely, leaving the plan technically non-compliant. Plan sponsors who discover they missed several years of required audits face the challenge of filing delinquent returns through the DOL's Delinquent Filer Voluntary Compliance (DFVC) Program, which offers reduced penalties for voluntary correction.

Limited Scope vs. Full Scope Audit

Until recent standards changes, most 401(k) audits were performed as "limited scope" audits under DOL regulations, meaning the auditor did not audit investment information certified by a qualified institution (such as a bank or insurance company holding plan assets). This certification exception significantly reduced audit scope and cost. The AICPA's Statement on Auditing Standards No. 136 (SAS 136), effective for plan years ending on or after December 15, 2021, fundamentally changed this. The old "limited scope" terminology was replaced with "ERISA Section 103(a)(3)(C) audit," but more importantly, SAS 136 significantly expanded auditor procedures even when the certified institution exception is used. Auditors must now perform more extensive testing of participant data, plan provisions, and internal controls regardless of whether the certified institution exception applies.

Form 5500 Deadline

The Form 5500 is due seven months after the close of the plan year. For calendar-year plans (the most common), the deadline is July 31. Plan sponsors can request a 2.5-month extension using Form 5558, extending the deadline to October 15. The plan audit must be completed and the auditor's report attached before the 5500 is filed -- which means starting the audit engagement well before the filing deadline. Most plan sponsors begin working with their auditor in March or April for calendar-year plans, with fieldwork in May or June to allow time for the audit to be finalized before the October extension deadline.

Common DOL Audit Findings

When the DOL reviews Form 5500 filings and selected plan audits, certain deficiencies appear repeatedly. Timely remittance failures are the most common: employee deferrals and loan repayments must be deposited to the plan as soon as administratively feasible, generally within three to five business days for smaller employers. Late deposits require correction through the DOL's Voluntary Correction Program and may require the employer to pay lost earnings. Eligibility and enrollment errors occur when employees are enrolled late or excluded from participation. Loan administration failures include loans that exceed the maximum permitted amount (the lesser of $50,000 or 50% of the vested account balance), missing promissory notes, or loans with incorrect repayment terms. Missing or outdated plan documents are a frequent finding: plan documents must reflect all plan amendments and be updated for law changes.

How to Prepare for a 401(k) Audit

Preparation for a plan audit starts with your plan administrator and record-keeper. Your auditor will request the plan document and all amendments, the plan's trust agreement, the prior year Form 5500 and audit report, participant census data as of the beginning and end of the year, payroll records supporting deferral calculations, evidence of timely remittance of contributions, loan documentation, and distribution records. Many plan sponsors find that their record-keepers can provide most of this information directly to the auditor, which significantly reduces the administrative burden on HR and accounting staff. Working with an auditor who specializes in employee benefit plan audits -- one who understands the specific requirements of ERISA and has experience with the DOL's audit focus areas -- is essential for a smooth, efficient engagement.