\n
![](\"https:\/\/media.anderscpa.com\/prod\/uploads\/2025\/03\/First-Time-401k-Plan-Audit-Guide-Rules-Deadlines-and-Requirements-1024x512.png\")
<\/p>\n
\n<\/p>\n
Your company\u2019s first 401(k) plan audit<\/a> is due; do you know where to start? Plan sponsors and administrators<\/a> have a fiduciary duty towards the plan, so ensuring your audit begins and ends on time is essential. The first step to a successful audit is avoiding the urge to panic. Your first plan audit will be a lengthy process, more than any subsequent audit, so enter it with full knowledge of the process and best practices that keep it on deadline.<\/p>\n Your plan recordkeeper will typically be the one to inform you when your plan is ready to be audited. The threshold for a 401(k) plan audit is 100 or more active participants as of January 1 of that plan year. The operative word is \u201cactive.\u201d Previously, all eligible participants were part of the count, but the count has been changed to include only active participants. You should also keep a close eye on the date. Even if you performed layoffs on January 2 of the plan year, you\u2019ll still have to use January 1 numbers.<\/p>\n This is also relevant in the case of a plan termination. If you terminate the plan on February 1, you may still need an audit for the year since the number of active participants drives the audit. Be sure to closely review your active participant count to ensure accuracy since this figure will be reported on your Form 5500<\/a>. If you outsource, your third-party administrator might report that you have 120 active participants, but your own internal counts show 80. Verify those figures and get them corrected on your Form 5500. This could mean you don\u2019t need an audit at all.<\/p>\n This will become an annual process as long as you stay above 100 participants.<\/p>\n Before the audit process can start, you must first find an auditor; as the plan sponsor, that is your responsibility. An audit must be conducted by a third-party, licensed CPA in your state. However, even if you have licensed CPAs in your organization, they are not allowed to conduct the audit because they\u2019re not independent of the entity they\u2019re supposed to audit. \u00a0A 401(k) plan audit requires specialized training and experience. Find a CPA firm in your area with a history of employee benefit plan audits or ask your CPA if they can recommend an auditor.<\/p>\n Kick off your first discussion with any potential auditor by focusing on the expected timeline to ensure their schedule aligns with yours, enabling you to meet all deadlines which, again, is your responsibility as the sponsor. During your initial conversations with potential auditors, keep in mind that price is important, but you get what you pay for. An audit must be done correctly and completely. Otherwise, your 401(k) plan audit could itself be audited. As the plan sponsor, you would be responsible and would be required to essentially pay for a second audit.<\/p>\n Keep in mind that your auditor will require a lot of information throughout the audit process. The plan sponsor is responsible for providing them with the information they need and ensuring that the audit is completed correctly. Even if your auditor fails to get the information from your third-party administrator<\/a>, you\u2019re still on the hook.\u00a0<\/p>\n Determine whether you\u2019d prefer an in-person or fully remote 401(k) audit<\/a>. Some businesses may not have a physical office, while others still use paper rather than digital files. These factors should influence your decision-making. A remote auditor won\u2019t come to your location, so paper-dependent businesses would have to scan and upload any requested documents, creating a potential roadblock.<\/p>\n The audit must be completed by the seventh month of the plan year, culminating in a filled-out Form 5500, which is an informational return. If you have a calendar plan year, your audit will finish by the end of July. You are allowed to file for an extension to file your Form 5500, and for your first 401(k) plan audit<\/a>, you\u2019ll likely need that extension. The extension takes you to the middle of the tenth month of the plan year, typically October 15. \u00a0<\/p>\n The end result of a 401(k) plan audit is a packet of financial statements that support what\u2019s reported in your Form 5500. It will also include supplemental schedules and an audit opinion letter that will be documented on Form 5500. To complete the last step of the audit, you must file the packet with your Form 5500.<\/p>\n Your auditor will send you an engagement letter<\/a>, a legally binding contract that contains the details of your agreement on the services your auditor will provide as part of the planning process. The main purpose of an engagement letter is to outline management\u2019s responsibilities for both the audit and the financial statements, explain the scope of the audit and state the fees for all deliverables, including the audit itself, as well as financial statements.<\/p>\n Once you\u2019ve had the letter reviewed by an attorney and signed it, the auditor will perform a plan document review. At this point, the auditor will request copies of your current plan document, your adoption agreement, your opinion letter and any amendments: past, present and future.<\/p>\n As part of the planning process, your auditor will also perform a walkthrough of different types of transactions to try to understand your relationship with your service providers and what they do for the plan. This may include your payroll provider, plan trustee, custodian and recordkeeper. Your auditor wants to understand your company\u2019s payroll processes for deferral remittances and other internal controls<\/a> as well as anyone else\u00a0involved in the plan.<\/p>\n Over the course of the audit, your auditor will examine the lifecycle of a participant by taking samples at random to ensure you follow all your processes. They won\u2019t look at everyone, but they\u2019ll try to make the samples as representative as possible of the whole population. They\u2019ll check for any compliance issues and ensure everything was correctly recorded in the financial statements. If they discover any issues with this testing, they\u2019ll work with you to figure out what went wrong and where.<\/p>\n There are two main paths that an audit covers: financial statements and compliance.<\/p>\n On this path, your auditor works to verify the accuracy and completeness of the financial statements that will be included in a set of financial statement disclosures in your final packet, providing further clarity on those statements.<\/p>\n Although your auditor won\u2019t provide an opinion on compliance, they are still required by the Department of Labor and the IRS to review compliance-related aspects of the plan. They\u2019ll check to make sure you\u2019re complying with your plan provisions, with ERISA regulations, with current DOL and IRS regulations in addition to other current congressional acts that may apply to the plan. Your auditor will perform a risk assessment, which involves determining the risk that you\u2019re not complying, that you made an error or that the financial statements themselves aren\u2019t correct. From that assessment, they\u2019ll determine their procedures.<\/p>\n As your auditor wraps up their activities and begins preparing your packet, they\u2019ll reconcile the financial statements it contains to Form 5500 to ensure those statements match what\u2019s on Schedule H of the 5500. They\u2019ll also provide you with a management representation letter which the plan administrator or plan trustee will have to sign. It\u2019s typically a three-to-four-page letter listing everything you did during the audit. It\u2019ll also include the information that you provided and the discussions you had with your auditor. A signature verifies that you were truthful, you didn\u2019t withhold information and you provided full access to everything your auditor requested. Your audit report can\u2019t be issued without this letter.<\/p>\n In the final phases of your audit, your auditor will address any issues that come up and discuss events that will affect next year\u2019s plans. They may also provide plan process improvement suggestions. Don\u2019t take these optional suggestions personally: they\u2019re not a critique but instead meant to help you improve your plan. Trust that you\u2019d rather hear these suggestions from your auditor, rather than the DOL, the IRS or a lawsuit.<\/p>\n401(k) Plan Audit Threshold \u00a0<\/h2>\n
Selecting a 401(k) Plan Auditor<\/h2>\n
Basics of a 401(k) Plan Audit<\/h2>\n
First Steps in the 401(k) Plan Audit Process<\/h2>\n
401(k) Plan Financial Statements<\/h3>\n
401(k) Plan Compliance<\/h3>\n
401(k) Plan Audit Final Steps<\/h2>\n