403(b) plan audits: when a 403(b) needs one, and how it differs from a 401(k)

Does your 403(b) plan need an audit?

Three questions, in order:

1. Is the plan covered by ERISA? The Form 5500 rules, and so the audit, apply to 403(b) plans subject to Title I of ERISA. Governmental plans and church plans are not.^[1] The next section covers the safe harbor for employee-funded programs.
2. Does it have 100 or more participants with an account balance on the first day of the plan year? Then it files as a large plan and needs an audit. A plan filing its first return counts at the end of the year instead.^[1]
3. If it is under the line, does it meet the small plan audit waiver conditions? Check before assuming it does. How the count, the 80 to 120 rule and the waiver work.

Is your 403(b) covered by ERISA?

Usually, for a nonprofit employer that is not a church. The exception is the DOL’s safe harbor. A 403(b) program funded by employees’ salary reduction is not treated as an employer’s ERISA plan if all of these hold:^[2]

• participation is completely voluntary for employees;
• all rights under the annuity contract or custodial account are enforceable only by the employee, a beneficiary or their authorized representative;
• the employer’s involvement is limited to tasks the regulation lists, such as letting vendors publicize their products, collecting and remitting deferrals, and limiting the choice of vendors to a reasonable selection; and
• the employer receives nothing beyond reasonable reimbursement of its expenses.

A program with employer contributions, such as a match, is not one funded only by salary reduction, so it falls outside that description. Where a plan sits close to the line, the DOL’s bulletins on 403(b) coverage are the place to start, and the call is one for your ERISA counsel.^[4]

What about annuity contracts from before 2009?

Some 403(b) plans carry older individual contracts with vendors the employer no longer uses. Under DOL Field Assistance Bulletin 2009-02, the administrator need not treat such a contract or account as a plan asset if all four of these are true:^[3]

• it was issued to a current or former employee before January 1, 2009;
• the employer stopped having any obligation to contribute, and in fact stopped contributing, to it before January 1, 2009;
• the individual can enforce all rights under it against the insurer or custodian without any involvement by the employer; and
• the individual is fully vested in it.

Contracts that qualify can be left out of the plan’s financial statements. The DOL said it would not reject a Form 5500 because the auditor’s opinion is qualified, adverse or disclaimed, if the auditor states that the only reason is that those pre-2009 contracts were not covered by the audit.^[3]

What does a 403(b) audit look at that a 401(k) audit doesn’t?

• Universal availability. If any employee can make elective deferrals, every employee must be allowed to, apart from listed exclusions such as employees who normally work fewer than 20 hours a week, certain students and nonresident aliens.^[5]
• Long-term, part-time employees. For plan years beginning after December 31, 2024, an ERISA 403(b) cannot make an employee wait longer than two consecutive 12-month periods of at least 500 hours (and age 21) before letting them defer.^[7]
• No ADP test on deferrals. The IRS states that the ADP test is not used to test discrimination in 403(b) plans. Matching and after-tax employee contributions are still tested under section 401(m).^[6]
• The 15-year catch-up. Employees with at least 15 years of service may be able to contribute more, in addition to the age-50 catch-up.^[8]
• Several vendors. A 403(b) often holds money with more than one insurer or custodian, each with its own statements, which the auditor has to tie together.

What does Ledgerline audit?

401(k) and 403(b) plans. We’re building an audit firm around those two plan types and booking engagements for the coming season, starting December 2026. How a Ledgerline audit works, or employee benefit plan audits in general.

Frequently asked questions