401(k) audit checklist: the documents your auditor will ask for

What is on a 401(k) audit checklist?

This is the checklist a Ledgerline engagement uses, grouped by who holds each item so nobody is asked for something they do not have. Any plan auditor will ask for nearly all of it, because most items are required by the auditing standard or the DOL’s rules, as the next section shows.

Some lines cover more than one item: the SOC 1 line is one report for each service organization, for instance. The same list, and how the engagement runs around it, is on how a Ledgerline 401(k) audit works.

Why does the auditor need each document?

Because the audit has to test the plan against its own terms and against ERISA, and these records are the evidence. The ones sponsors ask about most:

Two more rules sit behind the list. Whatever the scope, the auditor has to be satisfied that contributions received and benefits paid were worked out under the plan’s provisions, which is why distribution forms, loan agreements and the census are on it.^[1] And the financial statements need notes covering the plan, its funding policy and its dealings with parties in interest, which is why service agreements and the general ledger are there too.^[6]

Which documents take longest to arrive?

The ones held outside your company. The recordkeeper’s year-end package is often the slowest item, and SOC 1 reports come out on the recordkeeper’s or custodian’s own schedule, which is why a bridge letter covers any gap to your plan’s year end. Ask your TPA for those on the day the audit is engaged, and gather your own items while you wait.

Payroll is the other common delay, because the register has to show every pay date and the date each deferral reached the plan. Connecting your payroll provider supplies the census and payroll register directly, so neither has to be exported and sent.

What are a SOC 1 report and a bridge letter?

A SOC 1 Type 2 report is written by the service provider’s own auditor and describes the controls over the work it does for client plans, such as processing contributions and distributions, with the results of testing those controls over a period. A plan auditor reads it to understand what the recordkeeper, custodian or TPA does and which controls your own team is expected to have in place alongside it. Those are the user controls listed in the report, such as reviewing the contribution files sent to the recordkeeper.

The report rarely ends on your plan’s year end. A bridge letter from the provider covers the gap, stating whether anything has changed since the period the report tested. If your payroll provider has a SOC 1 too, it belongs on the list.

Who should coordinate the checklist?

One person on the sponsor’s side, usually in HR or finance, who can chase the other two groups. The TPA usually gathers the recordkeeper and custodian items, and the auditor directs follow-up questions to whoever holds each item. Agreeing at the start who holds what is most of the work, which is why the checklist is split that way.

What if a document does not apply to your plan?

Mark it not applicable and give a one-line reason: no loan program, no hardship withdrawals this year, payroll run in house so there is no payroll provider SOC 1. A reason up front saves the follow-up question later.

Does a limited scope audit need fewer documents?

Hardly. An ERISA 103(a)(3)(C) audit lets the auditor rely on a bank’s or insurer’s certification of the investments it holds, but participant data, contributions, benefit payments and account balances are audited either way.^[1] The certification itself becomes one more item, and it has to certify both accuracy and completeness.^[3] Which scope your plan can use covers the choice.

Does a first audit need more?

Yes, a little. A first auditor also has to get comfortable with the balances the plan started the year with, so expect requests for the prior year-end statements and, if the plan filed one, last year’s Form 5500. What a first auditor actually looks at walks through it.

When should you start gathering?

As soon as you know the plan needs an audit. A plan generally needs one once it has 100 participants with an account balance on the first day of the plan year: how the count works, or run your numbers through the audit requirement checker on 401kaudithelp.com. The audit itself is 40 to 60 hours of work once the documents are in, so how fast they arrive sets the calendar. The Form 5500 deadline calculator gives the date you are working back from. If it is already close, see your options when the audit will not be done, or what to do after missing it.

The order of events from engagement letter to signed report is in the 401(k) audit process.

Frequently asked questions