401(k) audit process: what happens, from engagement letter to signed report

Who starts a 401(k) audit, and why?

The plan administrator does, because ERISA says so. Section 103(a)(3)(A) requires the administrator to engage an independent qualified public accountant, on behalf of all plan participants, to examine the plan’s financial statements and give an opinion that becomes part of the annual report.^[1] If the plan document does not name an administrator, the plan sponsor is the administrator.^[2]

A 401(k) plan needs the audit once it files the Form 5500 as a large plan, which usually means 100 or more participants with an account balance on the first day of the plan year. How that count works is its own guide, and the free audit requirement checker on 401kaudithelp.com answers it for your numbers. The signed report is not optional paperwork: the DOL says a large-plan Form 5500 filed without it is subject to rejection as incomplete.^[6]

What are the steps of a 401(k) audit?

The sections below take each step in turn.

What does the engagement letter commit the plan to?

More than the fee. Before accepting an ERISA plan audit, the auditor has to get management’s agreement that it understands its own responsibilities: keeping a current plan document with every amendment, and administering the plan so that its transactions follow the plan’s terms, with records good enough to work out each participant’s benefits.^[3] Management also agrees to hand over a substantially complete draft of the Form 5500 before the report is dated.^[3]

If the plan elects an ERISA 103(a)(3)(C) audit, often still called limited scope, the letter adds that management has determined the election is allowed and the bank’s or insurer’s certification qualifies.^[3] Which scope your plan can use covers that decision.

What does the auditor do during planning?

Reads the plan document. The standard requires the auditor to obtain and read the most current plan instrument for the audit period, including effective amendments, and to consider the plan provisions that affect the risk of a misstatement when designing the tests.^[3] That is why the auditor wants the signed plan document and the adoption agreement even when nothing changed this year.

Planning also covers the plan’s tax status. The auditor considers whether management ran the required compliance tests, including nondiscrimination testing, and has corrected any failures or intends to.^[3] In practice your TPA’s testing results are among the first documents asked for.

Which documents does the auditor ask for?

Plan documents and the bond from HR, recordkeeper and trust records through the TPA, and payroll and the general ledger from finance. The full list, split by who holds each item, is in the 401(k) audit checklist. Gathering is usually the longest step, and the one the sponsor controls most.

What does the auditor test?

Whatever the scope of the audit, the auditor has to be satisfied that money received and paid out by the trustee or custodian, such as employee and employer contributions and benefit payments, was determined under the plan’s provisions.^[3] In practice that means:

• contributions traced from payroll to the trust, with the employer match recalculated from the plan formula;
• eligibility and entry dates checked against the plan document;
• distributions, loans and hardship withdrawals checked for approval and support;
• participant account balances agreed to the trust’s net assets; and
• investments tested, unless a qualified institution certified them under a 103(a)(3)(C) election.

Deposit timing gets particular attention. Employee deferrals become plan assets on the earliest date they can reasonably be separated from the employer’s own money, and for a pension plan never later than the 15th business day of the month after the month they would have been paid in cash.^[5] That 15th business day is an outer limit, not a safe harbor. A large plan reports late deposits on Schedule H line 4a, with a schedule of delinquent participant contributions that the auditor reports on.^[6]

How long does a 401(k) audit take?

40 to 60 hours of audit work, once every document is in hand. Most of the time between signing the engagement letter and receiving the report is spent waiting for documents, not doing the audit, so the fastest way to shorten the calendar is to send the checklist items early and complete.

The report has to be ready for the filing. When your plan’s Form 5500 is due, and how far an extension moves it, depends on the plan year; the Form 5500 deadline calculator on 401kaudithelp.com works it out. If the audit will not be done in time, see your options before the deadline, or what to do once it has passed.

What happens at the end of the audit?

Three things, in this order:

1. The auditor reads your draft Form 5500. The standard requires the auditor to obtain and read it before dating the report, looking for anything that does not match the audited financial statements.^[3] Your TPA usually prepares the draft.
2. Management signs a representation letter. Beyond the usual representations, it confirms the auditor was given the current plan document with all amendments, and acknowledges management’s responsibility for administering the plan under its terms.^[3]
3. The auditor signs the report. The regulation requires it to be dated and manually signed, to name the city and state where it was issued, and to say whether the audit followed generally accepted auditing standards.^[4] The opinion type is reported on Schedule H line 3a: unmodified, qualified, disclaimer or adverse.^[6]

Separately, the auditor communicates any reportable findings in writing, such as a contribution that did not follow the plan document or a control weakness worth your attention. The auditor will not send a letter saying there were none.^[3]

What happens if the auditor finds a problem?

It depends on the problem. The most common one in a 401(k) audit is a late deposit of employee deferrals. The fix is to deposit the money and restore the earnings the plan lost. The late amounts are reported on Schedule H line 4a for the year they were late and every year after, up to the year the correction is complete, and the DOL’s Voluntary Fiduciary Correction Program sets out accepted ways to correct them.^[6]

A number in the financial statements that is wrong is simpler: the auditor asks for it to be corrected before the report is dated. If it is material and is not corrected, the opinion is modified. A qualified opinion means the problem is material but not pervasive, and an adverse opinion means it is both.^[6] The opinion type goes on Schedule H, which is open to public inspection.

Is the process different for a first audit?

The steps are the same, but a first audit also has to get comfortable with where the plan started, so it asks for records from before the year being audited. What a first auditor actually looks at explains the difference.

How would a Ledgerline audit run?

The same six steps, in four stages shown in a secure portal, with each person given a checklist of only the documents they hold. How a Ledgerline audit works has the detail. We’re booking engagements for the coming season, starting December 2026.

Frequently asked questions