ERISA 103(a)(3)(C) audit vs full-scope audit: which your plan can use

What is the difference between the two?

One part of the work. ERISA lets the auditor’s opinion leave out statements prepared and certified by a bank, similar institution or insurance carrier that is regulated, supervised and periodically examined by a state or federal agency.^[1] The DOL’s regulation applies that to the information about plan assets such an institution holds.^[2] In a full-scope audit, the auditor tests the investments too.

Sources for the table: the auditing standard, pars. 15, 32, 34 and A8,^[4] and the Schedule H instructions.^[5] How the rule developed, and what changed when the auditing standard renamed it, is explained in the 103(a)(3)(C) audit, from the statute and SAS 136 on 401kaudithelp.com. This page is about the decision.

Can your plan use a 103(a)(3)(C) audit?

Three conditions, and all three have to hold:

1. The right kind of institution holds the assets. A bank, similar institution or insurance carrier that is regulated, supervised and subject to periodic examination by a state or federal agency.^[2] The DOL says “similar institution” does not extend to securities brokerage firms,^[5] and the auditing standard says investment companies and broker-dealers are not qualified institutions for a certification.^[4]
2. It signs a certification that says the right thing. The institution must certify the accuracy and completeness of the information, in a written declaration signed by a person authorized to represent it.^[3] A certification of accuracy alone, or completeness alone, does not qualify.^[4] Your recordkeeper may sign as agent for the bank or insurer if a contract between them allows it.^[4]
3. Management makes the determination and puts it in writing. More on that below.

A plan whose assets sit with a bank trustee or an insurance company usually meets the first two. Ask your recordkeeper or TPA who the plan’s trustee or custodian is, and for a copy of last year’s certification. Investments in a pooled fund that files its own audited Form 5500 as a 103-12 investment entity can be relied on in the same way.^[5]

What should you ask your trustee or recordkeeper?

Five questions settle most of it, and the answers are worth having in writing before the engagement letter is signed:

• Who holds the plan’s assets? The name of the trustee or custodian, and whether it is a bank, trust company or insurance company regulated and examined by a state or federal agency.^[2]
• Who will sign the certification? If it is the recordkeeper, ask whether it signs as agent for the trustee under a contract that allows it.^[4]
• Does it say both accurate and complete? Wording that covers only one is not enough.^[4]
• Which investments does it cover? Anything held outside the institution, such as a brokerage window at a broker-dealer, will need testing.^[4]
• What dates does it cover? The report states the date or dates of the certification and the period it covers, so it has to match the plan year.^[4]

What does the plan sponsor take on by electing it?

Responsibility for the decision. Under the auditing standard, management, usually the sponsor acting as plan administrator, agrees in the engagement letter that it is responsible for determining four things: that the election is permissible in the circumstances, that a qualified institution prepared and certified the investment information, that the certification meets 29 CFR 2520.103-5, and that the certified information is properly measured, presented and disclosed.^[4] It repeats that acknowledgement in the representation letter at the end.^[4]

The auditor then asks how management decided the institution qualifies, evaluates that assessment, reads the certification, and compares the certified figures with the financial statements.^[4] If the certification turns out to be incomplete or inaccurate, the auditor has to do more work.^[4] None of this is heavy, but it is no longer a box the auditor ticks for you.

When is a full-scope audit the answer?

• No qualifying certification is available, for example because the assets sit with a broker-dealer rather than a bank trustee, or the certification covers accuracy but not completeness.
• Only part of the plan is certified. Then the auditor must test the uncertified investments anyway,^[4] so the saving shrinks with every investment the certification leaves out, such as a self-directed brokerage window held at a broker-dealer.
• You want an opinion that covers the investments too. A fiduciary committee may prefer that, for example where the plan holds assets that are hard to value. That is a judgment for the plan’s fiduciaries and their counsel, not a rule.

Does a 103(a)(3)(C) audit catch less?

Not outside the investments. Participant data, contributions, benefit payments and account balances, including earnings allocated to them, are audited whether or not they appear in the certified statements.^[4] Since the auditing standard changed, the report gives an opinion on the financial statements other than the certified investment information, rather than the disclaimer limited scope audits used to carry.^[4][6]

It is also the usual choice. The DOL found that 83% of employee benefit plan audits were limited scope in 2020.^[6] In the DOL’s sample, quality tracked the auditor’s experience more than the scope: 70% of the limited scope audits done by firms auditing one or two plans had at least one deficiency, against 19% for firms auditing 100 or more.^[6]

How does the choice show on the Form 5500?

On Schedule H, Part III. A plan that had a 103(a)(3)(C) audit checks “DOL Regulation 2520.103-8” (or 2520.103-12(d)) on line 3b, and still reports the opinion type on line 3a. An unmodified opinion on line 3a(1) includes the form of opinion the auditing standard allows for a 103(a)(3)(C) audit. Neither regulation excuses the plan from engaging an auditor or attaching the report.^[5]

Does the choice change the timeline?

Not the deadline. The Form 5500 is due on the same date whichever scope the plan uses, and the Form 5500 deadline calculator on 401kaudithelp.com gives it for your plan year. What the choice changes is what has to arrive before the auditor can finish: a 103(a)(3)(C) audit waits on the certification, which the regulation gives the institution up to 120 days after the plan year ends to provide,^[3] while a full-scope audit waits on the investment testing. Ask for the certification early either way, because it tells you which of the two your plan can have. If the deadline is already close, see your options when the audit will not be done.

What does Ledgerline quote for?

Our published fee assumes an ERISA 103(a)(3)(C) audit, since that is what most audited 401(k) plans use. Full scope is quoted separately, because testing the investments is materially more work. Either way the rest of the audit, and the document checklist, is the same. How the audit process runs, step by step, and whether your plan needs an audit at all, which the neutral audit requirement checker on 401kaudithelp.com also answers. A first audit has its own wrinkles: what a first auditor looks at.

Frequently asked questions