401(k) Audit Services for US Sponsors: Choose an Auditor

US 401(k) sponsors should verify the plan-specific audit trigger, select an independent qualified public accountant and assign evidence held by internal teams, the TPA and the recordkeeper before fieldwork begins.[3][4][7]

Confirm whether the plan needs an audit

The Department of Labor’s reporting rules turn on the number of participants at the beginning of the plan year. A plan covering 100 or more participants at that date files the large-plan annual report, which includes the report of an independent qualified public accountant.[3] A plan with fewer than 100 participants files the small-plan report and can be exempt from the accountant’s report, but only if it meets the waiver conditions, such as holding at least 95 percent of its assets as qualifying plan assets or carrying an enhanced fidelity bond, and adding the required disclosures to its summary annual report.[8]

Two details commonly change the answer:

• The 80–120 rule: a plan with between 80 and 120 participants (inclusive) at the beginning of the plan year may elect to file the same category of annual report it filed for the previous plan year.[3]
• Who counts as a participant: vendor and adviser guidance reports that, for plan years beginning on or after January 1, 2023, defined-contribution plans count participants with account balances rather than every eligible employee.[4][6] Confirm the definition in the current Form 5500 instructions before relying on it.

1. Establish the plan-year start date. The count is taken at the beginning of the plan year.[3]
2. Document the beginning-of-year count. Ask the recordkeeper or TPA for the number of participants with account balances, not merely an eligible-employee census.[4]
3. Check the prior-year filing. If the count is between 80 and 120, the prior year’s category may still be available.[3]
4. Test the small-plan waiver. If the plan is under 100 participants, confirm whether it meets the qualifying-asset or bonding conditions.[8]
5. Identify timing complications. Short and non-calendar plan years require tailored schedules rather than calendar-year assumptions.[2][7]

Form 5500 is generally due on the last day of the seventh month after the plan year ends — July 31 for a calendar-year plan — and an extension can be requested on Form 5558.[9] Watkins Ross says the Form 5558 extension adds two and a half months, giving a calendar-year plan an October 15 deadline.[7] Build the audit timeline back from the filing date.

Choose the engagement scope before requesting quotes

Ask each firm to quote the same engagement type and determine whether the plan can obtain the investment certification on which one scope depends.[4]

Human Interest distinguishes a non-ERISA Section 103(a)(3)(C) audit, formerly called a “full-scope” audit, from an ERISA Section 103(a)(3)(C) audit, formerly called a “limited-scope” audit.[4] For a Section 103(a)(3)(C) engagement, qualifying investment information may be prepared and certified as accurate and complete by a qualified institution such as a bank.[4]

According to Human Interest, auditing standard SAS 136 replaced the former disclaimer approach: the auditor now opines on financial-statement information outside the certification and on whether investment information reconciles to the certified information.[4]

1. Request the proposed certification from the institution that will prepare it, including the information and period covered.[4]
2. Give every bidder the same certification and request written confirmation that it supports the proposed engagement.
3. Require a defined scope. The proposal should name the engagement type and distinguish certified information from information subject to the auditor’s procedures.
4. Request an alternative quote if certification remains uncertain. Do not compare one quote that assumes qualifying certification with another that does not.

A Section 103(a)(3)(C) engagement narrows the auditor’s work on certified investments; it does not reduce the sponsor’s preparation work or assure any particular audit opinion.[4]

Compare PriceKubecka and Linked Accounting

Use independence as the first screening gate. The accountant’s report must come from an independent qualified public accountant.[3][6] Human Interest advises that the auditor should have no ties to the employer or plan, and that a firm handling the employer’s recordkeeping, accounting or financial statements may not be able to perform the annual audit if those ties impair independence.[4]

PriceKubecka

• Scope: PriceKubecka reports licensed-CPA staffing, more than 400 audits annually, AICPA peer review, direct recordkeeper connectivity and fully remote delivery. These are vendor-reported capabilities.[2]
• Price: The firm advertises a flat fee of $10,000.[2]
• Material terms: Quote confirmation is required; use the checklist below.

Linked Accounting

• Scope: Linked Accounting advertises CPA-led review of operations, financial statements, internal controls, contributions, distributions, participant eligibility and error detection, followed by a detailed report with actionable findings.[5]
• Price: Quote required.
• Material terms: Quote confirmation is required; the firm lists offices in California, Montana, Hawaii and Utah.[5]

The cited PriceKubecka materials state nationwide service and say the flat fee includes the complete audit engagement and Form 5500 preparation support, but do not publish contract length or cancellation terms.[2] The cited Linked Accounting page does not publish price, timing commitments, eligibility limits, contract or cancellation terms.[5]

What to confirm with each provider

• written independence confirmation and CPA license details;
• employee-benefit-plan experience, ERISA familiarity, assigned staff and peer-review report;
• engagement type, procedures, deliverables and request-list timing;
• report-delivery date and support for the Form 5500 filing deadline;
• fee inclusions, exclusions and adjustment triggers; and
• contract term, cancellation rights and responsibilities in the engagement letter.

PriceKubecka recommends considering employee-benefit-plan experience, ERISA familiarity, staffing and AICPA peer review. These are vendor-recommended screening factors, not regulatory qualification rules.[2]

Build a sponsor–TPA–recordkeeper evidence register

Create a shared register before fieldwork so each request has an owner, source and status. Adapt this operating template to the plan’s service agreements and record-retention practices.

Use consistent fields

For each request, record the evidence category, requested item, source system, sponsor owner, producing party, period covered, due date, completeness status, open question and auditor acceptance status. A sponsor coordinator can maintain the register even when a provider holds the record.

• Census and payroll: Assign sponsor HR or payroll to participant and payroll data. Identify which files the TPA or recordkeeper will produce and who will explain transaction differences. Abbey Street says internal HR, payroll and finance teams provide participant and payroll records, while TPAs and recordkeepers provide additional records and explanations.[6]
• Contributions: Assign payroll or finance to remittance data by pay period and the recordkeeper to posting, trust or recordkeeping reports.[7] Route reconciliation or testing work according to the TPA’s service agreement.
• Investments: Request trust and recordkeeping reports and any applicable independent appraisals.[7] For a proposed Section 103(a)(3)(C) engagement, identify the institution preparing the certification and track both the certification and the information covered.[4]
• Distributions and loans: Identify who retains participant forms, approvals, transaction histories and explanations. Watkins Ross includes distribution, loan and other participant forms in its audit-preparation list.[7]
• Service-provider and governance records: Track plan and adoption documents, amendments, the IRS opinion letter, SPD and SMM materials, service agreements, SOC 1 reports, ERISA bond evidence, participant notices, corporate minutes, and prior and draft-current Form 5500 materials.[7]

Keep TPA support separate from the audit

TPA testing and administrative assistance are separate from the independent audit workstream. Define the TPA’s testing, reconciliation and document-production duties from its agreement; the cited guidance does not establish a universal TPA scope. Human Interest recommends organizing plan documents, payroll data and time-stamped communications in advance.[4]

Run a weekly handoff

The sponsor coordinator can review the register weekly, assign each open question to a named owner and return incomplete items with the issue and revised due date recorded. Use auditor acceptance—not upload alone—as the completion status.

Receive the report and resolve findings

Before signing the engagement, ask the firm to identify each report or letter it will deliver, who will receive it, response deadlines and the escalation contact. Human Interest says plan management may receive an audit communication letter and a management recommendation letter addressing noncompliance or process improvements.[4]

Move each reported issue into a findings log containing:

• the finding, affected process and period;
• the supporting evidence reference;
• the sponsor owner and TPA or recordkeeper contact;
• the corrective action and target date; and
• completion evidence, auditor follow-up status and potential filing impact.

As an operating assignment, finance can own financial-statement and contribution-remittance matters, while HR or benefits can own census and eligibility matters. The TPA or recordkeeper can provide evidence and explanations for processes it operates. Adjust ownership to the service agreements and authority of the plan committee, counsel and other advisers. Watkins Ross says plan administrators can coordinate auditor requests, assist with requested records and support the audit and Form 5500 filing.[7]

Escalate unresolved matters that could affect the report or filing schedule to plan management and the auditor before the final status meeting.

Keep the annual independent audit distinct from an IRS Employee Plans examination. If an examination identifies a defect jeopardizing qualified status, the IRS says it should, where possible and consistent with EPCRS, be corrected through agreement between the IRS and sponsor.[1] Hiring an auditor and keeping a findings log support compliance but do not establish it; the outcome depends on what the audit finds and how each finding is corrected.[1][4]

References

1. 401k Resource Guide Plan Sponsors What if You are Audited | Internal Revenue Service (irs.gov)
2. 4 Things To Look For When Selecting A 401k Auditor – PriceKubecka 401k CPAs (401kcpas.com)
3. 29 CFR 2520.103-1 — Contents of the annual report (eCFR) (ecfr.gov)
4. What To Know about IRS Annual 401(k) Audit Requirement | Human Interest (humaninterest.com)
5. 401k Audits – Comprehensive Employee Benefit Plan Reviews | Linked Accounting (linkedaccounting.com)
6. 401(k) Plan Audit: The Basics – Abbeystreet (abbeystreet.com)
7. 401k Plan Audit Requirements: A Guide for Employers | Watkins Ross (watkinsross.com)
8. 29 CFR 2520.104-46 — Waiver of accountant’s report for plans with fewer than 100 participants (eCFR) (ecfr.gov)
9. Form 5500 Corner | Internal Revenue Service (irs.gov)