Whether your 401(k) or employee benefit plan recently hit the audit requirement or you are looking for a new 401(k) or employee benefit plan auditor, there many resources to consider and steps to take in order to ensure that your 401(k) or employee benefit plan audit is completed efficiently and in compliance with the relevant laws and regulations. This paper provides recommendations that will result in a smooth audit and provides some valuable resources to facilitate the audit.
Your Role in the 401(k) or Employee Benefit Plan Audit Process
401(k) and employee benefit plan audits are unique and can be quite complex. Preparation and assistance on your part can lead to a significant reduction in the time the auditor spends. Here are some steps you can take that will help you meet your fiduciary responsibilities and contribute to an efficient audit.
- Assign an individual who is responsible for the 401(k) or employee benefit plan’s financial statements. Plan management is responsible for the plan’s financial statements, including the selection and application of the accounting policies, establishing and maintaining effective internal control over financial reporting, designing and implementing programs and controls to prevent and detect fraud, and identifying and ensuring that the 401(k) or employee benefit plan complies with the laws and regulations applicable to its activities. You might look to someone from your financial reporting department to be responsible for the preparation of the financial statements. AICPA independence rules permit auditors to assist with financial statement preparation if certain safeguards are met.
- Assign an individual who is responsible for coordinating the 401(k) or employee benefit plan audit and obtaining the necessary input and cooperation of all parties involved, including the financial reporting, human resources and benefits, payroll and treasury departments as well as trustees, custodians, record keepers, actuaries and other external parties.
- Establish and maintain good internal control policies and procedures. The AICPA EBPAQC Center plan advisory, The Importance of Internal Controls in Financial Reporting and Safeguarding Plan Assets provides valuable information to assist you in this area (see “Additional Resources” section below for more information).
- Make sure the 401(k) or employee benefit plan’s records are complete and up to date, and that all records are readily and easily accessible. The audit will require more time if the records are incomplete or inadequate or if controls do not exist or are ineffective.
- The 401(k) or employee benefit plan document and IRS opinion or determination letter should be up to date. The plan should be able to demonstrate that the plan has met all of the IRS qualification requirements.
- The 401(k) or employee benefit plan should establish and maintain a written investment policy.
- Review the reports prepared by the 401(k) or employee benefit plan’s service organizations, investment reports and certifications for consistency, completeness and reasonableness, and inquire about any information you don’t understand. Obtaining answers to questions you have about those reports in advance will help you answer inquiries you may receive from your 401(k) or employee benefit plan auditors. Consider whether adjustments to the information provided by your service organizations may be necessary to prepare the 401(k) or employee benefit plan’s financial statements.
- Prepare schedules and collect documentation requested by your 401(k) or employee benefit plan auditors in advance. Providing schedules of the underlying activity or items supporting account balances, such as investments or plan expenses, and a trial balance that supports the financial statement amounts, can help the 401(k) or employee benefit plan auditor reduce the amount of time they spend on the audit.
- Obtain and read SOC 1 and SOC 2 reports from service organizations to determine if the controls, including cybersecurity controls, relevant to the plan, including those at the plan sponsor (user entity controls), are adequate to ensure complete and accurate financial reporting as well as adequate cybersecurity. It is also is important that you document the controls for which the 401(k) or employee benefit plan is responsible and monitor compliance with those controls throughout the year.
- Arrange for the 401(k) or employee benefit plan auditor to have direct access to other service organizations used by the plan to obtain information or answer questions arising during the audit.
Additional Resources
EBPAQC Plan Sponsor Resource Center
The EBPAQC has compiled helpful tools and resources for plan sponsors, administrators and trustees, which can be found on the EBPAQC website at aicpa.org/ebpaqc.
EBPAQC Plan Advisories
The following EBPAQC plan advisories can be found on the EBPAQC website at aicpa.org/ebpaqc.
Understanding Auditor Communications.
This advisory addresses 401(k) and employee benefit plan auditor’s communications with those charged with governance, engagement letters, management representation letters, communications about internal control matters identified in an 401(k) or employee benefit audit, management letters and verbal communications, how auditor communications can help and where to obtain additional information about 401(k) or employee benefit plan auditor communications.
Effective Monitoring of Outsourced Plan Record Keeping and Reporting Functions.
This advisory is a comprehensive document that contains information about your fiduciary responsibility for monitoring service organizations and useful tips for selecting and monitoring service organizations. It also addresses the quality of plan accounting information, monitoring service organization controls over plan accounting information and special considerations for different types of 401(k) or employee benefit plans.
The Importance of Internal Controls in Financial Reporting and Safeguarding Plan Assets.
This advisory assists plan administrators in understanding their responsibilities for establishing, maintaining and monitoring internal controls at their 401(k) or employee benefit plans.
Valuing and Reporting Plan Investments.
This advisory assists plan sponsors in understanding their responsibilities for valuing and reporting their plan investments. It is a comprehensive document that contains information about your responsibility for reporting plan investments, how plan investments are reported, investment valuation and related disclosures, your responsibility for valuing investments and establishing internal controls, special considerations for alternative investments, investment information you should request from the plan trustee or custodian, how your independent 401( k) or employee benefit plan auditor can assist you and where to obtain additional information.
DOL Resources
U.S. Department of Labor Employee Benefits Security Administration Fiduciary Education Campaign Website.
Fiduciary Education Campaign includes nationwide educational seminars and webcasts to help plan sponsors understand rules and meet their responsibilities to workers and retirees. The campaign also includes educational materials on topics such as understanding fees and selecting a 401(k) or employee benefit plan auditor. dol.gov/agencies/ebsa
Meeting Your Fiduciary Responsibilities.
ERISA sets standards of conduct for those who manage a 401(k) or employee benefit plan and its assets (called fiduciaries). This publication provides an overview of the basic fiduciary responsibilities applicable to retirement plans under the law.
dol.gov/agencies/ebsa/employers-and-advisers/small-business/publications
Selecting an Auditor for Your Employee Benefit Plan.
Federal law requires employee benefit plans with 100 or more participants with account balances to have an audit as part of their obligation to file the Form 5500. This booklet will assist plan administrators in selecting a 401(k) or employee benefit plan auditor and reviewing the audit work and report. dol.gov/agencies/ebsa/employers-and-advisers/small-business/publications