Legacy Professionals LLP Makes the Case: Employee Benefit Plan Audits Are a “Value-Add”, Not a Compliance Chore

Audits of employee benefit plans may be seen by sponsors as just another exercise in compliance that has to get done on an annual basis. However, an audit can provide something more valuable to the sponsor than just another piece of paper that has to go into a filing.

An audit provides an opportunity for a sponsor to take stock of what is really happening with their plan in an organized way, and to identify potential problems early on. Problems can exist with participant data, contributions, eligibility, distributions, and internal controls.

For sponsors dealing with increasingly complex responsibilities, this makes the compliance pressures facing plan sponsors more than a regulatory concern. A well-managed audit can become part of stronger oversight and better decision-making.

What Actually Triggers the Requirement

The general rule is well-known. A plan with 100 or more participants at the start of the plan year files as a large plan and must attach an independent qualified public accountant’s report to its Form 5500. How those participants are counted–

For plan years beginning on or after January 1, 2023, defined contribution plans count only participants with account balances as of the first day of the plan year. Eligible employees who never enrolled no longer push a plan over the line. The Department of Labor estimated that roughly 18,700 plans would avoid large-plan status under the revised methodology. The 80-120 rule still applies on top of that, so a plan between 80 and 120 participants may continue filing in the same category it used the prior year.

The end result is that many plans have found themselves no longer within the audit range and even more plans have slipped into that category without anyone performing the recalculation. Sponsors who assume last year’s answer still holds are the ones who discover the requirement in July, three weeks before the calendar-year filing deadline of July 31, with the Form 5558 extension to October 15 as the only remaining cushion. Legacy Professionals LLP has pointed out that a five-minute participant count run each January removes the entire problem.

The Exposure That Sits Behind the Filing

A Form 5500 submitted without a required audit report is not a late filing. It is an incomplete filing initially and will be a rejected filing, which means the plan is treated as if it never filed. The Department of Labor can assess civil penalties of up to $2,739 per day with no statutory cap, and the exposure compounds daily until the deficiency is cured. The Delinquent Filer Voluntary Compliance Program reduces that to $10 per day, capped at $2,000 per plan year, but only for sponsors who come forward before the agency contacts them.

The penalty math is the overt component. The fiduciary part is less visible and considerably harder to unwind. ERISA imposes personal liability on plan fiduciaries for losses caused by a breach of duty, and the duty is procedural. 

Courts and regulators do not ask whether a decision turned out well. They ask whether the fiduciary followed a prudent process in reaching it. A sponsor that cannot demonstrate it monitored contribution remittances, verified eligibility determinations, or reviewed the recordkeeper’s controls is in a weak position, regardless of how the plan performed.

Audit is one of the only procedures that produce contemporaneous third-party documentation regarding that procedure. That evidence has value the day it is created and considerably more value three years later when someone asks what the committee knew.

What Is SAS 136? 

In regard to audits performed for periods ending on or after December 15, 2021, SAS 136 has changed the role of the sponsor and the auditor in relation to each other, placing actual responsibilities upon the sponsor.

The old “limited scope” audit became the ERISA Section 103(a)(3)(C) audit, and it is an election the plan administrator must affirmatively make and defend. Before the auditor can accept it, management must determine that the election is permissible, confirm that the certifying institution qualifies, verify that the certification covers both the accuracy and completeness of the investment information, and confirm that the reliable information is properly measured and disclosed in the financial statements. 

None of that is left to the judgment of the auditor.

The standard also requires management to acknowledge in writing its responsibility for maintaining a current plan instrument, including all amendments, and for administering the plan in accordance with it. In practice, this is where a surprising number of engagements surface a problem, because the plan document a sponsor believes is current and the document the recordkeeper is actually operating from are not always the same. Add the requirement that auditors communicate reportable findings to those charged with governance, and the audit stops being a document the committee receives and becomes a conversation the committee has to participate in. Firms with concentrated benefit plan practices, including Legacy Professionals LLP, generally treat that conversation as the deliverable rather than the report itself.

Where Audits Find Problems First

The repeating themes in benefit plan audits are far from unusual. They cluster in a handful of operational areas, and nearly all of them are cheaper to correct the year they occur than the year they are discovered.

Participant data is the most common source. Eligibility computed from the wrong hire date, employees enrolled late, terminated participants left active in the census, and rehires treated as new hires all produce contribution errors that accumulate quietly. Compensation definitions are close behind, particularly in plans where bonuses, commissions, or fringe benefits are handled inconsistently against what the plan document specifies.

Contributions received and receivable are a second cluster. Late deposit of participant deferrals is a prohibited transaction; it is reported on Form 5500 and requires correction with lost earnings. Benefit payments are a third cluster, where distributions processed without proper documentation or spousal consent create downstream problems.

And this is how the engagement is to be looked at in practical terms, and this is the case that Legacy Professionals LLP makes to the committees.

Correcting any of these through the IRS Employee Plans Compliance Resolution System or the DOL’s Voluntary Fiduciary Correction Program is straightforward when the sponsor initiates it. It is markedly less straightforward when the agency initiates it, and self-correction is generally unavailable once an examination has begun. The audit is the mechanism that keeps a sponsor on the initiating side of that line.

Auditor Selection Is Itself a Fiduciary Act

Choosing the auditor is itself a fiduciary act, and the statistics compiled by the Department of Labor itself show that not all choices are equal.

The DOL’s November 2023 audit quality study reviewed 307 plan audits and found that 30 percent contained one or more major deficiencies, an improvement over the 39 percent identified in the 2015 study but still substantial. The distribution is the striking part. Roughly 70 percent of audits performed by firms handling only one or two plans annually were deficient. In contrast, firms with larger benefit plan practices and membership in the AICPA Employee Benefit Plan Audit Quality Center performed measurably better.

A deficient audit is not a neutral outcome for the sponsor. It can render the Form 5500 filing incomplete, which reopens the penalty exposure the audit was supposed to close. Documenting why a particular firm was selected, what its benefit plan volume looks like, and how its fees compare is part of building durable audit oversight, not an administrative afterthought. It is also documentation the committee would want to have available should the choice be questioned.

Making the Audit Produce Governance Value

Those that gain the most benefit from the engagement do several mundane things consistently.

They review the SOC 1 report provided by the recordkeeper and validate the complementary user entity controls that the report presumes exist. They track reportable findings and management letter comments in a log with owners and dates, and they revisit that log the following year. They document committee discussion of the audit in minutes rather than simply noting receipt. They reconcile the participant count annually instead of assuming continuity, and they periodically compare the operating plan document with actual administration.

None of this is required by the audit standards. All of it converts a compliance expense into the procedural record that fiduciary defense actually depends on, which is the reframing Legacy Professionals LLP argues sponsors should make well before a regulator gives them a reason to.

About Legacy Professionals LLP

Established in the year 2003 and headquartered in Westchester, Illinois, with additional offices in Minnesota and Indiana, the firm concentrates its practice in four areas: employee benefit plans, labor organizations, not-for-profit entities, and commercial clients. 

With 32 partners and principals and more than 195 professionals, the firm’s specialized work in benefit plan assurance also extends to payroll compliance audits, client accounting and advisory services, and accounting services to its clients, and tax services for the multiemployer and Taft-Hartley community.

---