A 401k audit becomes mandatory when a plan reaches 100 participants with balances, not 100 eligible employees.
A 401(k) audit is an annual examination of a plan's financial statements by an independent qualified public accountant, required under ERISA when the plan files Form 5500 as a large plan. For 401(k) plans, that generally means 100 or more participants with account balances on the first day of the plan year, subject to the 80-120 rule.
Key Takeaways
- Since plan years beginning January 1, 2023, a 401(k) counts only participants with account balances at the start of the year to decide whether it is a large plan that needs an audit (DOL final rule, 88 FR 11793).
- The 80-120 rule lets a plan with 80 to 120 participants file in the same category as its prior-year Form 5500, so a small plan can usually skip the audit until it passes 120 (Form 5500 instructions).
- In EBSA's review of 400 plan audits, 39% had major deficiencies, and firms doing one or two plan audits a year had a 75.8% deficiency rate (EBSA audit quality study).
- A calendar-year plan's Form 5500, with the audit report attached, is due July 31, or October 15 with a Form 5558 extension (Form 5500 instructions).
- Late or incomplete filings face DOL penalties of up to $2,739 a day plus an IRS penalty of $250 a day up to $150,000 (90 FR 1854; Code section 6652(e)).
Four Primary-Source Numbers Behind the 401(k) Audit Rule
Sources: DOL/IRS/PBGC 2024 Form 5500 instructions; DOL final rule, Annual Reporting and Disclosure, 88 FR 11793; EBSA, Assessing the Quality of Employee Benefit Plan Audits (May 2015, 400 audits of 2011 filings); DOL civil penalty inflation adjustment, 90 FR 1854 (Jan. 10, 2025), ERISA section 502(c)(2).
What is a 401(k) audit?
A 401(k) audit is an independent CPA's annual examination of the plan's financial statements and operations, attached to the plan's Form 5500. It is required by ERISA section 103 for plans that file as large plans.
Talk With Craig Wear's Team
Craig has helped IRA millionaires save over $1 million each in unnecessary taxes. Find out if a Roth conversion strategy fits your retirement, with no sales pressure and no product pitch.
Large plans filing Schedule H must generally engage an independent qualified public accountant (IQPA) and attach its report (Form 5500 instructions). The audit checks whether the financial statements are fairly presented and whether money moved as the plan document requires. A common misconception is that this is an IRS rule; it is an ERISA reporting requirement enforced by the Department of Labor. For how plan money flows, see how a 401(k) works.
When does a 401(k) plan need an audit?
A 401(k) plan generally needs an audit when it had 100 or more participants with account balances on the first day of the plan year. Below 100, it usually files as a small plan and can claim the audit waiver if it meets the DOL's conditions.
The rule changed for plan years beginning on or after January 1, 2023. Before that, a 401(k) counted every eligible employee, even those who never enrolled. The DOL's 2023 final rule now counts only participants with an account balance at the beginning of the year, which the DOL estimated would move 18,699 defined contribution plans to small-plan status. New plans use their end-of-year count.
Two details trip up plan sponsors:
- Former employees count. Anyone who left the company but left money in the plan is still a participant with a balance.
- The 80-120 rule works in both directions. If the count is between 80 and 120, the plan may file in the same category as the prior year. A small plan can stay small up to 120. A plan that was already large and audited stays large until it falls below 100.
Small plans that skip the audit still have to satisfy the waiver conditions in 29 CFR 2520.104-46. The first is that at least 95 percent of plan assets are "qualifying plan assets," or that anyone handling the rest is bonded for at least their value (Form 5500 instructions). Every plan also needs an ERISA fidelity bond of at least 10 percent of funds handled, generally capped at $500,000 per plan official, or $1,000,000 for plans holding employer securities (DOL Field Assistance Bulletin 2008-04). Plan type choices are compared in small business 401(k) options.
Worked example: when does a growing company face its first 401(k) audit?
A growing company usually faces its first audit in the first plan year that begins with more than 120 participants with balances, assuming it filed as a small plan the year before. This hypothetical calendar-year 401(k) shows how the count and the 80-120 rule interact.
| Plan year (hypothetical) | Eligible employees | Participants with balances on Jan. 1 | Filing category | Why |
|---|---|---|---|---|
| 2024 | 160 | 92 | Small, no audit | Under 100 with balances; the pre-2023 rule would have counted all 160 and required an audit |
| 2025 | 171 | 118 | Small, no audit (elected) | Between 80 and 120 and filed small for 2024, so the 80-120 rule applies |
| 2026 | 180 | 127 | Large, audit required | Above 120, so the 80-120 rule no longer helps |
| 2027 | 176 | 112 | Large, audit required (unless below 100) | The prior filing was large; the plan must fall under 100 to return to small status |
For the 2026 plan year, the audited Form 5500 is due July 31, 2027, or October 15, 2027, with a timely Form 5558 extension. Its 2025 small-plan return was due July 31, 2026, or October 15, 2026, if extended.
Suppose 14 of the 127 participants are former employees, and 9 of them hold balances of $7,000 or less. A plan may provide for immediate distribution of a benefit whose present value is not greater than $7,000 (IRS Publication 560). A sponsor whose plan document includes that provision, and who processes those distributions before January 1 with the required notices, would start 2026 at 118. Because 2025 was filed as a small plan, the 80-120 rule could then apply for one more year. Whether that fits a given plan is a question for its ERISA counsel and recordkeeper.
What do 401(k) auditors test, and what do they usually find?
Auditors test whether contributions, distributions, loans and participant data match the plan document and payroll records, and they sample individual transactions to do it.
EBSA's audit quality study found that areas unique to benefit plans, "contributions, benefit payments, participant data and party-in-interest/prohibited transactions," continue to lead deficiency rates (EBSA). The IRS's 401(k) Plan Fix-It Guide lists the operational mistakes those tests tend to surface.
| Audit area | What the auditor checks | Common finding | IRS Fix-It Guide mistake |
|---|---|---|---|
| Compensation | Pay used for deferrals and match versus the plan's definition (bonuses, commissions, overtime) | Bonuses excluded from deferrals when the plan includes them | No. 3 |
| Eligibility and enrollment | Entry dates, service crediting, automatic enrollment | Eligible employees not offered a deferral election on time | No. 6 |
| Deposit timing | Payroll dates versus dates deferrals reached the trust | Late deposits that must be reported on Schedule H line 4a | No. 8 |
| Employer contributions | Match and profit-sharing formulas, true-ups, vesting | Match not given to all eligible employees; forfeitures misapplied | No. 4 |
| Limits and testing | 402(g) limit, ADP/ACP results, corrective refunds | Excess deferrals not distributed on time | Nos. 5 and 7 |
| Distributions and loans | Approvals, hardship documentation, loan terms | Loans or hardships administered outside plan terms | Nos. 9 and 10 |
Late deposits get extra attention because the plan must keep reporting them on line 4a of Schedule H every year until they are fully corrected, including lost earnings (Form 5500 instructions). The deposit deadlines themselves are covered in how long an employer has to deposit 401(k) contributions. Nondiscrimination testing is covered in the 2026 highly compensated employee rules, and vesting errors in 401(k) vesting schedules.
Source accuracy also matters for participants. Roth deferrals and in-plan Roth conversions must sit in separately tracked sources, because the tax treatment of every later withdrawal depends on them. Mixed-up sources can surface years later, when retirees coordinate Roth and traditional 401(k) withdrawals or plan conversions.
What is an ERISA section 103(a)(3)(C) audit, formerly a limited-scope audit?
An ERISA section 103(a)(3)(C) audit is an audit in which the accountant does not re-test investment information certified by a qualified bank, similar institution or insurance carrier, but still audits everything else. It used to be called a limited-scope audit.
Under 29 CFR 2520.103-8, the certification must come from an institution that is regulated, supervised and subject to periodic examination by a state or federal agency. The Form 5500 instructions note that "similar institution" does not extend to securities brokerage firms.
A second misconception is that this kind of audit ends in a disclaimer of opinion. Under the auditing standard SAS 136, effective for periods ending on or after December 15, 2021 (per the AICPA), the auditor issues an opinion instead, which the Form 5500 instructions treat as unmodified when there are no other modifications.
The trade-off is coverage. In EBSA's sample, 81% of the audits reviewed were limited-scope, and EBSA linked rising deficiency rates to the growth of that audit type (EBSA).
How much does a 401(k) audit cost, and what drives the fee?
There is no official fee schedule, but the Department of Labor's own rulemaking used $7,500 as a conservative per-audit estimate for plans near the 100-participant line. In the same 2023 final rule, the DOL cited a public comment suggesting $8,000 to $15,000 for a single-employer plan audit and stakeholder estimates of $10,000 to $20,000, while noting that actual costs vary with plan size and complexity.
Common fee drivers include full-scope versus 103(a)(3)(C) scope, a first-year audit of opening balances, multiple payrolls or locations, plan features such as loans, Roth sources and true-up matches, events such as mergers or recordkeeper changes, and the quality of the sponsor's records. How that work is divided among providers is laid out in what a 401(k) TPA does versus a recordkeeper.
EBSA's data shows auditor experience with benefit plans is closely linked to audit quality, and a deficient audit can lead to a rejected filing. Selecting an auditor is a fiduciary decision; see what the fiduciary standard means for background on that duty.
| Plan audits performed per year by the CPA firm | Audits reviewed | Major deficiency rate |
|---|---|---|
| 1 to 2 | 95 | 75.8% |
| 3 to 5 | 95 | 68.4% |
| 6 to 24 | 95 | 67.4% |
| 25 to 99 | 65 | 41.5% |
| 100 to 749 | 25 | 12.0% |
| 750 or more | 25 | 12.0% |
| All audits (weighted) | 400 | 38.8% |
Source: EBSA, Assessing the Quality of Employee Benefit Plan Audits (May 2015), covering 2011 Form 5500 filings.
What is the 401(k) audit timeline from count to filing?
The 401(k) audit timeline runs from the participant count on the first day of the plan year to the Form 5500 deadline, which is the last day of the seventh month after the plan year ends. A one-time extension of up to 2½ months is available by filing Form 5558 (Form 5500 instructions).
- Count on day one. Count everyone with an account balance on the first day of the plan year and apply the 80-120 rule.
- Engage an independent CPA. Hire an independent qualified public accountant (IQPA) and choose full-scope or 103(a)(3)(C) scope.
- Assemble the records. Plan document, recordkeeper year-end package, payroll registers, deferral elections, fidelity bond and minutes.
- Fieldwork and sample testing. The auditor samples contributions, distributions, loans, eligibility, compensation and deposit timing against the plan document and payroll.
- Review findings and draft the Form 5500. Management reviews draft statements and signs a representation letter.
- Receive the auditor's report. The IQPA issues its opinion, which is attached to Schedule H with the audited financial statements.
- File by the deadline. File through EFAST2 by the last day of the seventh month after plan year end (July 31 for a calendar-year plan), or by October 15 with a Form 5558 extension.
The Form 5500 itself is covered alongside participant tax forms in our guide to 401(k) tax forms.
What happens if a 401(k) audit or Form 5500 is late?
A late or incomplete Form 5500, including a large-plan filing without the required audit report, exposes the plan administrator to DOL and IRS penalties. The DOL's Delinquent Filer Voluntary Compliance Program (DFVCP) usually costs far less if the administrator acts before receiving a DOL notice.
| Penalty or program | Amount | Source |
|---|---|---|
| DOL civil penalty, ERISA section 502(c)(2) | Up to $2,739 per day (assessed after January 15, 2025) | 90 FR 1854 |
| IRS late filing penalty, Code section 6652(e) | $250 per day, up to $150,000 | Form 5500 instructions |
| DFVCP, small plan | $10 per day, capped at $750 per filing and $1,500 per plan | DOL DFVCP |
| DFVCP, large plan | $10 per day, capped at $2,000 per filing and $4,000 per plan | DOL DFVCP |
DFVCP filings go through EFAST2 and the penalty is paid online. Because a large-plan filing without the accountant's report can be treated as incomplete, the auditor's schedule effectively sets the filing calendar.
How is an IRS 401(k) plan examination different from the annual audit?
An IRS examination tests whether the plan keeps its tax-qualified status, while the annual audit is a DOL reporting requirement performed by the plan's own CPA. Any plan, large or small, can be selected.
The IRS correction system, EPCRS, is governed by Rev. Proc. 2021-30 and has three tiers: the Self-Correction Program, which needs no IRS filing or fee; the Voluntary Correction Program, which requires a fee before an audit; and Audit CAP, which carries a sanction once the plan is under examination (IRS EPCRS overview). SECURE 2.0 section 305 broadened self-correction for eligible inadvertent failures, which IRS Notice 2023-43 allows sponsors to use now if the IRS has not already identified the failure.
Errors found and fixed before an IRS examination generally have cheaper correction paths than errors the IRS finds first. Plans that use a safe harbor 401(k) design can avoid ADP testing, but they still need an audit once they cross the participant threshold.
Frequently asked questions
Do small 401(k) plans need an audit?
Generally no. A 401(k) that covers fewer than 100 participants with account balances at the beginning of the plan year usually files as a small plan and can claim the audit waiver if it meets DOL conditions. The 80-120 rule can extend small-plan filing up to 120 participants.
Is the 401(k) audit an IRS requirement?
No. The annual independent audit comes from ERISA section 103 and Department of Labor reporting rules, and the auditor's report is attached to the Form 5500. The IRS separately examines plans for tax qualification and has its own late filing penalty.
Who counts as a participant for the 100-participant audit test?
For plan years beginning on or after January 1, 2023, a defined contribution plan counts participants and beneficiaries with account balances on the first day of the plan year. Eligible employees who never deferred do not count, but former employees with balances do.
What is the difference between a full-scope audit and a 103(a)(3)(C) audit?
A full-scope audit tests investments as well as operations. An ERISA section 103(a)(3)(C) audit, formerly called limited-scope, relies on investment information certified by a regulated bank, similar institution or insurance carrier, but still tests contributions, benefit payments and participant data.
What happens if a large plan files Form 5500 without the audit report?
A large-plan filing without the required accountant's report is incomplete. The DOL can assess up to $2,739 a day under ERISA section 502(c)(2) as adjusted in January 2025. Before a DOL notice arrives, the DFVCP caps large-plan penalties at $2,000 per filing and $4,000 per plan.
Does a solo 401(k) need an audit?
No. A one-participant plan covering only a business owner, or the owner and spouse, is not subject to the ERISA Title I annual audit requirement. These plans file Form 5500-EZ or a simplified return when required.
Methodology. Figures come from the 2024 Form 5500 instructions, DOL rules at 88 FR 11793 and 90 FR 1854, EBSA guidance and its 2015 audit quality study, and IRS EPCRS guidance. Cost figures are the DOL's published estimates, not a fee quote. The growth example is hypothetical. Because this is a financial-compliance topic, vendor marketing claims and anonymous forum anecdotes were excluded.
This article is for educational purposes only and is not individualized investment, tax, or legal advice. Consult a qualified professional about your specific situation.
