Comprehensive overview of Department of Labor (DOL) and ERISA Requirements for Employee Benefit Plans (EBP) audits, focusing on Form 5500 filing, fiduciary responsibilities, limited-scope audits, and compliance with regulatory mandates under DOL and ERISA guidelines.
Employee benefit plans (EBPs) in the United States are highly regulated under the Employee Retirement Income Security Act (ERISA) and the Department of Labor (DOL). One of the primary goals of ERISA is to protect the interests of plan participants and their beneficiaries by ensuring that plan fiduciaries uphold their responsibility to manage plan assets prudently. The Department of Labor enforces these requirements, including filing deadlines, audit mandates, and fiduciary obligations.
In this section, we explore the DOL and ERISA requirements that every plan sponsor and auditor should understand, including the annual Form 5500, fiduciary responsibilities, regulations regarding timeliness of contributions, and the conditions that permit “limited-scope audits.” By understanding these requirements, you will be better equipped to plan and conduct audits that comply with federal regulations, safeguard plan participants’ interests, and fulfill your professional responsibilities.
Most employee benefit plans must file an annual Form 5500 with the DOL and the Internal Revenue Service (IRS). This filing provides key information about the plan, its financial condition, operations, and compliance with related laws and regulations.
• Annual Filing Requirement: Plans meeting certain thresholds (generally those covering at least 100 participants at the beginning of the plan year and other criteria) are typically required to file the Form 5500 each year.
• Small Plan Exemption: Some “small plans” (generally under 100 participants) may be exempt from the audit requirement if they meet specific conditions (e.g., certain funding and bonding requirements).
• Auditor’s Opinion for Large Plans: If a plan does not qualify for the small plan exemption, an independent audit of the plan’s financial statements and certain supplemental schedules is required. The auditor’s opinion must be attached to Form 5500.
Below is a simplified diagram outlining the Form 5500 submission process:
flowchart LR A[Plan Sponsor] --> B{Prepare Form 5500} B --> C[Include Required Schedules] C --> D[Attach Auditor's Report (if required)] D --> E[File with DOL/IRS] E --> F[Plan Compliance Review & Oversight]
In this process, the plan sponsor gathers information about the plan—such as participant data, contributions, distributions, and plan investments—and works with auditors if an audit is required. Once everything is finalized, the Form 5500 and accompanying auditor’s report (if applicable) are filed electronically using the DOL’s EFAST2 system.
DOL regulations aim to protect plan participants by ensuring plan sponsors adhere to fiduciary standards and follow specific rules on timely contributions and accurate reporting. Key areas include:
Timeliness of Contributions
• Employee deferrals (e.g., 401(k) contributions) must be remitted to the plan’s trust accounts as soon as they can be reasonably segregated from the employer’s assets.
• Delays in remitting employee contributions can lead to potential violations and may require additional disclosures or corrective action.
Fiduciary Responsibilities
• Plan sponsors and administrators are considered fiduciaries, meaning they must act solely in the interest of the plan participants and beneficiaries.
• Fiduciaries must ensure that investments, vendor selections, and benefit payouts serve the participants’ best interests and comply with plan terms.
Limited-Scope Audit Regulations
• Under ERISA Section 103(a)(3)(C), if a qualified institution (e.g., bank or insurance company) certifies the accuracy of investment information, the auditor’s required testing of those investments can be reduced.
• Caution: Even in a limited-scope audit, auditors still must assess contributions, distributions, participant data, and other plan transactions or controls, ensuring no material misstatements exist outside of the certified investment information.
ERISA imposes various requirements to ensure plan assets are properly managed and participants’ benefits are protected:
• Exclusive Benefit Rule: Plan assets must be used solely for the benefit of participants and beneficiaries, not for the employer’s purposes or personal gain.
• Adequate Disclosures: Plans must provide participants with clear information about their investments, account balances, and plan features, often in the form of Summary Plan Descriptions (SPDs) and benefit statements.
• Vesting and Participation Standards: ERISA prescribes minimum standards for vesting (e.g., how quickly participants earn a nonforfeitable right to their benefits) and participation (e.g., eligibility rules).
Auditors must understand these regulatory requirements to design appropriate audit procedures. For example, when testing compliance with plan contribution rules, auditors may review payroll processing and bank transfers to ensure participant deferrals are remitted reliably and on time. Additionally, the auditor assesses whether sufficient evidence is obtained—either directly or through a qualified institution’s certification—to substantiate investment valuations and earnings.
Some real-world scenarios and considerations include:
• A plan sponsor who unknowingly remits employee deferrals late every payroll cycle may be subject to DOL scrutiny. The auditor’s procedures should detect such delays.
• A custodian’s certified investment information might not eliminate the auditor’s responsibility for verifying the overall completeness and reasonableness of the plan’s financial statements, especially for non-certified assets.
• If auditors detect possible fiduciary breaches, they may be required to communicate these findings to those charged with governance and potentially the DOL, depending on the nature and severity of the issue.
Late Deposit of Contributions
• A medium-sized manufacturing company offers a 401(k) plan for employees. Due to the sponsor’s inefficient payroll system, the company frequently takes two to three weeks to deposit employee contributions into the plan trust. During the audit, the auditor discovers these delays, which exceed DOL guidelines. The plan’s management may have to correct these late deposits by making up for lost earnings and potentially alerting the DOL if corrections exceed de minimis thresholds.
Limited-Scope Audit Certification
• A financial institution holding the plan’s investments issues a certification covering the completeness and accuracy of the investment information. The auditor reduces testing in that area but continues to perform substantive procedures on participant contributions, distributions, loan balances, and other relevant plan transactions. The final financial statements still represent the plan’s entire financial position, and the auditor ensures the certified investments are properly disclosed.
Fiduciary Breach Allegations
• Employees accuse the plan sponsor of making imprudent investment selections that resulted in high fees and poor performance. The auditor is not responsible for judging the prudence of investments per se but does review the plan’s process for selecting these funds and discloses any potentially material noncompliance. If significant red flags suggest a fiduciary breach, the auditor consults professional standards and potential DOL reporting requirements.
• Challenge: Plan sponsors misunderstanding the limited-scope audit.
– Recommendation: Educate clients on the extent of auditor testing needed for non-certified areas and clarify that the auditor still requires sufficient documentation for contributions, distributions, and participant eligibility.
• Challenge: Late or incomplete data for the auditor.
– Recommendation: Encourage plan sponsors to streamline data collection and maintain well-organized records (e.g., payroll, investment statements, and participant data), reducing the risk of delays or audit findings.
• Challenge: Timely deposits of employee deferrals.
– Recommendation: Implement automated payroll systems that promptly segregate and transfer deferrals to the plan trust account. Perform periodic internal reviews to ensure compliance with DOL guidelines.
• Challenge: Fiduciary awareness.
– Recommendation: Provide fiduciary training for plan administrators. Remind them that investments should be monitored regularly for performance, fees, and suitability; keep detailed records of all committee decisions.
• Form 5500: An annual return/report that employee benefit plans file with the DOL and IRS to disclose financial information, investments, and compliance with ERISA.
• Limited-Scope Audit: An audit in which the auditor may rely on a qualified institution’s certification of the plan’s investment information. The auditor must still audit other areas of the financial statements for accuracy and completeness.
• Fiduciary Responsibility: The duty of plan administrators to act prudently and solely in the interest of plan participants, overseeing plan assets and ensuring compliance with plan documents and legal requirements.
• DOL “Employee Benefits Security Administration” (EBSA) Guidelines for Plan Audits
• ERISA Section 103(a)(3)(C) for Limited-Scope Audits
• “AICPA Plan Advisory: Limited vs. Full-Scope EBP Audits.” This publication helps auditors and plan administrators understand the differences between limited-scope and full-scope audits.
• EBSA Checklists for Plan Sponsors and Auditors: Provides best practices for compliance and thorough documentation.
Auditing & Attestation CPA Mock Exams (AUD): Comprehensive Prep
• Tackle full-length mock exams designed to mirror real AUD questions—from risk assessment and ethics to internal control and substantive procedures.
• Refine your exam-day strategies with detailed, step-by-step solutions for every scenario.
• Explore in-depth rationales that reinforce understanding of higher-level concepts, giving you a decisive edge on test day.
• Boost confidence and reduce exam anxiety by building mastery of the wide-ranging AUD blueprint.
Disclaimer: This course is not endorsed by or affiliated with the AICPA, NASBA, or any official CPA Examination authority. All content is created solely for educational and preparatory purposes.