“I Don’t Know” Won’t Cut It in a Department of Labor Audit

A company with 3,000 covered employees turned down help getting its fiduciary house in order. Six months later, they were notified of a Department of Labor audit. This is the story that should make every plan sponsor take a hard look at what happens when “we will get to it eventually” runs out of time.

A Phone Call Nobody Wants to Get About a Department of Labor Audit

Patrick Williams, co-founder of Fiduciary in a Box, tells a story on The Business of Benefits podcast that sticks with you. His team had given a full demo to a prospect, a company with roughly 3,000 covered lives, walking them through how to document their fiduciary process for their health plan. The company passed. No committee structure, no documented process, nothing loaded into a system. Just business as usual, renewal after renewal.

Six months later, that same company called back. Not to sign up. They had just been notified of a Department of Labor audit and needed help pulling their information together, fast. Patrick’s team scrambled to load what they could into the system after the fact, just so the auditor would have something coherent to review.

Here is the part that matters more than the anecdote itself: a Department of Labor audit does not wait for your organization to get its documentation in order. It arrives on its own timeline. Whatever process, or lack of one, exists at that moment is what you are defending yourself with.

Why “I Don’t Know” Is the Worst Answer in the Room

As Williams put it during the episode, a plan sponsor cannot walk into a Department of Labor audit empty-handed and expect a good outcome.

That line captures the core problem with treating fiduciary duty as background noise. Under the Employee Retirement Income Security Act, anyone who exercises discretionary authority over a health plan’s management or assets, whether that is an employer, an HR leader, or a benefits committee, is held to what the Department of Labor calls the “prudent person” standard. That standard does not ask whether you meant well. It asks whether you can show your work.

Fiduciaries who fail to meet that standard can be held personally liable to restore losses to the plan, not just the organization. That is not a hypothetical. It is the plain language of federal guidance on fiduciary liability, and it applies whether the plan sponsor is a Fortune 500 company or a 300-employee manufacturer.

What a Department of Labor Audit Is Actually Looking For

A Department of Labor audit investigator is not walking in to catch you in a scandal. In most cases, they are checking for evidence that your organization ran a deliberate, repeatable process for managing the health plan. That evidence usually comes down to a handful of things:

• Committee structure. Who is responsible for plan oversight, how often they meet, and whether that is written down anywhere.
• Meeting minutes. Not a vague summary after the fact, but a real record of what was reviewed, discussed, and decided.
• Vendor and broker review. Evidence that fees, services, and performance were benchmarked, not just renewed on autopilot.
• Fee reasonableness documentation. Proof that someone actually asked whether the plan is paying a fair rate for what it gets.
• Compliance filings and attestations. Timely, complete, and retained where they can be produced on request.

None of this is exotic. It is the paper trail of a plan being run with intention instead of inertia. The trouble is that most of it only gets built after the Department of Labor audit letter shows up, which is exactly backward.

The Numbers Behind the Risk

This is not a small, quiet corner of federal enforcement. The Department of Labor’s Employee Benefits Security Administration, the agency responsible for ERISA enforcement, recovered more than $1.4 billion for retirement, health, and welfare plans, participants, and beneficiaries in fiscal year 2025. More than half of that came directly from enforcement actions rather than voluntary correction.

The agency closed 878 civil investigations that year, and 63 percent of them produced a monetary recovery or required a corrective action of some kind, according to the EBSA fiscal year 2025 fact sheet. Put plainly, an investigation opening is far more likely than not to end in a finding against the plan.

Enforcement resources have also been shifting. Investigators are not only looking at retirement plans anymore. Health and welfare plans, the third-party administrators that run them, and the plan sponsors who oversee them are drawing more attention than they used to. A company that has never thought about its health plan as a Department of Labor audit target is exactly the kind of company that gets caught flat-footed.

The Fiduciary Liability Insurance Gap Nobody Checks

There is a second blind spot Williams flags on the episode, and it catches almost everyone off guard.

Most plan sponsors know they need fiduciary liability coverage for their own committee. Far fewer know to ask whether the advisor consulting on their health and welfare plan carries that same protection. If the answer is no, the plan sponsor is doing the committee work, the documentation, and the due diligence, while the person advising on some of the plan’s biggest financial decisions has no fiduciary coverage of their own if something goes wrong. That gap surfaces during a Department of Labor audit, not before one.

CAA Compliance Adds Another Layer

Documentation obligations have also grown since the Consolidated Appropriations Act, 2021 went into effect. Under Section 201 of the CAA, group health plans and issuers are prohibited from entering into service provider contracts that contain gag clauses, language that restricts a plan’s access to its own cost and quality data.

To prove compliance, plans must file an annual Gag Clause Prohibition Compliance Attestation through the federal government’s Health Insurance Oversight System. This requirement applies to fully insured and self-funded plans of nearly every size, and it sits on top of everything else a fiduciary committee is already expected to track. A missed attestation is one more item an auditor can flag, and one more gap in the story a plan sponsor has to tell about how the plan is actually run.

What a Documented Fiduciary Process Actually Looks Like

None of this requires a legal department. It requires a rhythm.

Form a real committee

Name the people responsible for plan oversight, define what they are accountable for, and put it in writing. A committee that exists only in conversation is not a committee an auditor can verify.

Meet on a schedule, and write it down

Quarterly is a reasonable baseline for most mid-sized plans. The point is not the frequency, it is the consistency, and the minutes that prove the meetings happened and covered substantive ground.

Review vendors and fees on purpose

Benchmark broker and administrator fees against the market on a regular cadence, and keep the documentation that shows the review took place, not just the renewal that followed it.

Confirm advisor coverage in writing

Before the next renewal conversation, ask directly: does your fiduciary liability coverage extend to health and welfare, specifically, not just retirement or general liability? Get the answer in writing.

Keep the file current, not retroactive

Store committee charters, minutes, vendor reviews, and attestations somewhere they can be produced within days, not weeks. The goal is a file that is already finished before anyone asks to see it.

Building the Habit Before the Letter Arrives

The company in Patrick Williams’ story is still waiting to find out whether a fine lands. As he put it, “cross your fingers” is not a compliance strategy anyone should be running on, and it is not one you would choose if you had built the process six months earlier instead of six months too late.

A Department of Labor audit does not ask whether you are ready. It asks what you can prove. If your organization does not currently have a documented fiduciary process for your health plan, the time to build one is now, while it is still your choice and not the government’s timeline. Learn more about what fiduciary responsibility actually requires of a plan sponsor, and start building the record before you need it.