What is an employee benefit plan audit?
An employee benefit plan (EBP) audit is an audit of a plan’s financial statements by an independent qualified public accountant (IQPA), required by ERISA for certain large plans. The accountant’s report and the audited statements are attached to the plan’s Form 5500, the annual report filed with the Department of Labor.
The audit answers one question: are the plan’s financial statements presented fairly? To get there, the auditor tests what goes in and out of the plan, including contributions, benefit payments, investments and expenses, and checks that the plan operated under its plan document and ERISA’s rules.
It is a different thing from a claims, billing or eligibility audit, which is covered further down.
Which plans need an audit?
An employer’s plan generally needs an IQPA audit when it files the Form 5500 as a large plan, meaning it had 100 or more participants at the start of the plan year. For health and welfare plans, the funding arrangement matters more than the headcount.
| Plan type | 100+ participants: audit required? |
|---|---|
| Fully insured health plan (premiums paid to an insurer or HMO) | No. Exempt under 29 CFR 2520.104-44 |
| Self-funded health plan, claims paid from the employer’s general assets | No. Exempt as an unfunded plan |
| Combination of insured and unfunded benefits | No. Exempt as a combination plan |
| Health plan funded through a trust, such as a VEBA | Yes |
| Defined contribution retirement plan, such as a 401(k) | Yes, counting only participants with account balances |
Exempt welfare plans with 100 or more participants still file a Form 5500. They just skip the accountant’s report and Schedule H, and must still report any nonexempt transactions on Schedule G, Part III. Welfare plans that are insured or unfunded and have fewer than 100 participants are generally exempt from filing a Form 5500 at all.
When does a health plan lose the exemption?
A health plan loses the audit exemption once it holds plan assets outside the employer’s general assets and its insurance contracts. The exemption covers plans whose benefits are paid from the employer’s general assets, from insurance contracts, or both. Common examples:
- A trust or VEBA. Contributions held in a trust and used to pay claims make the plan funded, so a large plan needs an audit.
- Slow handling of employee contributions. For an insured plan to stay exempt, employee contributions must be forwarded to the insurer within three months of receipt.
- Assets held outside the insurer’s general account. Plan assets the insurer holds must sit in its general account.
Most self-funded plans that pay claims from a company bank account, including many level-funded plans, are treated as unfunded. Employee pre-tax contributions through a cafeteria plan generally do not change that, under the DOL’s long-standing enforcement policy in Technical Release 92-01. If your plan has a trust, a VEBA or an account in the plan’s name, confirm its status with your ERISA counsel and your Form 5500 preparer.
How are participants counted?
For a health plan, count the employees and former employees covered by the plan on the first day of the plan year, including former employees on COBRA. Covered spouses and children are not counted.
Two counting rules come up often:
- The 80-120 rule. If a plan has between 80 and 120 participants at the start of the year and filed a Form 5500 for the prior year, it can file in the same category as the prior year. A plan that filed as a small plan can stay small until it passes 120 participants. The rule is set out in 29 CFR 2520.103-1(d) and applies to any plan, but in practice it matters most for retirement plans and funded health plans, since insured and unfunded health plans skip the audit anyway.
- The 2023 account balance change. For plan years beginning on or after January 1, 2023, defined contribution retirement plans count only participants with account balances at the start of the year. Health and welfare plans still count covered employees and former employees, as described above.
What does the audit cover?
An EBP audit covers the plan’s financial statements and the transactions behind them. It is performed under Statement on Auditing Standards No. 136 (AU-C 703), the auditing standard written specifically for ERISA plans. It sets out what the auditor must do and the form of the report. Large plans report their finances on Schedule H of the Form 5500, and the audit supports those numbers.
Areas the auditor typically tests include:
- Participant data and eligibility, including enrollment dates and payroll records.
- Contributions, and whether employee contributions reached the plan on time. Late employee contributions are a common finding.
- Benefit payments, checked against the plan document.
- Investments and plan assets, including how they are valued and held.
- Prohibited transactions and party-in-interest dealings.
- The Form 5500 itself, and the supplemental schedules attached to it.
SAS 136 also allows an ERISA section 103(a)(3)(C) audit, once called a limited-scope audit. In that version, the auditor relies on investment information certified by a regulated bank, trust company or insurer instead of testing it directly. The plan administrator elects it, and the auditor’s report says so.
How does the audit work?
- Engage the auditor. The plan administrator selects an IQPA and agrees on scope and timing, ideally well before the Form 5500 is due.
- Gather documents. The auditor asks for the plan document and amendments, the summary plan description, trust and insurance statements, payroll and enrollment records, vendor contracts and committee minutes.
- Fieldwork and testing. The auditor samples transactions, tests controls and checks operations against the plan document.
- Findings. The auditor reviews draft findings with the plan’s management.
- Report and management letter. The auditor issues an opinion on the financial statements and, often, a letter with control weaknesses and recommendations.
- File and follow up. The report is attached to the Form 5500, which is due by the last day of the seventh month after the plan year ends unless extended. Then the plan fixes what the auditor found.
Audits are required every year the plan files as a large plan and remains funded.
How should you choose an auditor?
Selecting the IQPA is a fiduciary decision for the plan administrator. The DOL’s own guidance on selecting an auditor points to the firm’s experience with employee benefit plans, its licensing and peer review results, and its understanding of ERISA.
The quality gap is real. In the DOL’s November 2023 audit quality study, covering 2020 filings, 30% of plan audits had major deficiencies. Firms that audited only one or two plans a year had a 70% deficiency rate, compared with 17% for firms auditing more than 100 plans.
A deficient audit is the plan’s problem, not only the auditor’s. The DOL can reject the Form 5500, and the plan administrator then has 45 days to file a satisfactory report. The DOL’s enforcement manual sets the starting penalty for a missing or deficient accountant’s report at $150 a day, capped at $50,000, and it can be higher depending on the facts. The DOL also refers significantly deficient audit work to state boards of accountancy and the AICPA.
Plan audits vs. claims and eligibility audits.
An EBP audit is a financial statement audit that ERISA requires of some plans. A claims, billing or eligibility audit is an operational review that asks whether the plan paid the right amounts, for the right people, under its contracts. No federal filing requires one, and most health plans never need an IQPA audit at all, so the operational audits are usually where the money is.
| EBP (IQPA) audit | Claims, billing or eligibility audit | |
|---|---|---|
| Purpose | Opinion on the plan’s financial statements | Find overpayments, billing errors and ineligible enrollees |
| Who performs it | An independent qualified public accountant | A claims auditor, the plan’s advisor, or an audit firm under the plan’s contract rights |
| Required by law | For large funded plans | No |
| Where results go | Attached to the Form 5500 | To the plan sponsor and committee, with recoveries |
Ethos Benefits does not perform IQPA audits; its claims, billing and eligibility audits and ERISA compliance work cover the operational side.
How do you prepare?
- Confirm your status every year. Check the participant count and the funding arrangement before the plan year starts, especially if you added a trust, changed carriers or moved to self-funding.
- Keep records organized. Plan documents, amendments, contracts, enrollment data and committee minutes should be easy to produce. The ERISA compliance checklist covers what to keep.
- Watch employee contributions. Deposit or forward them promptly, and keep proof of when they moved.
- Name a point person. One person who knows the plan should own the auditor’s requests and coordinate with your TPA and carriers.
- Fix prior findings. Document what you changed after the last audit’s management letter.
- Check your fidelity bond. Plans that handle funds generally need an ERISA bond, and auditors look for it.