# The employee benefit plan audit. Which health plans need one, and which don't.

Source: https://ethosbenefits.com/benefits-101/employee-benefit-plan-audit
Type: Benefits 101
Topic: ERISA and plan documents
Author: Meghan Anderson, Account Executive
Reviewed by: Patrick Ansara, Partner and Director of Client Operations
Publisher: Ethos Benefits
Published: 2025-05-16
Last updated: 2026-11-03
Cite as: "The employee benefit plan audit," Ethos Benefits, https://ethosbenefits.com/benefits-101/employee-benefit-plan-audit, updated 2026-11-03.

**Short answer:** An employee benefit plan audit is an independent accountant's audit of an ERISA plan's financial statements, attached to the Form 5500. Plans with 100 or more participants generally need one, but fully insured and unfunded health plans are exempt at any size. Health plans that hold assets in a trust, such as a VEBA, must be audited.

## What is an employee benefit plan audit?

An employee benefit plan (EBP) audit is an audit of a plan's financial statements by an independent qualified public accountant (IQPA), required by ERISA for certain large plans. The accountant's report and the audited statements are attached to the plan's [Form 5500](https://ethosbenefits.com/benefits-101/form-5500-deadline), the annual report filed with the Department of Labor.

The audit answers one question: are the plan's financial statements presented fairly? To get there, the auditor tests what goes in and out of the plan, including contributions, benefit payments, investments and expenses, and checks that the plan operated under its plan document and ERISA's rules.

It is a different thing from a claims, billing or eligibility audit, which is covered further down.

## Which plans need an audit?

An employer's plan generally needs an IQPA audit when it files the Form 5500 as a large plan, meaning it had 100 or more participants at the start of the plan year. For health and welfare plans, the funding arrangement matters more than the headcount.

| Plan type | 100+ participants: audit required? |
|---|---|
| Fully insured health plan (premiums paid to an insurer or HMO) | No. Exempt under 29 CFR 2520.104-44 |
| Self-funded health plan, claims paid from the employer's general assets | No. Exempt as an unfunded plan |
| Combination of insured and unfunded benefits | No. Exempt as a combination plan |
| Health plan funded through a trust, such as a VEBA | Yes |
| Defined contribution retirement plan, such as a 401(k) | Yes, counting only participants with account balances |

Exempt welfare plans with 100 or more participants still file a Form 5500. They just skip the accountant's report and Schedule H, and must still report any nonexempt transactions on Schedule G, Part III. Welfare plans that are insured or unfunded and have fewer than 100 participants are generally exempt from filing a Form 5500 at all.

## When does a health plan lose the exemption?

A health plan loses the audit exemption once it holds plan assets outside the employer's general assets and its insurance contracts. The exemption covers plans whose benefits are paid from the employer's general assets, from insurance contracts, or both. Common examples:

- **A trust or VEBA.** Contributions held in a trust and used to pay claims make the plan funded, so a large plan needs an audit.
- **Slow handling of employee contributions.** For an insured plan to stay exempt, employee contributions must be forwarded to the insurer within three months of receipt.
- **Assets held outside the insurer's general account.** Plan assets the insurer holds must sit in its general account.

Most self-funded plans that pay claims from a company bank account, including many [level-funded plans](https://ethosbenefits.com/benefits-101/level-funded-vs-fully-insured), are treated as unfunded. Employee pre-tax contributions through a cafeteria plan generally do not change that, under the DOL's long-standing enforcement policy in Technical Release 92-01. If your plan has a trust, a VEBA or an account in the plan's name, confirm its status with your ERISA counsel and your Form 5500 preparer.

## How are participants counted?

For a health plan, count the employees and former employees covered by the plan on the first day of the plan year, including former employees on COBRA. Covered spouses and children are not counted.

Two counting rules come up often:

- **The 80-120 rule.** If a plan has between 80 and 120 participants at the start of the year and filed a Form 5500 for the prior year, it can file in the same category as the prior year. A plan that filed as a small plan can stay small until it passes 120 participants. The rule is set out in 29 CFR 2520.103-1(d) and applies to any plan, but in practice it matters most for retirement plans and funded health plans, since insured and unfunded health plans skip the audit anyway.
- **The 2023 account balance change.** For plan years beginning on or after January 1, 2023, defined contribution retirement plans count only participants with account balances at the start of the year. Health and welfare plans still count covered employees and former employees, as described above.

## What does the audit cover?

An EBP audit covers the plan's financial statements and the transactions behind them. It is performed under Statement on Auditing Standards No. 136 (AU-C 703), the auditing standard written specifically for ERISA plans. It sets out what the auditor must do and the form of the report. Large plans report their finances on Schedule H of the Form 5500, and the audit supports those numbers.

Areas the auditor typically tests include:

- **Participant data and eligibility,** including enrollment dates and payroll records.
- **Contributions,** and whether employee contributions reached the plan on time. Late employee contributions are a common finding.
- **Benefit payments,** checked against the plan document.
- **Investments and plan assets,** including how they are valued and held.
- **Prohibited transactions and party-in-interest dealings.**
- **The Form 5500 itself,** and the supplemental schedules attached to it.

SAS 136 also allows an ERISA section 103(a)(3)(C) audit, once called a limited-scope audit. In that version, the auditor relies on investment information certified by a regulated bank, trust company or insurer instead of testing it directly. The plan administrator elects it, and the auditor's report says so.

## How does the audit work?

1. **Engage the auditor.** The plan administrator selects an IQPA and agrees on scope and timing, ideally well before the Form 5500 is due.
2. **Gather documents.** The auditor asks for the plan document and amendments, the summary plan description, trust and insurance statements, payroll and enrollment records, vendor contracts and committee minutes.
3. **Fieldwork and testing.** The auditor samples transactions, tests controls and checks operations against the plan document.
4. **Findings.** The auditor reviews draft findings with the plan's management.
5. **Report and management letter.** The auditor issues an opinion on the financial statements and, often, a letter with control weaknesses and recommendations.
6. **File and follow up.** The report is attached to the Form 5500, which is due by the last day of the seventh month after the plan year ends unless extended. Then the plan fixes what the auditor found.

Audits are required every year the plan files as a large plan and remains funded.

## How should you choose an auditor?

Selecting the IQPA is a fiduciary decision for the plan administrator. The DOL's own guidance on selecting an auditor points to the firm's experience with employee benefit plans, its licensing and peer review results, and its understanding of ERISA.

The quality gap is real. In the DOL's November 2023 audit quality study, covering 2020 filings, 30% of plan audits had major deficiencies. Firms that audited only one or two plans a year had a 70% deficiency rate, compared with 17% for firms auditing more than 100 plans.

A deficient audit is the plan's problem, not only the auditor's. The DOL can reject the Form 5500, and the plan administrator then has 45 days to file a satisfactory report. The DOL's enforcement manual sets the starting penalty for a missing or deficient accountant's report at $150 a day, capped at $50,000, and it can be higher depending on the facts. The DOL also refers significantly deficient audit work to state boards of accountancy and the AICPA.

## Plan audits vs. claims and eligibility audits.

An EBP audit is a financial statement audit that ERISA requires of some plans. A claims, billing or eligibility audit is an operational review that asks whether the plan paid the right amounts, for the right people, under its contracts. No federal filing requires one, and most health plans never need an IQPA audit at all, so the operational audits are usually where the money is.

| | EBP (IQPA) audit | Claims, billing or eligibility audit |
|---|---|---|
| **Purpose** | Opinion on the plan's financial statements | Find overpayments, billing errors and ineligible enrollees |
| **Who performs it** | An independent qualified public accountant | A claims auditor, the plan's advisor, or an audit firm under the plan's contract rights |
| **Required by law** | For large funded plans | No |
| **Where results go** | Attached to the Form 5500 | To the plan sponsor and committee, with recoveries |

Ethos Benefits does not perform IQPA audits; its [claims, billing and eligibility audits](https://ethosbenefits.com/services/audits) and [ERISA compliance](https://ethosbenefits.com/services/erisa-compliance) work cover the operational side.

## How do you prepare?

- **Confirm your status every year.** Check the participant count and the funding arrangement before the plan year starts, especially if you added a trust, changed carriers or moved to self-funding.
- **Keep records organized.** Plan documents, amendments, contracts, enrollment data and committee minutes should be easy to produce. The [ERISA compliance checklist](https://ethosbenefits.com/benefits-101/erisa-compliance-checklist) covers what to keep.
- **Watch employee contributions.** Deposit or forward them promptly, and keep proof of when they moved.
- **Name a point person.** One person who knows the plan should own the auditor's requests and coordinate with your TPA and carriers.
- **Fix prior findings.** Document what you changed after the last audit's management letter.
- **Check your fidelity bond.** Plans that handle funds generally need an [ERISA bond](https://ethosbenefits.com/benefits-101/erisa-bond), and auditors look for it.

## Frequently asked questions

### Does my health plan need an audit?

Only if it files as a large plan and is funded, meaning plan assets are held in a trust such as a VEBA. Fully insured plans, unfunded self-funded plans paid from the employer's general assets, and combinations of the two are exempt from the audit under 29 CFR 2520.104-44, even with 100 or more participants.

### When does a 401(k) plan need an audit?

A 401(k) plan generally needs an independent audit when it has 100 or more participants with account balances at the start of the plan year. That account balance count applies to defined contribution plans for plan years beginning on or after January 1, 2023. A plan between 80 and 120 participants may keep filing in its prior year's category.

### What is the 80-120 rule?

If a plan has between 80 and 120 participants at the start of the plan year and filed a Form 5500 for the prior year, it may file in the same category, small or large, as the prior year. A plan that filed as a small plan can stay small, and skip the audit, until it passes 120 participants.

### When is the employee benefit plan audit due?

The audit report is due with the plan's Form 5500, because the accountant's opinion is attached to the filing. The Form 5500 is due by the last day of the seventh month after the plan year ends, which is July 31 for a calendar-year plan. An extension on Form 5558 adds up to two and a half months.

### Who chooses the plan auditor?

The plan administrator, usually the employer, engages the independent qualified public accountant. Choosing and monitoring the auditor is a fiduciary decision, so it should rest on the firm's experience with ERISA plan audits, its licensing and its peer review results, not on price alone. The DOL publishes guidance on what to look for.

### What happens if the audit is missing or deficient?

The Department of Labor can reject the Form 5500, and the plan administrator then has 45 days to file a corrected report. If it is not fixed, the DOL can assess a daily penalty against the plan administrator. Its enforcement manual starts that penalty at $150 a day, capped at $50,000, and it can be higher.

### Is a claims audit the same as an employee benefit plan audit?

No. An employee benefit plan audit is a financial statement audit by an independent qualified public accountant, filed with the Form 5500. A claims, billing or eligibility audit checks whether the plan paid the right amounts for the right people, and no federal filing requires it.

## Sources

1. [29 CFR § 2520.104-44, Limited exemption and alternative method of compliance for annual reports of certain unfunded and insured plans](https://www.law.cornell.edu/cfr/text/29/2520.104-44), Legal Information Institute, Cornell Law School
2. [29 CFR § 2520.103-1, Contents of the annual report](https://www.law.cornell.edu/cfr/text/29/2520.103-1), Legal Information Institute, Cornell Law School
3. [2024 Instructions for Form 5500, Annual Return/Report of Employee Benefit Plan](https://www.dol.gov/sites/dolgov/files/EBSA/employers-and-advisers/plan-administration-and-compliance/reporting-and-filing/form-5500/2024-instructions.pdf), U.S. Department of Labor, IRS and PBGC
4. [Annual Reporting and Disclosure, final rule (88 FR 11793, February 24, 2023)](https://www.federalregister.gov/documents/2023/02/24/2023-02652/annual-reporting-and-disclosure), Federal Register, Employee Benefits Security Administration
5. [Reporting Compliance Enforcement Manual, Chapter 5, Enforcement Programs Procedures](https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/enforcement/oca-manual/chapter-5), U.S. Department of Labor, Employee Benefits Security Administration
6. [Audit Quality Study, November 2023](https://www.dol.gov/sites/dolgov/files/ebsa/about-ebsa/our-activities/resource-center/publications/november-2023-audit-quality-study.pdf), U.S. Department of Labor, Employee Benefits Security Administration
7. [Selecting an Auditor for Your Employee Benefit Plan](https://www.dol.gov/sites/dolgov/files/EBSA/about-ebsa/our-activities/resource-center/publications/employee-benefit-plan-auditor-selection.pdf), U.S. Department of Labor, Employee Benefits Security Administration