When Does a 401(k) Need an Audit?

The old shortcut—"100 employees means a 401(k) audit"—is wrong.

For defined contribution plans, the Department of Labor changed the participant-count methodology beginning with the 2023 plan year. The small-plan reporting and audit threshold generally counts participants with account balances at the beginning of the plan year, not every employee who is merely eligible but has never established an account.^[1]

Then the 80–120 participant rule can override the obvious result.

A plan with 108 account-balance participants might still file as a small plan and avoid the annual IQPA audit if it filed as small the year before and satisfies the small-plan audit-waiver conditions.^[2]

That is why headcount alone is a poor compliance test.

Key Takeaways

• Defined contribution plans generally use the number of participants with account balances at the beginning of the plan year for the small/large-plan reporting threshold.^[1]
• This counting methodology applies for plan years beginning on or after January 1, 2023.^[1]
• A plan with 100 or more participants under the applicable count is generally a large-plan filer, but the 80–120 participant rule can preserve the prior year's filing category.^[2]
• If a plan filed as small last year and begins the current year with fewer than 121 participants, it can generally continue to file as small under the 80–120 rule.^[2]
• A small pension plan does not automatically escape audit. It must satisfy the conditions of DOL's audit waiver.^[3][6]
• The annual audit is performed by an independent qualified public accountant, or IQPA.^[3][4]
• The accountant's report and audited financial statements become part of the Form 5500 filing when an audit is required.^[4][5]
• A qualified small plan can generally use the audit waiver when at least 95% of assets are qualifying plan assets, or when additional bonding and disclosure conditions are satisfied for non-qualifying assets.^[6]
• An audit can test areas such as investments, contributions, participant data, benefit payments, plan obligations, expenses and prohibited transactions.^[3]
• An audit is not a blanket government or CPA certification that every plan operation is correct.
• Plan administrators choosing a low-cost auditor with little employee-benefit-plan experience are taking a measurable risk. DOL has repeatedly found audit quality problems concentrated among firms performing few benefit-plan audits.^[3][9]

Count Participants With Account Balances

Before 2023, defined contribution plans generally counted employees who were eligible to participate even if they had never contributed and had no account.

That inflated the audit count for employers with:

• low participation
• high turnover
• automatic eligibility
• large numbers of non-contributing employees

DOL changed the methodology for defined contribution plans.^[1]

The relevant small-plan count now focuses on:

participants with account balances

at the beginning of the plan year.

Example: 160 Eligible Employees, 82 Accounts

Assume a company has:

• 160 employees eligible for the 401(k)
• 82 participants with account balances at the beginning of the plan year

The old shortcut says:

160 employees → audit

The current defined contribution methodology points to:

82 account-balance participants

for the small-plan threshold analysis.^[1]

That can keep the plan in small-plan reporting status, subject to the rest of the rules.

The difference is not cosmetic. It can determine whether the plan incurs a five-figure professional audit cost.

Account Balance Can Exist Without Current Contributions

Do not equate:

participant with account balance

with:

employee currently contributing

A participant can have a balance while contributing zero this year.

Examples include:

• former contributor who stopped deferrals
• terminated employee who left money in the plan
• participant receiving only employer contributions
• employee with rollover assets

The Form 5500 count should follow the applicable filing instructions, not payroll participation shorthand.

The Basic Large-Plan Rule

DOL describes Schedule H as the financial schedule for large-plan filers, generally plans with:

100 or more participants at the beginning of the plan year.^[2]

For defined contribution plans under the current methodology, use the applicable account-balance participant count.^[1]

Large pension plans generally must attach:

• audited financial statements
• IQPA report
• required supplemental schedules

to the annual Form 5500.^[3][4]

But "100 or more" is not the whole rule.

The 80–120 Participant Rule

The 80–120 rule prevents a plan from bouncing between small- and large-plan filing requirements every time participant count moves around 100.

DOL states that a plan with between:

80 and 120 participants

at the beginning of the plan year can generally file in the same category it used the prior year.^[2]

That prior-year status matters.

Example: Small Plan Grows to 108

Assume:

Prior year

• plan filed as small

Current beginning-of-year count

• 108 participants with account balances

A simple 100-participant test says:

large plan

The 80–120 rule can allow the plan to continue filing as:

small

because it filed as small the prior year and starts the current year below 121.^[2]

If the plan satisfies the small-plan audit-waiver conditions, an IQPA audit may still be avoided.

Example: Large Plan Falls to 92

Now reverse the facts.

Prior year

• plan filed as large

Current beginning-of-year count

• 92

Because 92 falls within the 80–120 band, the plan can generally continue filing in the same:

large-plan

category as the prior year.^[2]

The rule works both directions.

The prior filing status can matter more than whether this year's number sits above or below 100.

The 80–120 Rule Eventually Ends

Suppose the prior-year small plan grows to:

121 participants

at the beginning of the year.

It is outside the transition band.

The small-plan continuity rule no longer solves the problem.^[2]

That is why 121 can be more consequential than 100 for a plan that was already filing as small.

Small Plan Does Not Automatically Mean No Audit

Small pension plans can qualify for DOL's annual IQPA audit waiver.

The waiver is conditional.

A small plan that fails the conditions can still need an audit.^[3][6]

That is particularly important for plans holding:

• private investments
• unusual real estate interests
• assets outside conventional regulated custodians
• other non-qualifying assets

A plan can be small by participant count and still create enough asset-verification risk that the ordinary waiver does not apply.

The 95% Qualifying-Asset Test

DOL's small-plan audit-waiver framework uses qualifying plan assets.^[6]

If at least:

95% of total plan assets

are qualifying plan assets, the ordinary fidelity-bonding rules can generally support the waiver, assuming the other disclosure conditions are met.^[6]

Qualifying assets can include specified assets held through regulated institutions and structures, such as certain:

• bank-held assets
• insurance contracts
• registered investment company shares
• broker-dealer-held securities
• qualifying participant loans
• participant-directed assets supported by qualifying institutional statements.^[6]

The legal definition controls.

Do not classify an asset as qualifying merely because it looks liquid or familiar.

Less Than 95% Does Not Automatically Force an Audit

Suppose a small plan has:

• total assets: $3 million
• qualifying assets: $2.64 million
• non-qualifying assets: $360,000

Qualifying percentage:

88%

The plan fails the 95% test.

That does not necessarily mean an audit is unavoidable.

The small-plan waiver can still be available if enhanced fidelity bonding and the other waiver conditions are satisfied.^[6]

For the non-qualifying assets, DOL's enhanced rule can require bonding equal to:

100% of the non-qualifying assets

when those assets exceed 5% of total plan assets.^[6]

INV-077 covers that bonding calculation.

Example: Enhanced Bond vs. Audit

Assume a small plan holds:

$400,000

of non-qualifying assets.

The plan administrator now faces a real decision.

Potential paths can include:

Preserve audit waiver

Obtain the enhanced bond and satisfy the required participant disclosure/document-access conditions.

Do not satisfy waiver

Engage an IQPA and complete the annual audit.

This is not just a compliance technicality.

Hard-to-value or non-institutionally held assets can make both:

• bonding
• auditing

more expensive.

Plan design can create recurring administrative cost.

What Is an IQPA?

IQPA stands for:

independent qualified public accountant

ERISA requires an IQPA for plans subject to the annual audit requirement.^[3][4]

DOL says the auditor must generally be:

• licensed or certified as a public accountant by a state regulatory authority
• independent of the plan and plan sponsor in the relevant professional sense.^[3][7]

The plan administrator hires the auditor on behalf of plan participants.^[4]

That responsibility should not be treated as clerical purchasing.

The Plan Administrator Owns the Selection Decision

DOL makes the plan administrator responsible for engaging the auditor.^[3]

That matters because a deficient audit can create a deficient Form 5500 filing.

A sponsor cannot safely defend a bad audit by saying:

"The CPA signed it."

The administrator selected the CPA and is responsible for filing a complete annual report.

Employee Benefit Plan Experience Matters

A CPA license is necessary.

It is not enough.

Employee benefit plan audits have specialized issues involving:

• participant data
• plan provisions
• contribution timing
• benefit payments
• prohibited transactions
• plan investments
• ERISA reporting
• Form 5500 schedules.^[3]

DOL explicitly tells administrators to consider benefit-plan audit experience when selecting an auditor.^[3]

That advice has evidence behind it.

The Cheapest Auditor Can Be the Most Expensive Choice

DOL's historical audit-quality research found a strong relationship between how many benefit-plan audits a CPA firm performed and its deficiency rate.

A later DOL analysis summarizing the 2015 Audit Quality Study reported that firms performing only:

1–2 employee benefit plan audits per year

had a 76% deficiency rate, compared with 12% for firms performing at least 100 annually.^[9]

Those figures describe historical audits, not the current profession-wide deficiency rate.

The implication remains useful:

specialization matters.

A low audit fee is poor value if the auditor does not understand the work.

What the 401(k) Auditor Actually Examines

DOL tells plan administrators to make sure the auditor considers areas such as:^[3]

• plan investments
• valuation
• participant contributions
• employer contributions
• participant data
• plan obligations
• benefit payments
• participant account balances
• administrative expenses
• prohibited transactions
• tax-status issues that come to attention
• required financial-statement schedules

This is why an employee benefit plan audit is not simply:

bank balance + investment statement = done

The plan's financial statements depend on operational data.

Example: Year-End Assets Are Correct, Contributions Were Late

Suppose:

• participant payroll deductions eventually reached the trust
• year-end assets reconcile perfectly
• total participant balances are correct at December 31

But employee deferrals sat in the employer's operating account longer than permitted earlier in the year.

A year-end balance check can miss the timing problem.

A proper benefit-plan audit considers contribution timing.^[3]

INV-076 explains why delayed participant contributions can also create fiduciary and prohibited-transaction issues.

Example: Correct Trust, Wrong Participant Data

Assume the trust contains exactly:

$20 million

The plan's total assets are correct.

But the recordkeeper has wrong service dates for 40 employees, causing vesting errors.

That is not cured because the trust balance ties.

Participant data is a distinct audit area.^[3]

Financial-statement integrity and participant-level administration intersect.

What an Audit Opinion Actually Addresses

ERISA requires the IQPA to examine the plan's financial statements and required schedules under applicable auditing standards and issue a report.^[4]

The auditor addresses whether those financial statements and schedules are presented fairly under the applicable financial reporting framework.

That is narrower than:

"We certify this 401(k) complied with every law."

The distinction matters.

An Audit Does Not Test Every Transaction

The audit's objective is not to re-perform the plan's entire year.

It is an independent examination of financial statements and required schedules under professional auditing standards.^[4]

The auditor performs procedures considered necessary to support the opinion.

An audit can uncover:

• operational errors
• late contributions
• prohibited transactions
• incorrect participant data
• control weaknesses

That does not mean every account, distribution, payroll file and investment transaction was individually re-executed by the CPA.

Audited Does Not Mean IRS-Approved

A clean audit opinion is not:

• an IRS determination that the plan preserved tax qualification
• a DOL certification that no fiduciary breach occurred
• a guarantee that every participant account is correct
• approval of every investment
• proof that all plan fees are reasonable

The auditor can identify matters relevant to tax status or ERISA compliance.^[3]

The audit remains a financial-statement engagement.

Audit vs. Fidelity Bond

These solve different problems.

The last row is the source of confusion.

Enhanced bonding can help a small plan qualify for the audit waiver.

That does not turn the bond into an audit.

Audit vs. Recordkeeper SOC Report

A recordkeeper may provide a service-organization controls report to plan management and auditors.

That report concerns controls at the service organization.

It is not the plan's financial-statement audit.

A 401(k) can have:

• a recordkeeper SOC report
• trustee reports
• audited investment funds

and still need its own ERISA plan audit.

The legal reporting entity is the plan.

The Plan Is the Entity Being Audited

This sounds obvious until it goes wrong.

DOL's audit-quality work has identified cases in which accountants audited:

• the trust
• an insurance vehicle
• another financial entity

instead of the employee benefit plan itself.^[4]

The plan is the reporting entity for the ERISA annual report.

Auditing the wrong pile of assets does not satisfy the requirement.

Full Audit vs. ERISA Section 103(a)(3)(C) Audit

ERISA permits a special election when qualifying investment information is prepared and certified by certain regulated:

• banks or similar institutions
• insurance carriers.^[8]

You may still hear the older phrase:

limited-scope audit

Current professional materials commonly call it an:

ERISA Section 103(a)(3)(C) audit.^[8]

The name change is useful because "limited scope" encouraged a bad inference:

the auditor barely audits anything.

That is false.

What the Section 103(a)(3)(C) Election Changes

When the statutory conditions are met, the plan administrator can instruct the auditor not to perform ordinary audit procedures over qualifying certified investment information.^[8]

The auditor still has responsibilities over the rest of the engagement.

Areas outside the qualifying certification can include:

• contributions
• participant data
• distributions
• plan obligations
• expenses
• prohibited transactions
• other financial-statement matters

A proper certification narrows one area.

It does not erase the audit.

The Plan Administrator Must Evaluate the Certification

The election depends on investment information certified by an institution that satisfies the statutory and regulatory conditions.^[8]

Management cannot simply accept any document labeled:

certification

from any custodian or broker.

The institution and certification have to qualify.

AICPA's current 2026 guidance specifically addresses management's responsibility for determining whether the conditions for the Section 103(a)(3)(C) election are met.^[8]

Brokerage Firm Is Not Automatically a Qualifying Certifier

DOL has historically distinguished qualifying banks and insurance carriers from ordinary securities brokerage firms for the Section 103(a)(3)(C) certification rules.

The legal status of the institution matters.

Do not assume that:

regulated financial company = qualifying certifying institution

for this specific ERISA election.

The plan administrator should confirm the certification before instructing the auditor to rely on it.

Independence Is Not a Formality

DOL updated its accountant-independence guidance in 2022.^[7]

The underlying principle remains straightforward:

The CPA should not have financial or business interests that undermine an objective audit opinion.

Independence questions can arise from:

• ownership interests
• financial relationships
• certain business relationships
• other connections with the plan or sponsor

A technically skilled auditor who is not independent does not satisfy the requirement.

What to Ask Before Hiring the Auditor

A useful RFP is shorter than most procurement questionnaires.

Ask:

How many employee benefit plan audits did your firm perform last year?

This reveals specialization.

Who will actually perform the work?

Partner résumé alone is not enough if inexperienced staff do the engagement with weak supervision.

What percentage use Section 103(a)(3)(C)?

The auditor should understand the certification rules.

What plan types do you audit?

A simple participant-directed 401(k) is different from:

• ESOP
• defined benefit pension
• multiemployer plan
• plan with private assets

Have your benefit-plan audits been subject to peer review or regulatory findings?

Ask for specifics.

What information will you need and when?

A good auditor should understand:

• payroll
• participant census
• trust reports
• distributions
• plan document
• amendments
• committee minutes
• contribution files
• service-provider reports

Vague document requests are not reassuring.

A Higher Audit Fee Can Be Rational

This is one area where "lowest cost" is a weak selection criterion.

A more experienced employee-benefit-plan audit team can cost more because it maintains:

• specialized training
• standardized procedures
• quality review
• benefit-plan expertise

That does not justify any price.

It does justify asking what the cheaper bid removes.

If the answer is:

experience, review time or specialized procedures

the saving can be false economy.

What Participants Can Learn From the Audit Report

The Form 5500 and attached auditor report are generally public through DOL's filing system.^[5]

A participant reviewing a large plan can look for:

• auditor firm
• type of opinion
• whether the Section 103(a)(3)(C) election was used
• financial statements
• supplemental schedules
• reportable matters appearing in the filing

The report gives more context than the employer's annual benefits brochure.

It still requires careful interpretation.

A Modified Opinion Deserves Attention

An auditor can modify the report when the financial statements or audit evidence create a material issue under the applicable standards.

A participant should not jump from:

modified opinion

to:

plan is insolvent

or:

fraud occurred

Read the reason.

Possible audit-report issues can involve:

• evidence limitations
• financial-statement departures
• certification problems
• other technical matters

The language matters more than the label.

A Clean Opinion Is Not a Plan Quality Rating

The opposite mistake is more common.

A clean audit opinion does not rank:

• investment menu quality
• employer match generosity
• retirement readiness
• participant service
• fee competitiveness

Those are separate questions.

The audit can support confidence in the financial statements without telling you whether the 401(k) is a strong plan for participants.

A Practical Audit-Requirement Test

Run the questions in this order.

1. What type of plan is this?

This article focuses on defined contribution plans such as 401(k)s.

2. How many participants with account balances existed at the beginning of the plan year?

Use the current defined contribution methodology.^[1]

3. What category did the plan file under last year?

If the count is 80–120, prior-year status can control.^[2]

4. If small, does the plan satisfy the audit waiver?

Check:

• qualifying plan assets
• fidelity bond
• participant disclosures
• access to supporting documents.^[6]

5. If audit is required, has an independent qualified public accountant been engaged?

Do not wait until the Form 5500 deadline.

6. Is a Section 103(a)(3)(C) election available and appropriate?

Check the certification and institution.

That sequence avoids most threshold mistakes.

Example: 108 Participants and Prior-Year Small Status

Assume:

• beginning-of-year account-balance participants: 108
• prior year filed small
• 100% of assets are qualifying plan assets
• required participant disclosures are made
• fidelity bond is adequate

Result:

The 80–120 rule can allow continued small-plan filing, and the plan may qualify for the IQPA audit waiver.^[2][6]

The fact that 108 exceeds 100 does not end the analysis.

Example: 88 Participants but Waiver Conditions Fail

Assume:

• beginning-of-year account-balance participants: 88
• small-plan filing status
• substantial private assets
• qualifying assets below 95%
• enhanced bond not obtained
• waiver disclosure conditions not satisfied

The plan can be small and still need an audit.^[3][6]

Participant count determines category.

It does not independently create the waiver.

Example: 121 Participants

Assume:

• prior year filed small
• current beginning-of-year account-balance count: 121

The 80–120 continuity rule no longer applies.^[2]

The plan generally moves into large-plan filing status and the annual IQPA audit requirement becomes relevant.

That single additional participant can have a material compliance cost.

Frequently Asked Questions

Does a 401(k) need an audit at 100 employees?

Not necessarily. For defined contribution plans, the current threshold generally uses participants with account balances at the beginning of the plan year, and the 80–120 participant rule can preserve prior-year filing status.^[1][2]

When did the participant-count rule change?

For plan years beginning on or after January 1, 2023.^[1]

Do terminated employees with balances count?

They can. The relevant Form 5500 count is based on participants with account balances under the applicable instructions, not merely active payroll contributors.

What is the 80–120 rule?

A plan with between 80 and 120 participants at the beginning of the year can generally continue using the same small- or large-plan filing category used the prior year.^[2]

Does every small 401(k) avoid an audit?

No. Small pension plans must satisfy the DOL audit-waiver conditions.^[3][6]

What happens if less than 95% of plan assets are qualifying assets?

Enhanced fidelity bonding and additional disclosure conditions can allow an eligible small plan to preserve the waiver. Otherwise an audit can be required.^[6]

Who performs the audit?

An independent qualified public accountant, or IQPA.^[3][4]

Is any CPA qualified?

The auditor generally must be appropriately licensed or certified and independent. DOL strongly emphasizes employee-benefit-plan audit experience because these engagements contain specialized audit areas.^[3][7]

Is the audit filed with Form 5500?

Yes, when the plan is subject to the audit requirement, the audited financial statements and accountant's report are generally included with the Form 5500 filing.^[4][5]

Does the auditor test participant contributions?

Contribution amounts and timing are among the areas DOL tells administrators to ensure the auditor considers.^[3]

Does an audit prove my individual 401(k) account is correct?

No. The audit is an examination of plan financial statements and required schedules, not a re-performance of every participant transaction.

What is a Section 103(a)(3)(C) audit?

It is an ERISA audit election under which qualifying investment information certified by an eligible regulated institution can be excluded from ordinary audit procedures, while the auditor continues work over the rest of the plan.^[8]

Is a fidelity bond the same as an audit?

No. The bond protects the plan against covered fraud or dishonesty. The audit independently examines financial statements. Enhanced bonding can be one condition allowing a small plan to waive the audit, but the two are not substitutes generally.^[6]

The Number to Check First

Do not start with company headcount.

Start with:

beginning-of-year participants with account balances

Then check:

prior-year filing status

Only after those two numbers are known should anyone decide that a 401(k) has crossed the audit threshold.

That order prevents the two most common mistakes: paying for an audit the plan did not yet need, or discovering after year-end that a required audit was never scheduled.

Sources & References

1. U.S. Department of Labor: Changes for the 2023 Form 5500 and Form 5500-SF
2. U.S. Department of Labor: EFAST2 Form 5500 and Form 5500-SF Filing Tips
3. U.S. Department of Labor: Selecting An Auditor For Your Employee Benefit Plan
4. U.S. Department of Labor: Reporting Compliance Enforcement Manual — Chapter 1
5. U.S. Department of Labor: Form 5500 Series
6. U.S. Department of Labor: Field Assistance Bulletin 2008-04 — Small Plan Audit Waiver Bonding
7. U.S. Department of Labor: 2022 Update to Accountant Independence Guidance
8. AICPA & CIMA: ERISA Section 103(a)(3)(C) Audits of Employee Benefit Plans Primer
9. U.S. Department of Labor: An Analysis of Benefit Plans Auditors

Educational Disclaimer

ROIStreet publishes educational content about retirement-plan reporting and ERISA. This article is not legal, accounting, audit, tax or fiduciary advice. Audit requirements depend on plan type, participant counts, prior-year filing status, plan assets, bonding, disclosures and current Form 5500 rules.

The ROIStreet Reader Promise

We strive to explain before we evaluate, present evidence before opinions, discuss risks alongside potential benefits, distinguish facts from analysis, and correct material errors transparently.

Our purpose is to help readers better understand investing—not to tell them what to do.