Most business owners do not think about 401k audit requirements until someone else brings it up: a plan administrator, a payroll provider, or a letter from the DOL. By then, the deadline is closer than it should be and the plan records are rarely in the shape an auditor expects to find them.
The rule is straightforward in principle. Once your 401(k) plan reaches a certain number of eligible participants, you are legally required to have an independent audit conducted by a qualified CPA firm and submitted with your Form 5500 filing. Miss that requirement and you are looking at penalties that accumulate daily while you work out what went wrong.
This post explains exactly what triggers the audit requirement, what auditors look at when they arrive, and what a prepared plan sponsor does before the process begins. If your company is growing and you have a retirement plan, this applies to you.
What You’ll Learn
• Exactly how many plan participants trigger a mandatory independent audit under DOL rules, including the 80-120 transition exception
• What an auditor examines during a 401(k) plan audit and which records plan sponsors are most frequently unprepared to produce
• The specific penalties for missing the audit requirement or filing Form 5500 without an auditor’s report attached
• What a prepared plan sponsor does in the months before an audit begins, versus the scramble that defines an unprepared one
• How to identify a CPA firm that is actually qualified to conduct an employee benefit plan audit under ERISA and DOL standards
When Does a 401(k) Plan Actually Require an Independent Audit?
The 401k audit requirement is tied to participant count, not headcount and not active contributors. A 401(k) plan is required to have an independent audit once it reaches 100 or more eligible participants at the beginning of the plan year, regardless of how many employees are actively contributing.
That distinction trips people up regularly. Eligible participants includes employees who are eligible to participate in the plan, not just those who have enrolled. Someone who qualifies to join your 401(k) but has not signed up yet still counts toward your total.
The 80-120 Transition Rule
Plans near the boundary have a narrow exception available. If your plan had between 80 and 120 eligible participants at the start of the plan year and you filed as a small plan (no audit required) in the previous year, you may continue filing as a small plan for one more year. This is the 80-120 rule, and it exists to avoid forcing plans across the audit threshold based on minor year-to-year fluctuations in headcount.
Once you exceed 120 participants, the exception no longer applies. The audit requirement kicks in with no further grace period.
Understanding where your plan sits relative to this threshold is the first practical step. If you are approaching the large plan filer audit threshold and have not yet spoken to a qualified CPA firm, that conversation should happen before you cross the line, not after.
What the DOL and IRS Are Looking for When Your Plan Gets Audited
The employee benefit plan audit process is more detailed than most plan sponsors expect. Auditors are not simply reviewing whether contributions were made. They are examining whether the plan operates in the way it is documented and whether participant rights have been properly protected throughout the year.
A 401(k) plan is required to have an independent audit once it reaches 100 eligible participants at the start of the plan year, regardless of how many employees are actively contributing.
Here is what auditors typically examine:
• Plan document compliance: Does the plan operate according to its written terms? Amendments, eligibility rules, and vesting schedules all need to match how the plan actually runs.
• Participant eligibility records: Were the right employees enrolled at the right time? Were any excluded who should have been included?
• Contribution accuracy and timing: Were employee deferrals deposited within the DOL’s required timeframe? Late contributions are one of the most common audit findings.
• Vesting calculations: Are participants receiving the correct vested percentage based on their years of service?
• Loan and distribution records: Are plan loans documented properly? Were distributions processed correctly and taxed appropriately?
• Internal controls: Does the plan sponsor have adequate processes in place to catch errors before they compound?
Limited-Scope vs. Full-Scope Audits
The scope of your audit may vary depending on your plan’s investment structure. A full-scope audit covers all plan assets and transactions. A limited-scope audit, now referred to under the SECURE 2.0 Act as an ERISA Section 103(a)(3)(C) audit, excludes investment information that has been certified by a qualifying financial institution. This reduces the volume of testing but does not eliminate the audit requirement.
Your auditor will confirm which scope applies to your plan. What matters for preparation is the same in both cases: your participant data, contribution records, and plan documentation need to be accurate and accessible.
This is where the 401k plan compliance review work happens before the auditor arrives. Plans that have been actively maintained throughout the year are significantly easier to audit than plans that have been left on autopilot.
How Do You Know If Your Plan Is Ready for Scrutiny?
Most plan sponsors find out they are not ready by getting partway into an audit and discovering gaps in their records. The better approach is to assess the plan’s condition before an auditor arrives. That means running a preparation process, not waiting for the audit to surface the problems.
A prepared plan sponsor typically has the following in order before the engagement begins:
• A complete, current plan document with all amendments noted and dated
• Participant census data that matches payroll records exactly
• Contribution deposit records with dates, showing that employee deferrals were transferred to the plan within the required timeframe
• Vesting schedules that have been calculated and updated for all participants
• Loan records that are current, including outstanding balances and repayment histories
• Distribution documentation for any withdrawals processed during the plan year
• Evidence that eligibility determinations were made correctly for all employees
An unprepared plan sponsor is scrambling to locate records that should have been maintained throughout the year, explaining inconsistencies between how the plan was documented and how it was actually administered, and hoping the auditor does not find anything that requires a corrective contribution.
The difference in outcome between these two situations is significant. Plans with clean records tend to move through the audit efficiently. Plans with gaps in documentation or inconsistencies in participant data create findings that require additional work and, in some cases, corrective action with the DOL.
For Bay Area companies, this is particularly relevant. Growth-stage businesses in the San Francisco Bay Area are adding headcount at a pace that can push a plan across the audit threshold faster than expected. A company that had 80 eligible participants eighteen months ago may be well past 100 today, and the obligation does not wait for the plan sponsor to notice.
What Happens If You Miss the Deadline or File Without an Audit?
The DOL audit triggers for retirement plans are not advisory. They are legal obligations with penalty structures attached. Filing Form 5500 without the required auditor’s report is treated as an incomplete filing, not a partial one, and the penalties reflect that.
The independent auditor’s report is a required attachment to Form 5500 for large plan filers, and filing without it exposes the plan sponsor to DOL penalties that accumulate daily.
Here is the penalty structure in plain terms:
| Penalty Source | Amount | Cap |
| IRS (late Form 5500 filing) | Up to $250 per day | $150,000 per filing |
| DOL (late or incomplete filing) | Up to $150 per day | No statutory cap |
These figures apply separately. A plan sponsor who misses the filing deadline and omits the auditor’s report can face both sets of penalties running simultaneously.
Form 5500 is due seven months after the close of the plan year. For calendar-year plans, that is July 31. A two-and-a-half month extension is available, pushing the deadline to October 15. The extension applies to the filing, not to the audit itself. The audit needs to be complete before the filing goes in.
Plan sponsors who realise late that they are in large plan filer status and have not engaged an auditor are often working against a timeline that cannot absorb delays. Starting the engagement early is not optional; it is the only way to give the auditor enough time to do the work properly.
How to Choose the Right CPA Firm for a 401(k) Plan Audit
This is where many plan sponsors make a costly mistake. When is a 401k audit required is a question most owners figure out eventually. The follow-up, who should actually conduct it, gets less attention and more gets wrong.
DOL rules require an Independent Qualified Public Accountant, known as an IQPA. The firm must be independent of the plan, meaning it cannot have a financial relationship with the plan or the plan sponsor that would compromise its objectivity. Beyond independence, the firm needs specific experience conducting employee benefit plan audits under ERISA and DOL standards. These are not the same skills as general tax or business accounting work.
Choosing a CPA firm without specific experience in employee benefit plan audits is one of the most common and costly mistakes plan sponsors make when facing this requirement for the first time.
When evaluating firms, ask directly:
• How many employee benefit plan audits does the firm conduct each year?
• Does the firm participate in the AICPA’s Employee Benefit Plan Audit Quality Center?
• Has the firm conducted audits for plans similar in size and structure to yours?
• What does the firm’s quality control process look like for benefit plan engagements?
A generalist firm that occasionally handles benefit plan audits is not the same as a firm with a dedicated practice in this area. The technical requirements of ERISA compliance, the documentation expectations, and the judgment calls involved in scoping and conducting these audits all require depth that comes from doing this work regularly.
[Internal link to audit and assurance services page, AM to insert verified URL before publishing. Suggested anchor text: audit and assurance services]
The LNB team works with plan sponsors through the audit and assurance services line, including employee benefit plan audits for growing companies navigating this requirement for the first time. The engagement starts with a clear conversation about where your plan stands, what the timeline looks like, and what needs to be in order before the formal work begins.
For plan sponsors who are also managing a broader transaction, investment process, or advisory need alongside their compliance obligations, the Business Due Diligence Playbook is a practical tool for tracking and managing a complex financial process with multiple moving parts.
If you want to understand how financial due diligence services connect to your broader financial readiness as your company grows, that context is worth having before a deal or funding event puts it in front of you under pressure.
Key Takeaways
• The 401k audit requirement applies once a plan reaches 100 eligible participants at the start of the plan year, based on eligibility, not active enrollment
• Plans between 80 and 120 participants may qualify for a one-year transition exception under the 80-120 rule if they filed as a small plan the prior year
• Auditors examine plan document compliance, contribution timing, participant eligibility, vesting accuracy, loan records, distribution documentation, and internal controls
• Filing Form 5500 without the required auditor’s report is treated as an incomplete filing and carries separate IRS and DOL penalty exposure
• The audit engagement needs to be complete before the Form 5500 deadline, which means the process needs to start well in advance of July 31 for calendar-year plans
• Only an Independent Qualified Public Accountant with specific employee benefit plan experience meets DOL requirements for this work
If Your Plan Is Approaching the Audit Threshold, Do Not Wait for It to Arrive
The plan sponsors who come through a 401(k) audit with the least disruption are the ones who started the process before it felt urgent. They had their records in order, they had engaged a qualified firm with time to work properly, and they understood what the auditor was going to look at before anyone asked.
Reviewing your 401k audit requirements now, whether you are currently above the threshold or approaching it, puts you in a position to respond with preparation rather than scramble. If your plan is near or past 100 eligible participants and you have not yet confirmed whether an independent audit is required, that confirmation is the first step.
Book a discovery call with the LNB team to review where your plan stands, what the timeline looks like for your situation, and what needs to be in order before the formal engagement begins.
Questions Plan Sponsors Ask Before Their First 401(k) Audit
How many employees do I need before my 401(k) plan requires an audit?
A 401(k) plan generally requires an independent audit once it has 100 or more eligible participants at the beginning of the plan year. Plans between 80 and 120 participants may qualify for a transition exception if they filed as a small plan in the previous year. The count is based on eligibility, not active participation, so employees who qualify for the plan but have not enrolled still count.
What does a 401(k) auditor actually look at during the audit?
Auditors review the plan document, participant eligibility records, contribution timing and accuracy, vesting calculations, loan and distribution records, and the plan’s internal controls. They are looking for inconsistencies between how the plan operates and how it is documented. The most common findings involve late contributions, missing participant records, and eligibility errors.
What is the deadline for filing a 401(k) audit with Form 5500?
Form 5500 is due seven months after the close of the plan year, with a two-and-a-half month extension available. For calendar-year plans, the standard deadline is July 31, with an extension to October 15. The audit must be complete before the filing goes in, so the engagement timeline should account for the auditor’s work, not just the filing date.
What are the penalties if I miss the 401(k) audit requirement?
The IRS can impose penalties of up to $250 per day (capped at $150,000) for late Form 5500 filings. The DOL can impose additional penalties of up to $150 per day with no statutory cap. Filing without the required auditor’s report is treated as an incomplete filing, which means both sets of penalties can run simultaneously until the filing is corrected.
Can any CPA firm conduct a 401(k) plan audit?
No. DOL rules require an Independent Qualified Public Accountant, and the auditor must be independent of the plan. Not all CPA firms have the employee benefit plan audit experience required to conduct these engagements properly. Choosing a firm without dedicated benefit plan audit experience is a common and avoidable mistake.
What is the difference between a limited-scope and full-scope 401(k) audit?
A limited-scope audit, now referred to as an ERISA Section 103(a)(3)(C) audit under SECURE 2.0, excludes investment information certified by a qualifying financial institution, which reduces the scope of testing. A full-scope audit covers all plan assets and transactions. Your auditor will confirm which scope applies based on your plan’s investment structure, but preparation requirements are substantively similar for both.
If your plan is approaching the audit threshold or you have already received a Form 5500 notice, the LNB team works with growing companies through every stage of the employee benefit plan audit process. Book a discovery call to understand exactly what is required and what your plan needs in order before the work begins.
