The Complete Guide to Employee Benefit Plan (EBP) Audits in 2026: Everything CPA Firms and Plan Sponsors Need to Know
Executive Summary
Employee Benefit Plan (EBP) audits sit in an odd spot in the accounting world: they’re mandatory for hundreds of thousands of retirement and welfare plans, they carry real fiduciary and financial stakes for plan sponsors, and yet they’re still treated by many firms as a lower-priority, seasonal add-on rather than a specialized practice area. That gap is exactly where problems show up.
This guide walks through what an EBP audit actually is, which plans need one, how the process works from planning through reporting, and what the Department of Labor’s own data says about audit quality across the profession. It also covers the documentation plan sponsors need to gather, the findings that show up most often, and the operational pressures – a shrinking CPA pipeline chief among them – that are pushing more firms toward audit support partnerships. Whether you’re an audit partner scoping next busy season or a controller trying to figure out why your plan suddenly needs an audit this year, the goal here is the same: give you a clear, accurate, and practical reference you can actually use.
Table of Contents
- What Is an Employee Benefit Plan Audit?
- Which Employee Benefit Plans Require an Audit?
- Who Needs an EBP Audit?
- Understanding ERISA Requirements
- The Complete EBP Audit Process
- Documents Required for an EBP Audit
- Common Audit Findings
- Best Practices for Audit Readiness
- How Technology Is Changing EBP Audits
- Why CPA Firms Are Leveraging Audit Support Teams
- Frequently Asked Questions
- Key Takeaways
Introduction
Every year, hundreds of thousands of 401(k), pension, and health and welfare plans in the United States cross a threshold that most plan sponsors never think about until it hits them: the point at which federal law requires an independent audit of the plan’s financial statements. For plan sponsors, this often arrives as a surprise – a headcount milestone buried in a Form 5500 filing deadline. For CPA firms, it arrives as a specialized, high-stakes engagement that doesn’t forgive generalist shortcuts.
The regulatory spotlight on these audits has only gotten brighter. As of fiscal year 2025, the Department of Labor’s Employee Benefits Security Administration (EBSA) oversees roughly 2.8 million health plans, 837,000 private pension plans, and 521,000 other welfare benefit plans, protecting more than 155 million workers, retirees, and dependents whose plans hold an estimated $13.8 trillion in assets. In fiscal year 2025 alone, EBSA recovered more than $1.4 billion for plans, participants, and beneficiaries, with over half of that coming directly from enforcement actions.
At the same time, the profession responsible for performing these audits is under real strain. Fewer CPA candidates are entering the pipeline, experienced auditors are retiring in large numbers, and the number of CPA firms willing to take on EBP audit work has been shrinking for over a decade even as the number of plans requiring audits has grown. That combination – rising regulatory scrutiny and a thinning bench of specialized auditors, is precisely why EBP audit quality, preparation, and staffing strategy deserve far more attention than they typically get.
This guide is built for two audiences. If you’re an audit partner or manager at a CPA firm, you’ll find a full walkthrough of the process, the quality benchmarks the DOL uses to judge firms like yours, and the staffing realities shaping how firms compete for this work. If you’re a plan sponsor, CFO, controller, or HR leader, you’ll find a plain-language explanation of why your plan needs an audit, what your auditor will ask for, and how to avoid becoming a statistic in next year’s DOL deficiency study.
Section 1: What Is an Employee Benefit Plan Audit?
An Employee Benefit Plan audit is an independent examination of a plan’s financial statements, typically a 401(k), pension, ESOP, or health and welfare plan – performed by a licensed CPA to confirm the plan’s financial condition is fairly presented and that it’s being operated in accordance with its own governing documents and applicable law.
Unlike a corporate financial statement audit, an EBP audit isn’t primarily about a company’s profitability. It’s about protecting the retirement and benefit assets of a plan’s participants. The auditor is testing things like: Were contributions deposited on time? Are participant accounts and eligibility calculated correctly? Are investments properly valued? Were distributions and loans processed according to plan terms? Is the plan being run the way its plan document says it should be run?
Regulatory framework.
EBP audits exist because of the Employee Retirement Income Security Act of 1974 (ERISA), the federal law that sets minimum standards for most voluntarily established retirement and health plans in private industry. ERISA Section 103(a)(3)(A) requires plans with more than 100 participants to retain an Independent Qualified Public Accountant (IQPA) to audit the plan’s financial statements in accordance with Generally Accepted Auditing Standards (GAAS)ERISA Section 103(a)(3)(A) requires that employee benefit plans with more than 100 participants retain an IQPA to perform an audit of the plan’s financial statements. This section requires that the audit be performed in accordance with GAAS.. That audit report then gets attached to the plan’s Form 5500 annual return, which is filed jointly with the DOL and IRS.
Two federal agencies share oversight here, and they care about different things. The DOL, through EBSA, is focused on protecting participants’ rights and plan assets. The IRS is focused on whether the plan maintains its tax-qualified status. Both rely on the audited Form 5500 filing to do their jobs, which is a big part of why the quality of the underlying audit matters so much – a weak audit doesn’t just create risk for the plan sponsor, it undermines two federal agencies’ ability to monitor the system.
Purpose, in plain terms:
an EBP audit exists to give the DOL, the plan’s participants, and the plan sponsor’s own fiduciaries confidence that the money set aside for employees’ retirement or health benefits is being handled correctly, recorded accurately, and protected from mismanagement or fraud.
Section 2: Which Employee Benefit Plans Require an Audit?
Not every benefit plan is subject to an audit requirement, and not every plan type is treated the same way once it does cross the threshold. Here’s how the major categories break down.
401(k) and other defined contribution plans.
These are by far the most common audited plan type. Because account balances are tracked individually per participant, auditors focus heavily on contribution timing, participant data accuracy, and investment valuation.
403(b) plans.
Common among nonprofit and educational employers, these follow largely the same audit rules as 401(k) plans once they cross the participant threshold.
Defined benefit (pension) plans.
These promise a fixed benefit at retirement rather than an account balance, which shifts audit focus toward actuarial assumptions, funding status, and benefit calculations rather than individual account activity.
Employee Stock Ownership Plans (ESOPs).
ESOPs add a layer of complexity because they hold employer stock, which usually isn’t publicly traded and requires an independent valuation each year – a frequent source of audit findings if the valuation methodology isn’t well documented.
Health and welfare plans.
These cover medical, dental, life, and disability benefits. Audit procedures here look different from retirement plan audits, focusing more on claims processing, premium payments, and stop-loss insurance arrangements than on investment activity.
Most plan types covered by ERISA are subject to the audit requirement, but there are notable exemptions. Governmental plans, church plans, plans maintained solely to comply with workers’ compensation or unemployment laws, plans for nonresident aliens maintained outside the U.S., and fully insured or unfunded welfare plans are generally exemptExempt plans include governmental plans, church plans, and plans established and maintained to comply with workers’ compensation, unemployment compensation or disability insurance laws. Plans maintained outside the United States for nonresident aliens and unfunded excess benefit plans don’t require an audit either. Insurance benefit plans fully insured, unfunded or both, are also exempt from the plan audit requirement.
Table: Employee Benefit Plan Types and Audit Focus
Plan Type | Primary Audit Focus | Common Complexity |
401(k) / Defined Contribution | Contribution timing, participant data, investment valuation | Payroll integration, eligibility tracking |
403(b) | Same as 401(k), plus universal availability rules | Multiple vendor arrangements |
Defined Benefit (Pension) | Actuarial assumptions, benefit calculations, funding | Actuarial report review |
ESOP | Employer stock valuation, allocation formulas | Independent valuation review |
Health & Welfare | Claims processing, premium remittance, stop-loss | Third-party administrator reliance |
Section 3: Who Needs an EBP Audit?
The trigger for most plans is participant count. Federal law generally requires plans with more than 100 participants (as of the first day of the plan year) to obtain an audit as part of their Form 5500 filingGenerally, Federal law requires employee benefit plans with 100 or more participants to have an audit as part of their obligation to file an annual return/report (Form 5500 series). A recent rule change narrowed the counting method for defined contribution plans specifically: the threshold is now based on participants with account balances as of the first day of the plan year, rather than all “eligible” participants – a shift that has pushed some plans below the audit threshold that would previously have required oneYour company’s benefit plan generally needs an audit if it has more than 100 participants with balances as of the first day of the plan’s year. This is a recent change as previously, the threshold included eligible participants in plans with a deferral option, such as 401(k) and 403(b) plans.
Counting participants is trickier than it sounds. “Eligible participants” for these purposes typically includes not just enrolled employees, but also employees who are eligible but haven’t enrolled, and terminated employees who still have an account balance”Eligible participants” includes more people than many teams expect. It’s not just the employees who enroll. It also includes those eligible but not enrolled, terminated employees with account balances, and sometimes participants who have not yet contributed. That’s exactly why plans often discover they’ve crossed the threshold only when preparing their Form 5500 – nobody was tracking headcount the way the DOL does.
The 80-120 rule.
Plans that hover around the 100-participant line get a bit of breathing room. If a plan had between 80 and 120 participants at the start of the plan year, it can generally file in the same category – large or small – that it used the previous yearRecent changes to Form 5500 have renewed interest in the 80/120 rule, which allows plans with 80–120 participants to avoid or delay audit requirements under certain conditions. This prevents a plan from bouncing in and out of audit requirements year to year due to small fluctuations.
New plans.
Plans in existence for seven months or fewer in their first plan year can generally delay – though not eliminate – the audit requirement until the following year, which matters for companies that just launched a plan, went through a plan year change, or merged with another organizationAny employee benefit plans in existence for seven months or fewer can generally delay, but not eliminate, ERISA’s audit requirement until the following year. Your plan could be affected by this rule if it was just created, the plan year changed or your company went through a merger.
Small plans, sometimes too.
Even plans under 100 participants can occasionally trigger an audit requirement if they fail to meet certain conditions related to investments, bonding, and disclosure, a nuance many small-plan sponsors don’t realize existsSome pension plans with fewer than 100 participants also may be required to have an audit if they fail to meet certain conditions relating to their plan investments, bonding, and disclosure requirements.
Section 4: Understanding ERISA Requirements
ERISA doesn’t just require an audit, it establishes a whole framework of fiduciary responsibility that the audit is designed to test and reinforce.
Fiduciary responsibility.
Under ERISA, a fiduciary is anyone with discretionary control over plan management or assets, responsibility for plan administration, or the authority to provide investment advice for compensation – a category that typically includes plan trustees, plan administrators, and members of the investment committee. Fiduciaries are legally obligated to act solely in the interest of plan participants and beneficiaries, and a well-executed audit is one of the clearest ways a fiduciary can demonstrate that duty was met.
Plan sponsor responsibilities.
The plan administrator, usually the plan sponsor unless another party is specifically designated, is legally responsible for maintaining complete and accurate plan records and making them available to the auditor, including records held by third-party service providers like recordkeepers or claims administrators. Selecting a qualified auditor is itself treated as a fiduciary duty. The auditor must be licensed or certified as a public accountant by a state regulatory authority, and should have no financial or other conflicts of interest with the plan or sponsor that could compromise an objective opinion.
DOL expectations.
The DOL doesn’t just care that an audit happened, it cares that it was performed well. Its own research found that studies of employee benefit plan audits show a meaningfully lower deficiency rate among firms that belong to the AICPA’s Employee Benefit Plan Audit Quality Center (EBPAQC) compared to firms that don’t, which is exactly why plan sponsors are directed to check for that membership when selecting an auditor.
Penalties for noncompliance are not symbolic. In 2026, the DOL can assess civil penalties of up to $2,739 per day for late or deficient Form 5500 filings, a number that climbs fast for a plan that misses a deadline or files an audit report that doesn’t meet GAAS standards.
Section 5: The Complete EBP Audit Process
A well-run EBP audit generally moves through six stages. Understanding this flow helps both auditors scope the engagement correctly and plan sponsors know what to expect and when.
1. Planning.
The auditor gathers an understanding of the plan’s provisions, prior-year workpapers, service providers, and any changes since the last audit (new recordkeeper, plan amendment, merger, etc.). This stage sets the scope and timeline for everything that follows.
2. Risk Assessment.
The auditor identifies where the plan is most likely to have material misstatements, commonly around participant data, contribution timing, and investment valuation, and tailors testing procedures accordingly rather than applying a generic checklist.
3. Internal Controls Review.
The auditor evaluates how the plan sponsor and its service providers process transactions: how payroll data flows into contribution remittances, how eligibility is tracked, how distributions and loans are authorized. Weak controls here often drive the scope of substantive testing that follows.
4. Testing.
This is the bulk of fieldwork, sampling transactions to verify contributions were remitted timely and in the correct amount, testing distributions and loans against plan terms, confirming investment balances and valuations, and reviewing eligibility determinations.
5. Evidence Collection.
Auditors gather and document the support for their conclusions: confirmations from trustees and custodians, payroll records, census data, and (where applicable) SOC 1 reports from service organizations.
6. Reporting.
The auditor issues an opinion on the plan’s financial statements, along with any required communications about internal control deficiencies or other findings to those charged with governance – typically the plan committee or sponsor’s leadership.
Section 6: Documents Required for an EBP Audit
Preparation is the single biggest lever plan sponsors have over how smooth, and how expensive, an audit turns out to be. The following checklist covers what auditors typically request.
Table: EBP Audit Document Checklist
Category | Documents Typically Required |
Plan Governance | Plan document and amendments, adoption agreement, IRS determination/opinion letter |
Trust & Custody | Trust agreements, trustee/custodian statements for the plan year |
Payroll & Contributions | Payroll registers, contribution remittance records, deferral election forms |
Participant Data | Participant census, eligibility records, enrollment and termination data |
Investments | Investment statements, fee disclosures, SOC 1 reports from recordkeepers |
Distributions & Loans | Distribution requests and approvals, loan agreements and repayment schedules |
Prior Audits | Prior year audit report and management letter, prior Form 5500 filings |
Service Agreements | Contracts with third-party administrators, recordkeepers, and investment managers |
Compliance Testing | ADP/ACP test results, top-heavy testing, coverage testing |
Gathering this material early, ideally starting reconciliation work well before the auditor’s official request list arrives, is consistently the difference between a predictable engagement and a scramble against the Form 5500 deadline.
Section 7: Common Audit Findings
The DOL’s own quality studies give a clear picture of where EBP audits tend to go wrong, both on the auditor’s side and the plan sponsor’s side.
Late contributions.
Failing to remit employee deferrals to the trust promptly is one of the most persistent findings across plan audits, and it’s a fiduciary breach the DOL watches closely, since delayed remittance means participants’ money sat outside the trust, and out of the market, longer than it should have.
Missing or incomplete documentation.
Plans that can’t produce a clean paper trail for eligibility determinations, distribution approvals, or loan terms create real audit delays and, in some cases, reportable findings.
Weak internal controls.
Gaps in how contribution data flows from payroll to the trust, or how distributions get authorized, are a recurring theme, particularly at organizations that changed payroll providers or recordkeepers mid-year without verifying the data mapping.
Incorrect eligibility determinations.
Auto-enrollment failures, missed deferral opportunities, and incorrect compensation definitions used in eligibility calculations show up repeatedly and often require formal correction under DOL or IRS correction programs.
Incomplete participant records.
Gaps in census data, missing termination dates, incorrect birthdates, or unreconciled account balances, slow down testing and can point to broader recordkeeping issues.
Operational errors.
Plan operation that doesn’t match the plan document, for example, using the wrong compensation definition for matching contributions, is a common and often costly finding, since correcting it can require retroactive contributions with lost earnings.
The DOL’s most recent quality study, examining audits of 2020 plan filings, offers a useful benchmark. Of more than 300 audits sampled, 30% had at least one deficiency, an improvement from 39% in the agency’s prior study, while 8% had five or more deficiencies, down sharply from 48% previouslyOf more than 300 audits sampled, 30% had at least one deficiency, an improvement from 39% in the prior study. However, 8% had five or more deficiencies, down from 48%. The most common problem areas were participant data and contributions, along with distributions, internal controls, investments, party-in-interest transactions, and audit planning itself.
One pattern stands out above all others: audit quality correlates strongly with auditor experience. Firms performing 100 or more EBP audits annually had an 18% major deficiency rate, compared to 25% for firms performing 25 or more, and 55% for firms performing fewer than 25Audit quality strongly correlates with a firm’s experience. Firms performing 100+ audits annually had an 18% major deficiency rate, compared to 25% for firms with 25+ audits and 55% for those with fewer than 25. That’s not a small gap, it’s the difference between a specialized practice and a generalist firm dabbling in an area it doesn’t perform often enough to master.
An earlier DOL analysis found something equally telling about where the financial risk concentrates: an estimated $653 billion in plan assets were held in audits that contained GAAS deficiencies, and 93% of those at-risk assets were audited by CPA firms performing fewer than 100 audits annually. The same study estimated that 22.5 million plan participants were affected by audits containing one or more deficiencies.
Table: Common EBP Audit Findings
Finding | Typical Root Cause | Correction Path |
Late contribution remittance | Payroll-to-trust process delays | VFCP / SCC correction with lost earnings |
Missing documentation | Poor recordkeeping across service providers | Rebuild records, tighten retention policy |
Weak internal controls | Undefined process ownership | Formal control documentation, SOC 1 review |
Eligibility errors | Incorrect compensation or enrollment logic | Retroactive correction, plan document review |
Incomplete census data | Payroll/recordkeeper data mismatches | Data reconciliation before fieldwork begins |
Section 8: Best Practices for Audit Readiness
Plan sponsors and CPA firms that treat audit prep as a year-round discipline, rather than a pre-deadline sprint, consistently see fewer findings and lower audit fees. A practical readiness checklist:
- Reconcile contribution data monthly, not just at year-end, so remittance timing issues surface while they’re still easy to fix.
- Maintain a current plan document library, including every amendment, so operational practice can always be checked against what the document actually says.
- Track participant eligibility changes in real time, especially around auto-enrollment and compensation changes tied to payroll system updates.
- Request SOC 1 reports from every recordkeeper and TPA annually, and actually review the complementary user entity controls section, this is frequently skipped.
- Document distribution and loan approval processes so there’s a clean audit trail for every transaction, not just a system log.
- Review the prior year’s management letter early, and confirm every prior finding has been remediated before the current audit begins.
- Choose an auditor based on experience, not just cost, ask directly how many EBP audits the firm performs annually and whether the firm belongs to the AICPA’s Employee Benefit Plan Audit Quality Center.
- Build in a pre-fieldwork readiness meeting between the sponsor’s finance team and the audit team to walk through the document request list before the clock starts.
Section 9: How Technology Is Changing EBP Audits
EBP audits have historically been document-heavy and manually intensive, reconciling spreadsheets, confirming balances by phone or email, tracing transactions one by one. That’s shifting.
Automation is increasingly used to reconcile payroll data against trust remittances, flagging timing discrepancies automatically rather than relying on manual sampling to catch them.
Data analytics now allows auditors to test 100% of a population, every contribution, every distribution, rather than a statistical sample, which materially changes the odds of catching an outlier before it becomes a finding.
AI-assisted document review is beginning to speed up the process of matching plan documents against operational practice, and of flagging inconsistencies in census data before fieldwork even starts, though human review remains essential for anything touching fiduciary judgment or GAAS compliance.
Workflow and engagement management software has made it easier for audit teams, including outsourced or offshore support staff, to work concurrently on standardized workpapers, which matters increasingly as more firms build audit teams that span multiple locations and time zones.
Digital documentation and secure client portals have mostly replaced the old model of shipping boxes of paper records back and forth, cutting both the time and the risk associated with document exchange.
None of this replaces the auditor’s judgment, EBP audits still hinge on interpreting plan documents correctly and applying professional skepticism to unusual transactions. But it does change where a firm’s specialized staff spend their time: less on manual reconciliation, more on the judgment calls technology can’t make.
Section 10: Why CPA Firms Are Leveraging Audit Support Teams
This is where the staffing conversation and the audit quality conversation converge, and it’s arguably the most consequential trend shaping EBP audits heading into busy season 2026.
The talent pipeline has genuinely contracted. CPA exam participation has declined more than 30% since its mid-2010s peak, and the AICPA’s own 2025 Trends Report shows a workforce increasingly concentrated in later-career age groups even as demand keeps climbingCPA exam participation has declined more than 30% since its peak in the mid-2010s. The Bureau of Labor Statistics projects well over 100,000 accounting and auditing job openings annually, a gap the current pipeline isn’t close to fillingThe Bureau of Labor Statistics projects more than 120,000 accounting and auditing openings each year, while the 2025 AICPA/NASBA Trends Report shows a shrinking pipeline of new CPAs and a workforce increasingly concentrated in later-career age groups.
The demographic side compounds the problem. A large share of the current CPA population is approaching retirement age, and more than 300,000 U.S. accountants and auditors left the profession within a two-year span, a 17% drop from the field’s 2019 peak, as experienced staff moved toward tech, private equity, and other higher-paid, less cyclical careers.
Firms are feeling it directly. More than 90% of finance and accounting leaders report difficulty finding qualified professionals, a figure that’s climbed sharply in just a few years, up from 70% in 2022According to the CFO Pulse Survey 2024, 83 percent of financial leaders said they could not find qualified accounting talent, up from 70 percent in 2022.Over 90% of finance and accounting leaders report difficulty finding qualified professionals, according to Robert Half’s 2025 Talent Report.
Busy season makes this worse. EBP audits cluster heavily around the same July–October window that overlaps with extension deadlines and other year-end engagements, meaning firms need a surge of specialized capacity during exactly the months when specialized staff are hardest to find and most likely to burn out.
And the stakes of getting staffing wrong aren’t abstract. The DOL’s own data shows the number of CPA firms performing EBP audits fell from 7,330 in 2011 to 4,300 in 2020, even as the number of plans requiring audits increased, and firms doing only one or two audits a year, the group most likely to produce a deficient audit, dropped from 3,684 to 1,729 over the same periodDespite quality gains, the number of CPA firms handling these audits fell from 7,330 in 2011 to 4,300 in 2020, even as plan audits increased. Firms doing only 1-2 audits dropped from 3,684 to 1,729. Fewer generalist firms are staying in this niche, which means the firms that remain need real depth, not a rotating cast of staff assigned to EBP work once a year.
This is exactly why more CPA firms are turning to dedicated audit support and outsourcing partnerships rather than trying to solve the staffing gap purely through direct hiring. A well-structured support relationship gives a firm:
- Scalability during busy season without the cost and risk of hiring full-time staff for a seasonal workload spike.
- Consistent quality, since a specialized support team performs EBP-specific procedures repeatedly across many engagements rather than occasionally.
- Knowledge continuity, reducing the risk that a single departure, increasingly common given current attrition trends, takes institutional EBP knowledge out the door with it.
- Partner and manager time freed up for the judgment-intensive review work that actually requires their signature, rather than routine testing and workpaper preparation.
Given the DOL’s own finding that audit quality tracks so closely with how many EBP audits a firm performs annually, building genuine depth in this niche, whether through internal specialization or a trusted outsourcing partner, isn’t just an efficiency play. It’s a quality and risk-management decision.
This is an area where Audenza Advisory works directly with CPA firms, providing dedicated, EBP-experienced audit support that scales with busy season demand without asking firms to compromise on the quality standards the DOL is actively measuring.
Section 11: Frequently Asked Questions
What is an Employee Benefit Plan audit?
It’s an independent examination of a benefit plan’s financial statements, performed by a licensed CPA, to confirm the plan is financially sound and operated according to its governing documents and ERISA requirements.
Who needs an EBP audit?
Generally, any plan with more than 100 participants (with account balances, for defined contribution plans) as of the first day of the plan year, unless it qualifies for the 80-120 rule or a specific exemption.
Why are EBP audits important?
They protect participants’ retirement and health benefit assets, satisfy ERISA and Form 5500 filing requirements, and demonstrate that plan fiduciaries are meeting their legal duty of care.
How does an EBP audit work?
It moves through planning, risk assessment, internal controls review, testing, evidence collection, and reporting, typically culminating in an audit opinion attached to the plan’s Form 5500 filing.
What documents are needed for an EBP audit?
Plan documents, trust and custodial statements, payroll and contribution records, participant census data, investment statements, distribution and loan records, and prior audit reports, among others.
How long does an EBP audit take?
Timelines vary by plan size and complexity, but most EBP audits run several weeks to a few months, factoring in fieldwork, document turnaround, and review cycles ahead of the Form 5500 deadline.
What is the 80-120 rule?
It allows a plan with between 80 and 120 participants at the start of the plan year to file in the same category, large or small, as the prior year, preventing audit status from flipping due to minor headcount changes.
What happens if a plan misses its audit or filing deadline?
The DOL can assess civil penalties of up to $2,739 per day for late or deficient Form 5500 filings, in addition to potential fiduciary liability exposure for plan sponsors.
What are the most common EBP audit findings?
Late contribution remittances, incomplete documentation, weak internal controls, incorrect eligibility determinations, and operational errors that don’t match the plan document.
What is a limited-scope (ERISA Section 103(a)(3)(C)) audit?
It’s an option that lets the plan administrator exclude certified investment information from full audit testing, provided the certification comes from a qualified institution such as a bank or trust company.
How can plan sponsors prepare for an audit
By reconciling contribution and payroll data continuously, maintaining a current plan document library, tracking eligibility changes in real time, and reviewing prior audit findings before fieldwork begins.
What is the AICPA's Employee Benefit Plan Audit Quality Centre?
A voluntary membership centre for firms performing EBP audits that requires specific training, experience, and practice-monitoring standards; membership is associated with meaningfully lower audit deficiency rates.
Why are more CPA firms outsourcing EBP audit work?
Because of a shrinking CPA talent pipeline, seasonal staffing demands that spike around Form 5500 deadlines, and DOL data showing that audit quality correlates strongly with how frequently a firm performs this specialized work.
Can a plan sponsor change auditors?
Yes, and it’s worth doing if an incumbent auditor lacks EBP-specific experience or AICPA quality center membership, the DOL specifically recommends sponsors verify an auditor’s benefit plan experience and peer review history before engaging them.
Does every welfare benefit plan need an audit?
No, plans that are fully insured, unfunded, or both are generally exempt from the audit requirement, though funded or partially self-insured welfare plans typically are not.
Section 12: Key Takeaways
- EBP audits are required for most plans with more than 100 participants (with balances, for defined contribution plans), with some exceptions and a buffer built in through the 80-120 rule.
- ERISA Section 103(a)(3)(A) sets the legal basis for the audit requirement, and the resulting audit report attaches directly to the plan’s Form 5500 filing.
- The audit process runs through six stages: planning, risk assessment, internal controls, testing, evidence collection, and reporting.
- DOL data shows audit quality correlates strongly with auditor experience; firms performing 100+ audits annually had roughly a third of the major deficiency rate of firms performing fewer than 25.
- The most common findings involve late contributions, documentation gaps, weak internal controls, eligibility errors, and operational mismatches with plan documents.
- The number of CPA firms performing EBP audits has shrunk by more than 40% since 2011, even as plan audit volume increased.
- A structural CPA talent shortage, declining exam participation, an ageing workforce, and high attrition are pushing more firms toward outsourced or dedicated audit support to maintain both capacity and quality.
- Preparation is the single biggest lever plan sponsors control: continuous reconciliation and clean documentation consistently produce smoother, lower-cost audits.
Conclusion
Employee Benefit Plan audits occupy a strange middle ground in the accounting world, legally mandatory, fiduciarily significant, and yet chronically under-resourced relative to the risk involved. The DOL’s own research makes the stakes plain: audit quality tracks closely with how much specialized experience a firm brings to the work, and the pool of firms willing to build that experience has been shrinking for over a decade.
For CPA firms, that’s a strategic signal. Building, or partnering for, real depth in EBP audit work isn’t just about surviving busy season; it’s about staying on the right side of the DOL’s own quality benchmarks. For plan sponsors, it’s a reminder that the choice of auditor is itself a fiduciary decision, not just a procurement one.
Audenza Advisory works with CPA firms navigating exactly this landscape, providing experienced, EBP-focused audit support that helps firms scale through busy season without stretching thin on quality. If your firm is evaluating how to staff EBP audit engagements for the year ahead, or you’re a plan sponsor trying to understand what your upcoming audit will require, it’s worth having that conversation early rather than in the weeks before your Form 5500 deadline.
