401(k) Audit Requirements: A Checklist for CPA and Accounting Firms

401(k) audit requirements generally apply when an ERISA-covered plan is a large-plan filer, usually with 100 or more participants with account balances at the beginning of the plan year. The 80-120 participant rule can let certain plans continue filing as small plans. Company headcount alone does not determine the answer.

For a CPA firm, that determination starts the work: document requests, reconciliations, workpapers, and review before filing. Outsourced 401(k) audit support can help with defined preparation tasks without transferring the signing firm's audit responsibility.

This guide connects the Form 5500 audit requirements with preparation and delegation for standalone, ERISA-covered 401(k) plans. Pooled plans and other benefit plan types need separate assessment.

Key Takeaways

• Confirm the requirement before allocating staff. Use participants with balances, prior filing status, and applicable waiver conditions, not employer headcount alone.
• Plan preparation and review separately. Offshore capacity does not create partner review time or supply records the client has not provided.
• Delegate named deliverables. A reconciled contribution schedule with evidence and open items is a clearer assignment than "prepare the audit."
• Protect the firm's review and approval responsibilities. The signing firm retains its audit responsibilities; the plan administrator retains responsibility for the plan.
• Measure the complete delivery cost. Include preparation, onboarding, supervision, rework, and final review, not just the provider's hourly rate.

What Is a 401(k) Audit?

A 401(k) audit is an independent examination of the plan's financial statements and related reporting. Where required, the auditor's report accompanies the annual Form 5500 filing.

It is different from an IRS examination, a Department of Labor investigation, and annual nondiscrimination testing. A required financial statement audit is not evidence that the client has done something wrong.

401(k) audit outsourcing, as discussed here, means engaging an external team for defined preparation and support work within the CPA firm's engagement. Offshoring describes where that team works, outside the firm's home country. Neither is a substitute for the independent audit itself.

If your firm is assessing audit documentation and workpaper support, first separate the client plan's audit obligation from the preparation work you need help delivering. The requirements below establish the first; the delegation table and checklist help scope the second.

When Is a 401(k) Audit Required?

To assess 401(k) plan audit requirements, start with the plan's reporting status, then assess any applicable exemption. A small-plan filing category and an audit waiver are related, but they are not the same decision.

401(k) audit threshold: use participants with account balances

For defined contribution plans, the DOL changed the methodology beginning with 2023 plan-year filings. The relevant count is participants with account balances, rather than everyone eligible to participate. This is not a new rule introduced in 2026. See the DOL's explanation of the change.

For an existing calendar-year plan's 2025 audit, normally use the January 1, 2025 balance population, not the employee roster when work begins in 2026.

Reconcile the recordkeeper's participant-level balance report with the client's third-party administrator (TPA). A list of people currently making deferrals is not a substitute. Have the engagement reviewer approve the filing-category conclusion before scheduling work around it.

Understand the 80-120 participant rule

The DOL's 80-120 rule permits an eligible plan in that range to elect the same filing category as the prior year. For a plan previously filed as small, this can preserve small-plan treatment through 120 participants.

This table assumes an ordinary full plan year and no special reporting arrangement or deferred prior-year audit. It is a screening aid, not a substitute for reviewing the actual filing history.

Do not overlook small-plan waiver conditions

Being below the numerical threshold does not automatically remove the audit requirement. The small pension plan waiver also involves qualifying plan assets or appropriate enhanced bonding, required disclosures, and access to supporting information. The details appear in the Schedule I audit-waiver instructions.

Confirm those conditions with the TPA and engagement reviewer, particularly if the plan holds unusual assets. A waiver from the audit is not a waiver from annual filing obligations.

Apply the threshold: three worked examples

These examples are illustrative, not Acculink client cases. They assume existing standalone plans, full plan years, and satisfaction of the small-plan waiver conditions where relevant.

Example 1: Employee headcount is not the answer. A company has 150 employees. On January 1, its plan has 85 current employees and 10 former employees with balances. Another 30 eligible employees have no balance. The relevant count is 95, not 150 or 125.

Example 2: Exactly 120 is different from 121. A previous small-plan filer with 120 participants with balances at the next plan-year start may elect continued small-plan treatment. At 121, that exception is unavailable; generally plan for an audit.

Example 3: Filing history matters. Two plans each have 110 participants with balances. One previously filed as small; the other as large. Only the first can use the small-plan continuation election at that count.

Keep the count, measurement date, prior filing, and approved conclusion together. A support team can assemble the evidence; the firm approves the determination.

401(k) Audit Requirements for New Plans and Special Situations

For a defined contribution plan filing its first return/report, the instructions use year-end participants with balances, reported on line 6g(2), rather than the usual beginning-year count on line 6g(1). A new plan should not assume that starting with no balances eliminates its first-year audit requirement.

A short plan year of seven months or less can involve a special election to defer the accountant's report under 29 CFR 2520.104-50. Deferral is not permanent exemption. Obtain advice on the election and subsequent reporting before relying on it.

Plan mergers, termination, and pooled or multiple-employer arrangements also deserve individual review. Do not apply a standalone-plan headcount table to a participating employer inside a different reporting structure.

For portfolios covering several benefit plan types, consider the scope of employee benefit plan audit support separately for each engagement. Do not apply these 401(k) examples automatically to other plans.

What Is the 401(k) Audit Deadline?

The audit must be completed in time to include the required report with Form 5500. The IRS sets the ordinary filing deadline at the last day of the seventh month after the plan year ends.

For the calendar-year 2025 plan being reported in 2026:

The Form 5558 instructions require a timely request. An extension provides more filing time; it does not cancel the audit. Certain employer tax-return extensions can also qualify under specific conditions, but should not be assumed to extend every plan's deadline.

For non-calendar-year plans, calculate the dates from the actual year-end. Weekend, holiday, or applicable disaster-relief provisions may change a deadline.

If the ordinary deadline has already passed: confirm whether a valid extension or other relief applies. Escalate an unresolved filing issue to the engagement partner and plan administrator. An ordinary extension cannot simply be assumed retrospectively, and filing an incomplete return does not automatically avoid consequences.

For each client, track three internal dates as well as the filing deadline: the complete-records date, the preparation deadline, and the reviewer sign-off target. Assign an owner to each. Do not promise completion based only on a preparer's availability.

If several client plans share a filing deadline, assess dedicated offshore audit staff against the preparation backlog and available reviewer hours. Additional preparers cannot resolve missing client records or replace the firm's final review.

What Does a 401(k) Audit Cover?

The engagement connects reported financial activity to payroll, participant records, plan provisions, and investment information. Depending on scope, work can include contributions, eligibility, compensation, employer matching, vesting, distributions, loans, expenses, and financial statement disclosures.

The IRS 401(k) fix-it guide is a useful companion for identifying operational problems, including incorrect compensation, missed eligibility, matching errors, and loan issues. It is not an audit program or a substitute for the auditor's procedures.

The firm's audit approach determines the procedures and evidence required. A support team's standard checklist cannot replace that approach, and an audit does not guarantee that every transaction is tested or every error found.

Limited-scope vs. full-scope: use the current terminology

What readers still call a "limited-scope 401(k) audit" is now an ERISA Section 103(a)(3)(C) audit. AICPA's SAS 136 advisory explains the performance and reporting requirements under AU-C 703.

When the election is appropriate, the auditor performs specified procedures on qualifying certified investment information, including checking its agreement with the certification, rather than auditing that information in the usual way. The remaining financial statement information is still audited. A routine account statement is not necessarily sufficient certification.

An audit without that election is often described as "full scope." The engagement team must evaluate the relevant certification and procedures; an offshore preparer should not assume that a custodian's statement settles the scope question.

What 401(k) Audit Work Can a CPA Firm Outsource?

Delegate defined preparation tasks to a suitably qualified team under the firm's supervision. Specify the procedure, records, output, escalation rules, and reviewer. Tailor this framework to each engagement.

Firms evaluating a support team should assess a representative work sample against their own templates. Check the preparer's evidence references and escalation decisions, not just whether the file looks finished.

Outsourcing does not transfer the signing firm's audit responsibility. Engagement acceptance, independence, risk and materiality decisions, evidence evaluation, supervision, and the issued opinion remain the firm's responsibility. Plan management retains its responsibilities for records, administration, and financial reporting. The DOL's auditor-selection guidance explains why qualified, independent audit work cannot be replaced by administrative support.

401(k) Audit Checklist: What to Gather and Who Owns It

Tailor this provided-by-client (PBC) checklist to the engagement. It is an employee benefit plan audit checklist specifically for 401(k) preparation, not an audit program for every benefit plan type. The client, TPA, and recordkeeper supply the records; an offshore team may organize and reconcile them. Confirm who supplies each item.

Track each request's owner, due date, file location, and status: requested, received, reconciled, or ready for auditor review. Received does not mean complete.

For a first-year audit, ask the engagement team what prior-period records and opening-balance support are needed before confirming the preparation schedule. A complete current-year folder may still be insufficient.

Four Issues the Preparation Team Should Flag, Not Silently Fix

1. Participant counts and census data. Compare the recordkeeper's balance population with the TPA's count. Investigate former employees with balances and inconsistent dates instead of forcing totals to agree.

2. Payroll-to-trust reconciliation. Match amounts withheld, amounts transmitted, and amounts recorded. Explain timing differences and adjustments. A year-end total that agrees can still conceal an individual late deposit.

3. Contribution timing. The IRS guidance on late employee deferrals explains the prompt-deposit requirement. The following month's 15th business day is not a general safe harbor permitting an employer to hold contributions when earlier deposit is feasible. Have the TPA or adviser assess suspected late remittances and the appropriate correction process.

4. Plan terms versus system settings. Check that payroll and recordkeeping settings reflect the relevant compensation definition, eligibility provisions, match formula, and amendments. Do not treat the system's current configuration as proof of what the plan required during the audit period.

Give each exception an evidence reference, owner, and resolution status. The support team should preserve the original records and raise the question, not change data to make a reconciliation agree or choose a correction method without authorization.

How to Run the Offshore Preparation and Review Workflow

Build the handoff around the firm's audit methodology, with unresolved questions visible at every stage.

1. Define the assignment and authorize access

Identify the plan, period, preparer, reviewer, source files, required workpaper format, and due date. Confirm engagement terms, confidentiality obligations, and any necessary client notifications or permissions before access. Establish whether the support team may contact the client or must route questions through the firm.

2. Confirm the records are ready

Separate missing client information from preparation work. Record unresolved differences and dependencies before assigning a completion date. A provider cannot complete a loan workpaper if the required loan agreement has not been supplied.

3. Prepare with an evidence trail

Require source references, version control, documented procedures, and an open-item log. Set a handoff time and an escalation contact across time zones. A reviewer should be able to follow the work without reconstructing the preparer's reasoning from scattered messages.

4. Review, resolve, and approve

The firm evaluates the work and determines what further evidence or procedures are needed. Track returned items and the time spent reviewing them. A provider's internal review may improve the submission, but it does not replace the engagement team's review.

Test this preparation and review workflow on a bounded workstream before expanding. Resolve missing information or reviewer availability before adding more plans.

Protect Participant Data Before Offshoring Work

401(k) files can contain Social Security numbers, compensation, account balances, and banking information. Review the actual access arrangement, not just the provider's security claims.

Confirm named accounts, multifactor authentication, task-appropriate permissions, approved devices, transfer controls, data locations, retention, incident escalation, and access removal. Where possible, limit records to the information needed for the assignment. Do not use shared logins or a general contact form to exchange participant files.

When evaluating Acculink, use its published data-security controls as a starting point and request current evidence relevant to your engagement. Confirm any subcontractors and where the assigned team will work. A provider's policy does not remove the CPA firm's own confidentiality and oversight obligations.

Task-Based Support or Dedicated Offshore Audit Staff?

Choose the arrangement around the work you can define and supervise.

• Task-based support: consider it for a bounded assignment, such as document indexing or specified reconciliation schedules, with clear completion criteria.
• Dedicated capacity: consider it for a recurring portfolio where staff continuity, familiarity with templates, and ongoing coordination matter.
• Resolve internal constraints first: if no qualified reviewer is available or the firm has not settled the audit approach, extra preparation capacity alone is unlikely to solve the problem.

If your firm plans to hire dedicated audit support staff, ask for relevant employee benefit plan experience and a representative work sample. Confirm supervision, coverage during absences, overlap hours, and how review feedback becomes a corrected deliverable. General accounting experience alone does not establish readiness for your 401(k) assignments.

401(k) Audit Cost vs. Outsourced Support: What Should Firms Budget?

Separate the audit fee charged to the plan client from the cost of external preparation support to your firm. The first covers the agreed audit engagement; the second covers specified work within your delivery process. An offshore hourly rate cannot be compared directly with a complete independent audit fee.

Build the delivery budget from five components: external preparation fees, retained staff time, onboarding, supervision, and rework. Include final review rather than assuming outsourcing eliminates it.

Ask the provider to price a defined assignment with clear input assumptions, deliverables, exclusions, review-response expectations, and treatment of scope changes. For dedicated capacity, confirm the hours, coverage, and work included.

During a pilot, record preparation time, reviewer time, missing-evidence requests, and returned work. Compare the total effort for similar assignments. A lower preparation rate is useful only if the completed work meets the firm's requirements at an acceptable overall cost. No universal savings percentage or turnaround can establish that in advance.

How Acculink Supports CPA Firms Handling 401(k) Audits

Acculink's 401(k) audit support services provide offshore capacity for defined preparation and support work under the CPA firm's supervision. The useful starting point is a specific workload: which plans, which schedules, what records are ready, and who will review the output.

Bring one representative workstream to the scoping conversation. Agree on the expected deliverable, access controls, questions process, and review criteria before expanding the assignment. This helps both teams assess whether the proposed support fits the firm's methodology and available review capacity.

Need support across several plan audits? Discuss your 401(k) preparation and workpaper workload with Acculink. Share the number of plans, target deadlines, and support tasks you need. Keep participant-level records out of the initial enquiry.

Frequently Asked Questions

Does a company with 100 employees automatically need a 401(k) audit?

No. The relevant count is generally participants with account balances, not company headcount. Prior filing status, the 80-120 rule, and other applicable conditions also matter. Use the plan's records and reporting history rather than assuming the payroll roster determines the answer.

Does a safe-harbor 401(k) plan need an audit?

It can. Safe-harbor plan design addresses certain nondiscrimination-testing requirements; it is not a blanket exemption from the annual financial statement audit. Evaluate the plan's reporting status and applicable audit-waiver conditions separately.

What can a CPA firm delegate to an offshore 401(k) audit team?

Depending on the assignment and staff competence, defined work may include document indexing, census and contribution reconciliations, support for assigned procedures, financial statement tie-outs, and workpaper preparation. The firm sets the scope, supervises the work, evaluates the evidence, and retains its audit responsibilities.

Does outsourcing transfer responsibility for the audit opinion?

No. A preparation provider does not take over the signing firm's responsibility for its audit opinion. The firm remains responsible for its engagement and oversight of work used in the audit. Plan management also retains its own responsibilities; outsourcing does not remove them.

Does every Form 5500 require an audit report?

No. Eligible small plans may qualify for an audit waiver. Form 5500-SF also has its own eligibility conditions. Confirm the reporting form and supporting requirements; do not assume that filing an annual return always requires an audit, or that avoiding an audit eliminates the return.

Is an ERISA Section 103(a)(3)(C) audit an audit exemption?

No. It is an audit with specific treatment of qualifying certified investment information and associated reporting requirements. The election does not replace the audit or automatically remove procedures on other areas of the plan.

How long does outsourced 401(k) audit preparation take?

There is no universal timeline. Agree on delivery dates after reviewing scope, record readiness, complexity, and reviewer availability. Distinguish the provider's preparation deadline from the audit completion and filing deadlines. Missing client records or unresolved review points can affect all three.

The Bottom Line

Turn the 401(k) audit requirements assessment into a workable engagement: the right records, a defined preparation scope, qualified reviewers, and a realistic filing schedule.

Offshore support can contribute preparation capacity within that process. Start with a bounded assignment, keep exceptions visible, and expand when the work meets the firm's review requirements. Evaluate the complete workflow, not the rate alone.