Employee Benefit Plan Audit Guide for CPA and Accounting Firms: Requirements, Process and Outsourcing Support
Summary
This employee benefit plan audit guide helps CPA and accounting firms assess Form 5500 and ERISA requirements, manage each EBP audit stage and build review-ready workpapers. It covers participant-count rules, Section 103(a)(3)(C), plan-specific procedures, outsourcing responsibilities and Acculink support priced from $8 to $35 per hour.
Employee Benefit Plan Audit Guide for CPA and Accounting Firms: Requirements, Process and Outsourcing Support
Updated October 6, 2026
Employee benefit plan audits combine financial statement auditing with plan-specific ERISA and Form 5500 requirements. CPA and accounting firms must align plan provisions, participant data, audit evidence, reviewer capacity and the filing timetable.
This guide covers employee benefit plan audit requirements, the EBP audit process, a practical checklist and outsourcing support. The responsible independent CPA firm retains acceptance, independence, professional judgment, supervision, final review and responsibility for its report. A firm without the required attest authority may support preparation or refer the engagement, but it cannot act as the signing auditor.
In brief: Many ERISA-covered plans filing as large plans must attach an independent qualified public accountant's report to Form 5500. For defined contribution plans, current small-plan eligibility generally uses participants with account balances, and the 80-120 rule may preserve the prior filing category. The conclusion still requires a plan-specific review of the applicable instructions, filing history and exemptions.
Key takeaways for EBP audit leaders
- Determine the filing requirement before staffing the engagement. Employer headcount alone does not answer whether a plan needs an audit.
- Treat EBP work as a specialty. Contributions, benefit payments and participant data are plan-specific audit areas, not generic balance-sheet extensions.
- Control PBC and reviewer capacity together. Each request needs an owner, expected format, due date and escalation path; each prepared workpaper needs clear acceptance criteria.
- Delegate outputs, not responsibility. Reconciled schedules, documented procedures and visible open items can be assigned. The responsible firm keeps the judgments, communications, approval and opinion.
- Compare accepted work, not hourly rates alone. The useful cost measure includes onboarding, supervision, corrections and internal review.
Evaluating additional EBP capacity? Acculink publishes role-based pricing of $8 to $35 per hour for employee benefit plan audit support. The right comparison is the cost of review-ready output for the required plan type, not the quoted rate in isolation.
What is an employee benefit plan audit?
An employee benefit plan audit is an independent audit of a plan's financial statements and related information. When ERISA requires it, the independent qualified public accountant's report is generally filed with the plan's Form 5500 annual return/report. It is not an IRS examination, DOL investigation or the plan administrator's annual compliance testing.
EBP audit, ERISA audit, benefit plan audit and retirement plan audit describe overlapping searches, but the plan type controls the work. A 401(k) audit, defined benefit pension plan audit, ESOP audit and health and welfare plan audit involve different records, risks and procedures.
Employee benefit plan audit requirements by plan type
Many ERISA-covered large plans must attach an independent audit report to Form 5500, but no single numerical test applies to every plan. Form 5500 audit requirements and broader ERISA audit requirements depend on plan type, filing status, participant count, prior filing, funding arrangement and exemptions.
The Department of Labor's guidance for selecting a plan auditor states the general rule that plans with 100 or more participants require an audit as part of the Form 5500 filing obligation. That is a useful starting point, not a substitute for the applicable plan-year instructions.
| Plan category | Common examples | Requirement questions to resolve first |
|---|---|---|
| Defined contribution pension plan | 401(k), profit-sharing, money purchase and many 403(b) plans | Participant account-balance count, prior filing category, 80-120 rule, small-plan waiver conditions and reporting arrangement |
| Defined benefit pension plan | Traditional pension and cash balance plans | Participant count under the applicable instructions, funding and actuarial information, filing category and any exemption |
| Employee stock ownership plan | ESOP | Filing category, plan investments, employer-security valuation, benefit payments and plan-specific reporting |
| Health and welfare plan | Medical, dental, disability and certain other welfare arrangements | Participant count, funding arrangement and whether a reporting or audit exemption applies |
| Multiemployer, multiple-employer or pooled arrangement | Multiemployer plans, MEPs, PEPs and group reporting arrangements | Which entity files, which audit attaches and the rules for the particular arrangement |
Use the table only for screening. Base the conclusion on the current Form 5500 instructions, plan document, prior filing and applicable exemptions.
Defined contribution plans now count participants with account balances
Beginning with 2023 plan-year filings, defined contribution plans use participants with account balances for the 100-participant threshold applied to certain small-plan reporting alternatives and the conditional audit waiver. Existing plans generally use the beginning-of-year balance population; new plans generally use the end-of-year population.
The DOL's Form 5500 change summary explains the method. Reconcile the recordkeeper's balance population with the plan's reporting information; employer headcount, an eligibility list or current deferrals alone are insufficient.
Use Acculink's 401(k) audit requirements checklist for a detailed decision tree. If the requirement is established and the gap is execution capacity, review the separate 401(k) audit support scope.
The 80-120 participant rule can preserve the prior filing category
Under the 80-120 participant rule, an eligible plan in that range may generally file in the same category as the prior year. A prior small-plan filer may remain small; a prior large-plan filer does not switch categories merely because its count falls to 120. Retain the prior return, measurement date and approved conclusion together.
Small-plan status does not automatically establish an audit waiver
A small pension plan must satisfy conditions covering matters such as qualifying plan assets or enhanced bonding, participant disclosures and access to records. See the DOL's small pension plan audit waiver FAQ. Health and welfare plans, new or terminated plans, short plan years and group arrangements require separate analysis.
ERISA Section 103(a)(3)(C) audit versus a non-election audit
The current term for what older material calls a limited-scope audit is an ERISA Section 103(a)(3)(C) audit. The election changes the treatment of qualifying investment information; it does not eliminate the audit.
For a valid election, an eligible institution must certify the qualifying investment information as complete and accurate. The auditor evaluates the election and certification, performs the procedures required by AU-C section 703 and uses the applicable report.
Without a valid election, the auditor performs a non-Section 103(a)(3)(C) audit. Obtain the certification during planning and confirm that it covers the correct institution, period and information. The AICPA's 2026 Section 103(a)(3)(C) primer explains the election, certification and management responsibilities.
Employee benefit plan audit process for CPA and accounting firms
Use the following workflow as an engagement-control map. The firm's methodology and the plan's facts determine the procedures.
| Stage | Firm's decision | Required output | Suitable support |
|---|---|---|---|
| 1. Acceptance | Can the firm perform a quality audit independently and on time? | Approved acceptance, terms, staffing and timetable | Organize intake and prior-year records |
| 2. Requirement and scope | Which filing category, plan type and Section 103(a)(3)(C) status apply? | Approved scope and reporting conclusion | Assemble counts, filings, documents and certification |
| 3. Planning | Which provisions, processes and balances create risk? | Strategy, materiality, risk assessment and tailored program | Prepare process summaries and data maps |
| 4. PBC readiness | Are records complete, reconciled and usable? | PBC tracker, reconciled populations and open-item log | Track requests, normalize data and flag conflicts |
| 5. Fieldwork | Do procedures address the risks and produce sufficient evidence? | Workpapers with evidence, exceptions and conclusions | Perform assigned procedures within the firm's program |
| 6. Reporting | Do statements, schedules and disclosures agree with final records? | Tied-out reporting package | Prepare tie-outs, roll forwards and disclosure support |
| 7. Completion | Are significant matters resolved and approved? | Cleared review points, communications and final report | Update documentation and assemble final support |
Get the EBP audit PBC tracker.
Track records, owners, due dates, validation status, open items, and reviewer handoffs for every plan.
Set scope, competence and deadlines
Confirm independence, licensing, EBP competence, specialist needs, prior-auditor communications and staffing before acceptance. Build the schedule backward from the Form 5500 filing date. The ordinary due date is the last day of the seventh month after year-end; a timely, valid Form 5558 may extend an eligible filing. The IRS Form 5500 resource center provides filing resources.
Validate documents, PBC records and populations
Read the executed plan document, adoption agreement and amendments before testing. Use one PBC tracker with the owner, due date, version, validation status, affected workpapers and unresolved questions. Reconcile participant, contribution, benefit, loan, expense and investment populations to appropriate control totals before sampling. Preserve source files, document transformations and keep exceptions visible.
Connect procedures, evidence and conclusions
Common EBP work areas include:
- participant eligibility, demographic data and compensation;
- employee and employer contributions, including remittance timing;
- distributions, benefit payments and participant loans;
- investments, income, purchases, sales and certified information;
- plan expenses and administrative fees;
- forfeitures and unallocated amounts;
- parties in interest and prohibited transactions;
- actuarial or valuation information where relevant;
- plan obligations, commitments and subsequent events; and
- financial statement presentation, disclosures and supplemental schedules.
Each workpaper should identify the relevant provision or risk, population, procedure, evidence, exceptions and conclusion. Tie the final statements and notes to the final trial balance, trust information and supporting workpapers. The plan administrator owns the Form 5500 filing; the auditor owns its report and professional responsibilities.
Apply one review-ready workpaper standard
Before a prepared workpaper enters manager review, confirm that it shows:
- the objective, relevant plan provision or assessed risk;
- the source, period, completeness and reconciliation of the population;
- the procedure performed, sample or selection basis and linked evidence;
- every exception, its status and the evidence supporting resolution;
- a conclusion consistent with the work performed; and
- preparer and reviewer identification, dates and version control.
This standard gives an internal or outsourced preparer a measurable definition of completion. It also prevents the manager from becoming the first person to discover missing sources, unexplained transformations or unsupported conclusions.
Control the portfolio as well as each audit
For multiple employee benefit plan audits, maintain a portfolio view of PBC readiness, preparation status, reviewer assignment, unresolved matters and filing dates. Release work according to record readiness and reviewer capacity rather than sending every plan into fieldwork at once. This exposes the actual constraint and helps the firm decide whether it needs short-term support, a dedicated professional or earlier client escalation.
Employee benefit plan audit checklist
This checklist is designed for engagement control and PBC planning. It is not a substitute for the firm's audit program, the applicable professional standards or a plan-specific determination.
| Workstream | Records and control points to consider | Reviewer question |
|---|---|---|
| Plan governance | Executed plan document, adoption agreement, amendments, summary plan description, committee minutes, service-provider contracts and current fiduciary information | Do the records describe the provisions and parties that governed the audited period? |
| Filing and prior period | Prior Form 5500, prior financial statements and report, prior management communications, corrections and unresolved matters | Did the team identify changes in filing status, plan provisions or recurring issues? |
| Financial and trust records | Trial balance, general ledger, trust or custodial statements, investment reports, roll forwards and reconciliations | Are beginning balances, activity and ending balances reconciled across sources? |
| Participant and payroll data | Census, eligibility fields, dates, compensation, payroll registers, contribution rates and status changes | Is the population complete, internally consistent and reconciled to a control total? |
| Contributions | Employee deferrals, employer contributions, remittance dates, payroll support and receivable information | Are amounts and timing supported, and are exceptions visible for evaluation? |
| Distributions and benefits | Distribution register, approvals, participant elections, tax reporting, benefit calculations and payment support | Were payments authorized, calculated under the plan and recorded in the correct period? |
| Participant loans | Loan register, notes, repayments, defaults, deemed distributions and plan provisions | Does the loan population reconcile, and are deviations from terms identified? |
| Investments | Holdings, transactions, income, fair-value support, certification and related disclosures | Does the evidence cover the relevant period, assets and information, and is any election valid? |
| Expenses and service providers | Fee schedules, invoices, allocation methods, SOC reports and complementary user-entity controls | Are plan expenses authorized and properly allocated, and were relevant service-organization controls considered? |
| Plan-specific specialists | Actuarial reports, employer-security valuations, claims or IBNR information and specialist credentials where applicable | Is the specialist information appropriate for the plan and reconciled to the financial statements? |
| Compliance and legal matters | Operational testing, regulator correspondence, prohibited-transaction information, legal letters and correction activity | Could an identified matter affect the audit, financial statements, schedules or communications? |
| Financial statements and completion | Draft and final statements, disclosure checklist, supplemental schedules, adjustment log, representation letter and governance communications | Does the final package agree throughout, and are significant matters resolved and approved? |
The checklist is most useful when every item has an owner and acceptance criteria. “Census received” is not the same as “census reconciled, required fields present and exceptions logged.” That distinction is where much of the avoidable manager time sits.
Common EBP audit deficiencies and review bottlenecks
The DOL's November 2023 Audit Quality Study reported a 30 percent overall deficiency rate for audits reviewed from the 2020 filing year. Smaller EBP practices had more deficiencies, while contributions, benefit payments and participant data remained leading problem areas. The response is plan-specific competence and effective review, not headcount alone.
Watch for these operational warning signs:
| Warning sign | What it may indicate | Better control |
|---|---|---|
| The sample is selected before the population reconciles | Completeness was assumed | Require source, control total, reconciliation and approved exception treatment |
| Staff reuse last year's workpaper without re-reading the plan | Changes in provisions or operations may be missed | Tie each relevant procedure to current documents and period activity |
| Managers repeatedly rebuild routine schedules | Preparation capacity or acceptance criteria are inadequate | Define a model workpaper and assign recurring preparation separately |
| Review notes sit in email or chat | The file does not show resolution | Update the workpaper, attach evidence and retain the conclusion |
| The Section 103(a)(3)(C) certification arrives late or incomplete | Scope and reporting may be built on an unsupported assumption | Validate the election and certification during planning |
| Several plans reach review at once | Portfolio scheduling ignored reviewer capacity | Stagger PBC, preparation and review milestones by plan readiness |
The AICPA Employee Benefit Plan Audit Quality Center provides current resources on plan types, AU-C section 703, evidence and common deficiencies. Use those resources with the firm's approved methodology.
What EBP audit work can be outsourced?
Employee benefit plan audit services may mean either the independent audit or delivery support working under a CPA firm's direction. This section concerns support; the provider does not become the independent auditor.
Employee benefit plan audit outsourcing works best when the assignment defines the inputs, procedures, evidence, output and reviewer. “Reconcile the participant census to payroll, document differences and prepare the approved workpaper” is more controllable than “help with our EBP audits.”
| Work that may receive outside support | Useful output | Responsibility that stays with the firm |
|---|---|---|
| PBC administration | Status tracker, indexed support and dependency log | Deciding whether evidence is sufficient and escalating significant matters |
| Plan-document extraction | Current provision summary with source references | Interpreting provisions and determining audit implications |
| Participant-data preparation | Preserved source file, reconciliation and exception list | Assessing completeness, risk and the response to unresolved differences |
| Contribution, distribution and loan testing support | Firm-program workpaper with evidence and identified exceptions | Selecting the approach, evaluating exceptions and concluding |
| Trust and investment reconciliation | Roll forward, tie-out and certification package | Evaluating the election, evidence and financial statement effect |
| Financial statement and schedule preparation | Draft statements, tie-outs and disclosure support | Approving presentation, disclosures, schedules and report |
| Review-note updates | Corrected documentation with linked evidence | Determining whether the matter is resolved and approving the file |
Outside professionals may perform assigned procedures under the responsible firm's direction when the arrangement and applicable standards permit. The CPA firm should determine the competence needed, supervise the work, review the results and retain sufficient documentation. The provider does not become the signing auditor merely because it prepared a substantial portion of the file.
For a broader framework covering scope, quality controls and provider selection, see Acculink's audit outsourcing guide for CPA and accounting firms.
Responsibilities that stay with the CPA firm
The firm should keep clear ownership of:
- engagement acceptance, independence and ethics;
- audit strategy, risk assessment, materiality and program approval;
- evaluation of evidence, exceptions and misstatements;
- consultations and communications with management and governance;
- final review, report approval and sign-off; and
- compliance with professional, legal and regulatory obligations.
See where EBP support can release review time.
Map one representative plan by work area, software, timing, handoff, and reviewer requirements.
Choose the EBP audit support model and provider
Project, dedicated or blended support
The right delivery model depends on whether the capacity need is bounded or recurring.
| Model | Better fit | Main risk to control |
|---|---|---|
| Defined project or workstream support | A specific backlog, a limited number of plans or clearly packaged preparation tasks | Scope drift and inconsistent source records |
| Dedicated offshore audit professional | A recurring EBP portfolio, predictable seasonal volume and a firm that values continuity | Underutilization outside peak periods or weak onboarding |
| Blended model | Stable base workload plus seasonal surges | Unclear ownership between the core person and surge team |
A dedicated person supports continuity; a project team fits a defined workstream. Neither model fixes missing records, unavailable reviewers or unclear acceptance criteria.
If the firm needs recurring capacity across financial, 401(k) and other benefit plan work, it can compare dedicated offshore audit professionals with project-based audit support services. Ask for direct experience with the actual plan type rather than accepting general audit experience as a substitute.
Acculink's audit staffing guide compares in-house, contract and offshore capacity beyond the EBP portfolio.
Provider evaluation checklist
Test the provider with one representative, appropriately protected work package. Evaluate:
- Plan-specific competence and continuity: Who has relevant experience, and who covers absences or turnover?
- Methodology alignment: Will the team use the firm's program, templates and documentation standards?
- Quality control: Who prepares, checks and resolves recurring review feedback?
- Population integrity: How are source files, transformations, reconciliations and exceptions documented?
- Security: How are access, devices, storage, transmission, incidents and offboarding controlled?
- Commercial terms: What do the rate and scope include, and how are corrections and overtime handled?
Measure first-review acceptance, recurring notes, manager preparation time, open-item aging and deadline performance. Scale only if the provider applies feedback consistently and releases more review time than it consumes.
How Acculink supports EBP audit delivery
Acculink is structured for U.S. CPA and accounting firms. Its published EBP audit support includes participant-data validation, investment testing support, plan reconciliations and financial-statement support for listed plan types. Confirm the assignment against the proposed professional's experience.
Acculink also describes a two-tier maker-checker process. Confirm who will check the proposed work and how corrections reach the firm's reviewer.
Acculink's engagement models cover defined support and recurring staffing. Published pricing ranges from $8 to $35 per hour, based on role and experience. The proposal should identify expected hours, included work, response times, reviewer and record-readiness assumptions.
Across its business, Acculink reports 300 or more qualified professionals supporting more than 80 CPA and accounting firms. These are company-wide figures, so evaluate the proposed EBP professional directly.
Acculink publishes its IT and data-security controls. Before granting access to participant data, request current evidence and evaluate access, data location, subcontractors, incident procedures and offboarding.
Acculink states that eligible firms can begin with a 40-hour free trial and no long-term lock-in. Confirm the terms and test one defined work package. For the initial discussion, share plan types, target dates, work areas, software and review capacity without participant-level data.
Ask Acculink to map one representative EBP audit work package.
Frequently asked questions
What is an employee benefit plan audit?
An employee benefit plan audit is an independent financial statement audit of a benefit plan. For many ERISA-covered large plans, the independent qualified public accountant's report is filed with Form 5500. It is distinct from an IRS examination, a DOL investigation and routine plan compliance testing.
Which employee benefit plans require an audit?
Many ERISA-covered plans filing as large plans must attach an audit report, but the answer depends on plan type, participant count, prior filing status, funding arrangement and available exemptions. Review the applicable Form 5500 instructions and plan facts rather than applying a universal employee-count threshold.
Does a company with 100 employees automatically need an EBP audit?
No. Employer headcount alone does not determine the audit requirement. For defined contribution plans, the current small-plan counting method generally uses participants with account balances. Other plan categories and exemptions require separate analysis.
What is the 80-120 participant rule?
An eligible plan with a count between 80 and 120 may generally file in the same category used in the prior year. A prior small-plan filer may be able to remain small within that range. Confirm the applicable count, prior filing and waiver conditions before relying on the rule.
What is an ERISA Section 103(a)(3)(C) audit?
It is the current term for an engagement historically called a limited-scope audit. When plan management makes a valid election and qualifying investment information is properly certified, the auditor follows AU-C section 703 for that information. The election does not eliminate the audit or the auditor's responsibilities.
What should an employee benefit plan audit checklist include?
It should cover plan documents, prior filings, financial and trust records, participant and payroll data, contributions, distributions, loans, investments, expenses, service organizations, plan-specific specialist information, legal matters, financial statements, supplemental schedules and completion documents. Each request should have an owner and acceptance criteria.
How long does an EBP audit take?
Timing depends on plan type, complexity, record readiness, exceptions and reviewer availability. Plan backward from the Form 5500 deadline and set earlier dates for complete PBC records, preparation, manager review, partner review and final reporting. An extension adds filing time but does not make incomplete records ready.
What EBP audit tasks can be outsourced?
Common support areas include PBC tracking, data organization, census and trust reconciliations, plan-document summaries, assigned testing support, workpaper preparation, financial-statement tie-outs and factual review-note updates. The exact scope should follow the responsible firm's program and supervision.
Which types of employee benefit plan audits can an outside team support?
Outside professionals may support 401(k), 403(b), profit-sharing, pension, ESOP and health and welfare plan work when their experience matches the specific plan and assignment. Do not infer competence across every plan type from general audit experience. Confirm the proposed person's work history and test a representative deliverable.
Does outsourcing transfer responsibility for the audit opinion?
No. The responsible CPA firm retains independence, direction, professional judgment, supervision, evaluation of evidence, client communications, final review and responsibility for its report. The plan administrator retains its own responsibilities for the plan, financial statements and filing.
How much does outsourced EBP audit support cost?
Acculink publishes role-based rates of $8 to $35 per hour. Total cost depends on experience, scope, hours, plan types, record quality, delivery model and review needs. Compare accepted deliverables plus internal coordination and rework, not hourly price alone.
How should a firm protect participant data when using offshore support?
Perform due diligence on identity and access controls, encryption, approved devices, local-storage restrictions, logging, physical safeguards, incident response, subcontractors, data location and offboarding. Share only the data required for the approved work and preserve the firm's own confidentiality, supervision and compliance controls.
Make more room for EBP review.
Defined support or dedicated EBP audit capacity from $8 to $35 per hour.
Tags:
About the Author
Related Posts
White-Label Audit Support for CPA and Accounting Firms: How the Delivery Model Works
Evaluate white-label audit support for CPA and accounting firms against reviewer capacity, total delivery cost…
Financial Audit Process and Checklist for CPA and Accounting Firms
Use this practical financial audit process and checklist to organize planning, PBC records, risk assessment, t…
401(k) Audit Requirements: A Checklist for CPA and Accounting Firms
401(k) audit requirements generally depend on participants with account balances, prior filing status, and app…
