A 401k audit question comes up every fall around one date: the extended Form 5500 deadline for calendar-year plans is October 15, and that date decides a lot more than when the filing is due. Whether a plan needs an audit at all comes down to one participant count, and the rule for counting it changed in 2023. Plenty of plan sponsors are still working off the old method.
This guide covers who actually needs an employee benefit plan audit under ERISA, how the 2023 change to Form 5500's participant-counting rules shrank the population of plans that need one, what replaced the "limited scope audit" in 2021, and why the firm a plan sponsor picks to do the audit matters more than most sponsors assume.
ERISA Section 103(a)(3)(A), codified at 29 U.S.C. Section 1023(a)(3)(A), requires the plan administrator to engage an independent qualified public accountant to audit the plan's financial statements and attach that report to the Form 5500. The Department of Labor's implementing regulation, 29 CFR 2520.103-1, is what actually sets the 100-participant line between a "large plan" that needs the audit and a "small plan" that generally doesn't.
For plan years before 2023, that 100-participant count included every employee eligible to participate, whether or not they'd ever enrolled or had a dollar in the plan. A plan with 300 eligible employees and only 60 who'd actually joined was still a large plan, audit requirement included.
Effective for plan years beginning on or after January 1, 2023, the DOL changed the counting method for defined contribution plans. Line 5 of Form 5500 now reflects only participants who have an account balance at the start of the plan year, not the full eligible population. The DOL's own fact sheet on the change estimated that it would remove roughly 19,500 to 20,000 plans from the large-plan audit requirement.
Defined benefit plans weren't part of this change; they still count all eligible participants, regardless of account balance, the way defined contribution plans used to.
A plan sitting right at the threshold has one more option. Under 29 CFR 2520.103-1(d), a plan with between 80 and 120 participants at the beginning of the plan year can elect to file in the same category, large or small, that it used for the prior plan year, provided a Form 5500 was actually filed for that prior year.
A plan that filed as small last year with 110 participants this year can keep filing small. The election is available year after year as long as the count stays inside the 80-120 band and doesn't climb to 121 or more.
Form 5500 is the joint DOL, IRS, and PBGC filing that satisfies the annual reporting requirement under Titles I and IV of ERISA and the Internal Revenue Code. A large plan's audited financial statements and the IQPA's report get attached to it; a small plan generally files the shorter Form 5500-SF with no audit report required.
The standard due date is the last day of the seventh month after the plan year ends, which is July 31 for a calendar-year plan. Form 5558 grants an automatic 2.5-month extension, pushing that date to October 15, but only if the 5558 itself is filed by the original July 31 deadline. There's no further extension available beyond that; the total filing window tops out at 9.5 months after the plan year closes.
Large plan filers complete the full Form 5500 with Schedule H (financial information) and the accountant's report attached. Small plan filers generally use Form 5500-SF or complete Schedule I instead, and no audit report is required unless the plan fails to meet the DOL's small-plan audit waiver conditions.
A few situations push a plan over the threshold even after the 2023 change made the count more forgiving:
For years, plan sponsors who could get their custodian or trustee to certify investment information could elect a "limited scope audit," where the auditor excluded that certified information from testing and issued a disclaimer of opinion on the plan's financial statements as a whole. That option is gone by name, though the underlying mechanics largely survive under new rules.
The AICPA's Statement on Auditing Standards No. 136, codified in AU-C Section 703, took effect for ERISA plan audits for periods ending on or after December 15, 2021. It renamed the limited scope election the "ERISA Section 103(a)(3)(C) audit" and changed what the auditor's report actually says.
Electing this option is no longer treated as a scope limitation, so the auditor no longer issues a disclaimer. Instead, the report carries a two-part opinion:
The auditor's work didn't disappear under the new rule. Even on certified information, the auditor still has to:
Not every custodian certification qualifies: under 29 CFR 2520.103-8, the certification has to come from a "qualified institution," generally a bank, trust company, or insurance company that's regulated and examined by a federal or state agency; investment companies and broker-dealers don't count.
Under 29 CFR 2520.103-5, the certification itself has to be in writing, signed by someone authorized to represent that institution, and address both the accuracy and the completeness of the investment information. A certification that covers only one of those two doesn't satisfy the requirement, and the auditor can't rely on it to support an ERISA Section 103(a)(3)(C) audit.
The DOL doesn't just write the rules; it checks compliance with them. The department's November 2023 Audit Quality Study reviewed 307 plan audits from the 2020 plan year and found an overall major-deficiency rate of 30%, an improvement from the 39% rate in its 2015 study but still a meaningful share of audits that didn't comply with one or more GAAS requirements.
The deficiency rate wasn't evenly distributed. It tracked closely with how many employee benefit plan audits a firm actually performs in a year:
Membership in the AICPA's Employee Benefit Plan Audit Quality Center showed a similar split: member firms had a 30% deficiency rate, compared to 71% for non-members. For a plan sponsor who carries the fiduciary responsibility of selecting the auditor, that's not background trivia; it's one of the more direct correlations the DOL has published between a specific, checkable fact about a firm and the odds the resulting audit holds up.
Confirming whether a specific plan crosses the 100-participant line this year, whether a specific custodian certification actually satisfies 29 CFR 2520.103-5, or whether a merger changes the participant count enough to trigger an audit for the first time, is a research question with a specific regulatory answer, not a rule of thumb. Bizora's Audit Research traces answers back to the specific ERISA section, DOL regulation, or AICPA standard behind them, with a View Steps reasoning path showing how the conclusion was reached.
Research your next 401(k) audit or Form 5500 question in Bizora AI, with a 7-day free trial, no credit card required.
The sequence that keeps a plan's Form 5500 filing on schedule runs in a specific order:
Generally yes, if the plan has 100 or more participants with account balances at the start of the plan year, under ERISA Section 103(a)(3)(A). Plans between 80 and 120 participants can elect to keep their prior year's filing category under the 80-120 rule, and plans under 80 generally don't need one.
Large plans, generally those with 100 or more participants, must attach an independent qualified public accountant's report and audited financial statements to their Form 5500. Small plans typically file the shorter Form 5500-SF with no audit report required, unless the plan fails to meet the DOL's small-plan audit waiver conditions.
For plan years beginning on or after January 1, 2023, defined contribution plans count only participants who have an account balance at the start of the plan year, rather than every eligible employee. Defined benefit plans still use the older, broader counting method.
It's called an ERISA Section 103(a)(3)(C) audit. AICPA's SAS 136 replaced the term for periods ending on or after December 15, 2021, and the election is no longer treated as a scope limitation, so the auditor issues a two-part opinion instead of a disclaimer.
It's the independent qualified public accountant audit required under ERISA Section 103(a)(3)(A) for large employee benefit plans, performed under generally accepted auditing standards to determine whether the plan's financial statements and required schedules are fairly presented.
The standard deadline is the last day of the seventh month after the plan year ends, July 31 for calendar-year plans. Filing Form 5558 by that date grants an automatic 2.5-month extension to October 15, with no further extension available beyond that.
The investment information has to be certified by a qualified institution under 29 CFR 2520.103-8, generally a bank, trust company, or insurance company that's regulated and examined by a federal or state agency. The certification itself must be in writing, signed by an authorized representative, and address both the accuracy and completeness of the information under 29 CFR 2520.103-5.
Bizora AI turns hours of manual research into seconds, with every answer backed by primary source citations. Start your 7-day free trial. No credit card required.
Start Free TrialRelated articles