Four changes may impact your 401(k) plan’s 2023 audit. As the plan administrator or sponsor, it’s imperative to take this time to consult with your 401(k) plan auditor to determine whether your plan’s audit will be affected. The method to count participants on Form 5500 has changed, potentially reducing your total number of participants and ending your need for an audit. Other changes to auditing standards include risk assessments and estimates, as well as clarifications about your IT environment monitoring procedures. 401(k) audit director and practice leader Kim Moore, CPA, discussed how remaining vigilant on these fronts can help ensure a more successful audit with audit and assurance manager Karen Hill, CPA, on the 401(k) Audit CPA Success Show podcast.
Key Takeaways:
- The Department of Labor made changes to how Form 5500 counts participants, switching from counting all eligible participants at the beginning of the plan year to the number of account balances in the plan as of the first day of the plan year
- Statements on Audit Standards (SAS) 145 impact how auditors perform risk assessments, particularly how they are unable to use inquiry as audit evidence
- A new auditing standard, SAS 143, covers estimates and isn’t typically associated with benefit plan audits, but may impact your plan if the plan invests in non-standard investments such as real estate or artwork
- Consider who has access through your IT environment during your audit, even if your plan or payroll is processed through ADP, Paychex or another third-party administrator
Changes to how Form 5500 Counts Participants
The Department of Labor (DOL) implemented changes to Form 5500, altering the way plan participants are counted and potentially negating the need for a plan audit for some smaller companies. In the past, you would determine whether or not you need an audit by counting all eligible participants at the beginning of the plan year. Now, you would instead count the number of account balances in your plan as of the first day of the plan year, including any current employees who are deferring, plus any terminated or retired employees who still have account balances in your plan.
The DOL possibly introduced the change to help reduce costs from expensive audits for businesses with smaller numbers of active participants as compared to their eligible participants. Audits can be expensive, so reducing the number of businesses that need an audit can translate into cost savings for many. The changes do unfortunately add additional requirements for some businesses.
If your business is growing, but your active participant count is just short of the 100-participant threshold, which you may reach by next year, you should speak with your auditor about your options. Because of the gap between your previous audit and your next audit, your auditor may need to perform beginning balance testing, which is essentially an audit conducted to cover the years between when you stopped having the audit and when you needed an audit again. Communicate with your auditor to help determine what next steps are necessary to remain in compliance.
Audit Standards – SAS 145
Risk assessments performed by your auditor during your 401(k) audit may differ from previous years, especially as they pertain to your payroll reviews. Previously, your auditor may have performed an inquiry where they asked about how your payroll review process worked. If two separate people agreed that the review was performed, that is enough for your auditor to use as audit evidence. Now, instead of just asking if the payroll has been reviewed, your auditor may ask to see something that shows the payroll has been reviewed.
In this case, an email confirmation such as, “Yes, I reviewed it, it’s good to go,” can be used as evidence by the auditor. Automated messages that confirm approval and payroll processing can also be used by your auditor. If your payroll review process has been purely verbal rather than written, review your previous audits and wherever your auditor simply asked you or your colleague a series of questions, you may need to put a plan into place to produce written evidence of these approvals. This applies to all audits moving forward, not just employee benefit plan audits. Financial statement audits, for instance, will be subjected to this same standard.
Audit Standards – SAS 143
Although it won’t impact most 401(k) plans or audits, some plans that invest in assets such as real estate, artwork or other non-typical assets may be impacted. The purpose of SAS 143 is to clarify your auditor’s responsibilities concerning accounting estimates and related disclosures during a financial statement audit. Typical 401(k) plans with assets in mutual funds or pulled accounts will likely see no change in their audit based on this new rule, but consult with your auditor to make sure you’re not impacted.
Clarifications on IT Environment
The DOL has made it clear that a well-monitored IT environment is an important consideration for 401(k) plan administrators, but further clarification has made it imperative for you to have controls for IT as you have in your manual processes. Although it may be handled by your service provider inside a payroll system, managed by your recordkeeper and housed in their recordkeeping administrative system, your auditor will still need to know what controls are in place to protect participant assets.
Keep SOC reports and SOC reviews on hand to look at the controls your providers have. Depending on your auditor, they may ask for things like access listing or IT audit testing. Speak with your auditor to help you and your internal IT team or external IT provider prepare to accommodate to the new changes.
If you need an audit for your 401(k) plan, learn more about our 6-phase 401(k) audit process or request a free 401(k) audit consultation below.
Watch the 401(k) Audit CPA Success Show: Lessons Learned from the Department of Labor Audit Quality Study on YouTube and subscribe on Spotify or Apple Podcasts and let us know what you think by rating and reviewing.
