INSIGHT

Retirement Plan Internal Controls: What Auditors Look For

Ryan Davis • August 13, 2026

Services: Employee Benefit Plan Audit

---

Sponsoring a retirement plan means taking on real responsibility for your employees’ financial futures. Between the complexity of ERISA, shifting IRS and Department of Labor (DOL) expectations, and the day-to-day demands of plan administration, it’s easy for internal controls to slip down the priority list. That’s a problem, because when auditors arrive, internal controls are one of the first things they examine.

Understanding what auditors are looking for gives you a real advantage: the chance to identify and address gaps before they become costly 401(k) compliance issues.

Why Internal Controls Matter in Retirement Plan Audits

The IRS takes internal controls seriously. When an IRS agent conducts a retirement plan examination, they begin by evaluating the effectiveness of the plan’s internal controls to determine the scope of the audit. A plan with strong, well-documented controls may receive a focused review. A plan with weak or absent controls is likely to face a broader examination.

Beyond scope, internal controls affect your eligibility for correction programs. The IRS Employee Plans Compliance Resolution System (EPCRS) allows plan sponsors to correct certain operational failures, but that relief requires evidence of established practices and procedures. A plan document alone is not enough. The IRS expects to see that controls are actively in place and followed.

The DOL also scrutinizes internal controls. During fiduciary investigations, DOL examiners look specifically at plan administration processes, contribution deposit procedures, and how the plan monitors its service providers. Plans with clear, documented systems tend to fare better under DOL scrutiny than those operating informally.

What Auditors Examine: 8 Key Internal Control Areas

While every plan is different, auditors consistently focus on several high-risk areas during employee benefit plan audits. Here is a look at what they are looking for and why it matters.

1. Timely Deposit of Employee Deferrals

This is one of the DOL’s most consistent areas of scrutiny. ERISA requires that amounts withheld from employee paychecks, including elective deferrals, loan repayments, and voluntary contributions, be deposited into the plan as soon as they can reasonably be segregated from company assets. For small plans with fewer than 100 participants, a seven-business-day safe harbor exists. Large plans have no such safe harbor, and the DOL has indicated that deposits should occur within just a few business days.

Auditors will compare payroll dates to deposit dates and look for patterns. Chronic delays, even by a few days, can constitute a prohibited transaction, triggering correction requirements and potential excise taxes. Plans with no documented deposit procedures are especially vulnerable.

What to have in place: Documented payroll-to-deposit procedures, redundant staffing so the process does not depend on a single individual, and a regular reconciliation process comparing pay dates to deposit confirmations.

2. Participant Eligibility and Enrollment

Failing to enroll eligible employees is one of the more common and costly operational errors auditors find. This includes rehired employees, employees misclassified as independent contractors, leased employees, and, as of plan years beginning after December 31, 2024, long-term part-time (LTPT) employees who have worked at least 500 hours in two consecutive years and are at least age 21.

Plans with automatic enrollment face a related risk: the automation does not always work as intended. Auditors look for evidence that eligibility monitoring and enrollment processes are functioning correctly, particularly where there are gaps between payroll systems and plan recordkeeper platforms.

What to have in place: Automated or regularly reviewed eligibility monitoring, clear communication between HR and payroll, and documented processes for handling non-standard employee categories.

3. Compensation Definitions and Contribution Calculations

Compensation errors are more common than many plan sponsors realize. The plan document defines what counts as eligible compensation for purposes of calculating deferrals and employer contributions, but translating that definition accurately into payroll coding is where things often go wrong. Bonuses processed in separate pay runs are a frequent source of error, as are changes to payroll systems that disrupt existing configurations.

Auditors will test whether contributions are calculated based on the correct compensation amounts. Over- or under-contributions both require correction, and the process can be time-consuming and costly.

What to have in place: A clear mapping of the plan’s compensation definition to payroll pay codes, regular collaboration between HR and payroll to review coding accuracy, and a periodic audit of contribution calculations against plan terms.

4. Forfeiture Management

When a participant leaves before vesting, the unvested portion of their account becomes a forfeiture. Plan documents specify how and when forfeitures must be used, typically by the end of the plan year following the year they arise. Auditors look for unallocated forfeitures that have accumulated beyond that window, which indicates a breakdown in oversight.

Recent litigation has also raised questions about forfeiture use, particularly whether applying forfeitures to offset employer contributions satisfies ERISA fiduciary duties. Auditors are paying closer attention to this area as a result.

What to have in place: A documented process for monitoring forfeiture balances, clear procedures for directing their use in accordance with plan terms, and regular communication with your plan recordkeeper or third-party administrator (TPA) to confirm timely action.

5. Required Minimum Distributions

Many plan sponsors mistakenly believe that participants must initiate their own required minimum distributions (RMDs), similar to how an IRA works. That’s not the case. For employer-sponsored plans, the responsibility to identify and issue RMDs rests with the plan sponsor. Participants who have reached age 73 and are no longer employed are generally subject to RMD requirements.

Failing to issue RMDs is an operational failure that auditors will flag. The IRS imposes substantial penalties for missed distributions, and correction typically requires a filing under the Voluntary Correction Program (VCP).

What to have in place: A proactive process for identifying participants approaching RMD age, a system for calculating and issuing distributions on time, and clear procedures that do not hinge on participant-initiated requests.

6. Participant Loan Administration

Participant loans create their own set of control risks. A common scenario: a participant requests and receives a loan through the recordkeeper’s platform, but the repayment schedule never gets properly set up in payroll. The participant does not make payments, and what started as a loan becomes a taxable deemed distribution and a plan qualification failure.

Auditors look at whether loan repayments are being deducted correctly from payroll and whether loan balances reconcile with the recordkeeper’s records. Discrepancies indicate a control gap that can carry significant consequences for participants.

What to have in place: A clear protocol for setting up loan repayments in payroll upon loan initiation, periodic reconciliation between payroll records and the recordkeeper’s loan schedules, and documented loan policies that are regularly reviewed.

7. Hardship Distribution Compliance

The rules governing hardship distributions, including who qualifies, what documentation is required, and how distribution amounts are calculated, can be easy to misapply. While employee self-certification is permitted for certain hardship distributions, auditors still look at whether the plan sponsor has appropriate documentation practices in place and whether distributions were approved within the bounds of the plan’s terms.

What to have in place: Clear internal procedures for reviewing and approving hardship requests, a retention policy for supporting documentation, and a process for verifying that amounts distributed are within allowable limits.

8. Timely Plan Document Amendments

Plan documents must keep pace with 2026 employee benefit plan changes. Auditors look for evidence that plan documents have been amended on a timely basis to reflect legislative changes. SECURE Act 2.0, for example, introduced a number of provisions that affect plan operations, and sponsors who have not updated their documents accordingly are at risk.

Plans with individually designed documents bear a higher burden here than those using pre-approved documents. But even sponsors using pre-approved documents should confirm with their document provider or ERISA counsel what amendments have been made and when.

What to have in place: An annual review with your plan document provider or ERISA counsel to discuss required amendments, and a process for tracking and executing those amendments before applicable deadlines.

Oversight of Third-Party Administrators & Service Providers

Much of retirement plan administration is outsourced to TPAs, recordkeepers, and other service providers, which can create a false sense of security. Auditors understand this and look specifically at whether plan sponsors are actively overseeing those providers, including evaluating whether to switch their 401(k) plan provider, rather than simply delegating and assuming all is well. As a plan sponsor, you retain fiduciary responsibility even when a third party performs administrative functions.

That means you need processes in place to confirm that your TPA is receiving accurate and complete data from you, and that they are performing their responsibilities correctly. If a top-heavy calculation is performed incorrectly because your TPA received incomplete payroll data, the error is ultimately yours to correct. Auditors want to see evidence of that oversight: regular reconciliations, documented communication with service providers, and a clear understanding of who is responsible for which aspects of plan administration.

Preparing for Your Employee Benefit Plan Audit

The best time to evaluate your internal controls is before the auditor arrives. A few practices that can make a meaningful difference include reviewing your plan document annually to confirm that operations align with its terms and that required amendments have been made, reconciling payroll data to plan contributions on a regular basis to catch discrepancies early, and documenting your internal procedures in writing so that the process does not depend on institutional knowledge held by one person.

You should also schedule periodic check-ins with your TPA and recordkeeper to review plan operations and address any emerging issues, and correct known errors promptly through available IRS and DOL correction programs rather than waiting for an examination to surface them. If you are unsure where to start, your first 401(k) audit is an opportunity, not just a compliance obligation. A thorough, well-managed audit process can surface operational issues that, left unaddressed, would grow more difficult and expensive to correct over time.

Working With an Auditor Who Understands Plan Operations

BPM’s Employee Benefit Plan Audit Services team works extensively on retirement and benefit plan compliance. We stay current with regulatory developments, maintain membership in the AICPA Employee Benefit Plan Audit Quality Center, and bring continuity to our client engagements by working with the same people year after year.

Our role does not end with the annual audit. Throughout the year, we are available to discuss regulatory changes, walk through operational concerns, and help you prepare for DOL or IRS examinations. If we identify control weaknesses during the audit process, we will tell you directly and work with you to understand what stronger controls would look like in practice.

Your employees are counting on this plan. We take that seriously, and we approach every engagement with that responsibility in mind. Ready to talk about your employee benefit plan audit? Contact BPM to learn how we can support your organization.