ERISA employee benefit plan
financial statement audit special
considerations2024
This non-authoritative Employee Benefit Plan Audit Quality Center (EBPAQC) resource is intended to
help auditors identify and understand recent legislative, regulatory, and professional developments that
may impact the 2024 ERISA employee benefit plan audit season (including audits of ERISA plan financial
statements for periods ending December 31, 2023). This document may be helpful in initiating
discussions throughout the course of the audit with the engagement team, plan sponsor, plan
management, and third-party service organizations. This document has not been approved, disapproved,
or otherwise acted on by any senior technical committee of the AICPA.
The 2024 employee benefit plan (EBP) audit season will present the auditor with several new and special
considerations for ERISA audits, including:
New auditing standards and audit and accounting guidance
Implementing new auditing standards, including:
o SAS No. 143, Auditing Accounting Estimates and Related Disclosures;
o SAS No. 144, Amendments to AU-C Sections 501, 540, and 620 Related to the Use of
Specialists and the Use of Pricing Information Obtained From External Information
Sources;
o SAS No. 145, Understanding the Entity and Its Environment and Assessing the Risks of
Material Misstatement; and
o SAS No. 147, Inquiries of the Predecessor Auditor Regarding Fraud and Noncompliance
With Laws and Regulations.
Understanding the lessons learned from the auditor’s implementation of SAS No. 142, Audit
Evidence, (codified in AU-C section 500
1
).
Using the most recent version of the AICPA Audit and Accounting Guide, Employee Benefit Plans
(EBP Guide) (as of August 1, 2023) which has been updated with the recent audit and accounting
standards.
Legislative and regulatory developments
Understanding the effects of the SECURE 2.0 Act of 2022 provisions, which was signed into law
on December 29, 2022.
Understanding the effects of the change in the participant-counting methodology for determining
eligibility for simplified reporting alternatives available to small defined contribution plans
(generally plans with fewer than 100 participants), including the conditional waiver of the audit
requirement. Under the new methodology, defined contribution retirement plans will use the
number of participants with account balances as of the beginning of the plan year in counting
participants.
Understanding the audit quality issues identified in the DOL Audit Quality Study.
1
All AU-C sections can be found in AICPA Professional Standards.
2
Plan environment and controls
Considering the economic environment and potential implications for the business environment.
Understanding the effect of low employee retention rates at auditing firms, service providers, and
the plan sponsor and the increase in employer layoffs on plans.
This tool also includes references to additional AICPA resources on auditing in the current environment.
Contents
New auditing standards and guidance .................................................................................................................. 3
Implementation of new auditing standards ....................................................................................................... 3
Implementation of SAS No. 145, Understanding the Entity and Its Environment and Assessing the Risks of
Material Misstatement....................................................................................................................................... 3
SAS No. 142 resources .................................................................................................................................... 4
AU-C section 703 resources ............................................................................................................................. 5
2023 AICPA EBP Audit and Accounting Guide (revised through August 1, 2023) ........................................... 5
Legislative and regulatory developments .............................................................................................................. 5
SECURE 2.0 Act of 2022 ................................................................................................................................. 5
2023 Form 5500 changes ................................................................................................................................. 6
DOL Audit Quality Study, November 2023 ....................................................................................................... 7
DOL final rule on auditor independence ........................................................................................................... 8
DOL final rule on environmental, social, and governance (ESG) investments ................................................. 9
IRS revenue procedure 2022-40 permits determination letters for 403(b) plans .............................................. 9
IRS proposed regulations implementing exception to “one bad apple” rule ..................................................... 9
401(k) and profit-sharing plan contribution limits .............................................................................................. 9
Required Amendments List ............................................................................................................................ 10
Disclosure of name of certifying entity in ERISA Section 103(a)(3)(C) financial statements .......................... 10
ERISA section 103(a)(3)(C) audit for a plan that does not require an audit ................................................... 11
DOL Compliance Assistance Release No. 2022-01 ....................................................................................... 12
Current environment additional audit considerations ....................................................................................... 12
Economic environment ................................................................................................................................... 12
Nondisclosure agreements ............................................................................................................................. 13
Correcting delinquent participant contributions in a volatile market ............................................................... 13
Plan amendments SECURE Act and CARES Act ....................................................................................... 14
Partial plan terminations ................................................................................................................................. 15
Audit evidence ................................................................................................................................................ 15
SOC 1 reports ................................................................................................................................................. 16
Actuarial mortality improvement update ......................................................................................................... 16
Examples of financial statement disclosures ...................................................................................................... 16
DOL EDGAR search tool for Form 5500 filings .............................................................................................. 16
SEC Form 11-K search tool for plan financial statement filings ..................................................................... 16
3
Pooled employer plans (PEPs) ........................................................................................................................... 17
On the horizon ..................................................................................................................................................... 17
Auditing standards .......................................................................................................................................... 17
Additional resources ............................................................................................................................................ 18
AICPA resources and Journal of Accountancy articles .................................................................................. 18
New EBPAQC resources and tools ................................................................................................................ 18
2024 EBPAQC webcast calendar ................................................................................................................... 18
New auditing standards and guidance
Implementation of new auditing standards
SAS No. 143, Auditing Accounting Estimates and Related Disclosures (codified in AU-C section 540), is
effective for audits of financial statements for periods ending on or after December 15, 2023. The SAS
helps auditors to appropriately address increasingly complex scenarios that arise from new accounting
standards that include estimates, and may be particularly relevant in considering actuarial reports in DB
pension or health and welfare plan estimates, ESOP appraisals, fair value accounting estimates in non-
Section 103(a)(3)(C) audits, and fair value accounting estimates in ERISA Section 103(a)(3)(C) audits for
investments not covered by the certification.
SAS No. 144, Amendments to AU-C Sections 501, 540, and 620 Related to the Use of Specialists and
the Use of Pricing Information Obtained From External Information Sources, is effective for audits of
financial statements for periods ending on or after December 15, 2023. It provides guidance on the use of
information from pricing services as audit evidence and the use of specialists, and may be particularly
relevant in considering actuarial reports in DB pension or health and welfare plan estimates, ESOP
appraisals, fair value accounting estimates in non-Section 103(a)(3)(C) audits, and fair value accounting
estimates in ERISA Section 103(a)(3)(C) audits for investments not covered by the certification.
SAS No. 147, Inquiries of the Predecessor Auditor Regarding Fraud and Noncompliance with Laws and
Regulations, is effective for audits of financial statements for periods beginning on or after June 30, 2023.
It narrowly revises GAAS to require an auditor to inquire of the predecessor auditor regarding identified or
suspected fraud and matters involving identified or suspected fraud or noncompliance with laws or
regulation (NOCLAR) and, once an engagement is accepted, to document the inquiries of the
predecessor auditor and the results of those inquiries.
Implementation of SAS No. 145, Understanding the Entity and Its Environment and
Assessing the Risks of Material Misstatement
SAS No. 145, Understanding the Entity and Its Environment and Assessing the Risks of Material
Misstatement, is effective for audits of financial statements for periods ending on or after December 15,
2023; early implementation is permitted.
SAS No. 145 does not fundamentally change the key concepts underpinning audit risk. Rather, it clarifies
and enhances certain aspects of the identification and assessment of the risks of material misstatement
to drive better risk assessments and, therefore, enhance audit quality. SAS No. 145, for example,
enhances:
requirements and guidance related to obtaining an understanding of the entity’s system of internal
control and assessing control risk; and
guidance that addresses the economic, technological, and regulatory aspects of the markets and
environment in which entities and audit firms operate.
4
SAS No. 145 also includes revised and new requirements and guidance, including:
a revised definition of significant risk;
revised requirements to evaluate the design of certain controls within the control activities
component, including general information technology (IT) controls, and to determine whether
such controls have been implemented;
a new requirement to separately assess inherent risk and control risk;
a new requirement to assess control risk at the maximum level such that, if the auditor does not
plan to test the operating effectiveness of controls, the assessment of the risk of material
misstatement is the same as the assessment of inherent risk;
a new “stand-back” requirement intended to drive an evaluation of the completeness of the
auditor’s identification of significant classes of transactions, account balances, and disclosures;
revised requirements relating to audit documentation;
new guidance on scalability; and
new guidance on maintaining professional skepticism.
Click here to order the eBook version of the AICPA’s Risk Assessment in a Financial Statement Audit
(New Guide as of January 1, 2023). Click here to order the eBook version with a print-friendly PDF
download.
Click here to view the EBPAQC archived webcast, Applying SAS No. 145 in employee benefit plan audits,
Part 1.
Click here to view the EBPAQC archived webcast, Applying SAS No. 145 in employee benefit plan audits,
Part 2.
SAS No. 142 resources
SAS No. 142, Audit Evidence (codified in AU-C section 500), was effective for 2022 plan audits
performed in 2023. Among other things, the revisions to AU-C section 500 address the evolving nature of
transacting business as well as the evolution of information to be used as audit evidence. Issues
addressed include use of emerging technologies and techniques by both preparers and auditors and the
expanding use of external information sources to provide audit evidence, including confirmations with
third parties. Email confirmations are being used as audit evidence more frequently in today’s remote
work environment. When a confirmation request is sent by email, the auditor's determination that the
request is being properly directed to the appropriate confirming party may include performing procedures
to test the validity of some or all of the e-mail addresses supplied by management. In addition, AU-C
section 505, External Confirmations, requires that the auditor maintain control over external confirmation
requests, including determining that requests are properly directed to the appropriate confirming party.
Click here to access AU-C section 500.
Click here to access Audit evidence At a glance, which describes the effect of the changes to AU-C
section 500 on financial statement audits.
Click here to access the EBPAQC primer, Audit evidence in an employee benefit plan.
Click here to access the EBPAQC matrix, Common sources of audit evidence used in testing investment
valuations.
Click here to view the EBPAQC archived webcast, SAS No. 142 Audit Evidence: An employee benefit
plan audit perspective.
5
AU-C section 703 resources
EBPAQC tools and resources for AU-C section 703, Forming an Opinion and Reporting on Financial
Statements of Employee Benefit Plans Subject to ERISA, can be found at these EBPAQC resource
centers:
Click here to access the ERISA Section 103(a)(3)(C) audits resource center.
Click here to access the SAS No. 136 (AU-C section 703) resource center.
2023 AICPA EBP Audit and Accounting Guide (revised through August 1, 2023)
The AICPA recently issued the 2023 edition of the Audit and Accounting Guide, Employee Benefit Plans
(through August 1, 2023), which incorporates significant changes to address new auditing standards,
laws, and regulations. The summary of changes can be found in Appendix L, Schedule of Changes Made
to the Text From the Previous Edition. The 2023 edition includes conforming changes related to:
SAS No. 145, Understanding the Entity and Its Environment and Assessing the Risks of Material
Misstatement, in Chapter 3, Risk Assessment in an Audit of ERISA Plan Financial Statements
and Chapter 4, The Plan's System of Internal Control;
SAS No. 143, Accounting Estimates and Related Disclosures;
SAS No. 144, Amendments to AU-C Sections 501, 540, and 620 Related to the Use of
Specialists and the Use of Pricing Information Obtained From External Information Sources;
And SAS No. 147, Inquiries of the Predecessor Auditor Regarding Fraud and Noncompliance
with Laws and Regulations.
The issuance of the SECURE 2.0 Act of 2022 provisions, which was signed into law on
December 29, 2022.
Changes to the 2023 Form 5500, including the change in participant-counting methodology for
determining eligibility for simplified reporting alternatives available to small defined contribution
plans.
It also includes a new FinREC recommendation for the accrual of contributions receivable related to
employee deferrals in a defined contribution plan (pars. 5.55 and 5.80e).
Click here to purchase the Essential A&A Research Collection and access to the AICPA Online
Professional Library (subscription required).
Click here to order the eBook version with a print-friendly PDF download.
Click here to order the eBook version.
Legislative and regulatory developments
SECURE 2.0 Act of 2022
The SECURE 2.0 Act of 2022 (Act) was signed into law on December 29, 2022, to increase retirement
savings, improve retirement rules, and lower employer costs of setting up a retirement plan. Plan
amendments required by the Act generally need not be made until the end of the first plan year beginning
on or after January 1, 2025; however, plans must be operated in accordance with the effective date of
each new provision.
6
The EBPAQC has developed a resource, SECURE 2.0 Act of 2022 considerations for auditors, to assist
plan auditors in understanding the provisions of the SECURE 2.0 Act of 2022 (Act) that may affect the
ERISA plans they audit, which provides:
A summary of those provisions and their effective dates.
The types of plans and audit areas to which they may relate.
References to non-authoritative resources and authoritative guidance to assist auditors in
understanding the provisions and determining how they may affect the audit.
This document may be helpful in initiating discussions throughout the course of the audit with plan
management.
Following is a summary of some of the significant provisions that may affect plan sponsors and auditors in
the 2024 audit season:
Required Minimum Distributions (RMDs). The RMD age will increase in 2023 and again in
2033. Starting in 2024, Roth accounts will be exempt from the RMD rules while the participant is
alive.
Student loan payments. For plan years beginning after December 31, 2023, employers may
make matching contributions under a 401(k) or 403(b) plan on employees’ qualified student loan
payments. Employees who receive such matching contributions are required to certify annually to
the employer that such payment has been made on such loan.
Withdrawals for certain emergency expenses. The Act provides an exception from the 10%
tax on certain early distributions made after 2023 that are used for emergency expenses which
are unforeseeable or immediate family needs relating to personal or family emergency expense.
Plan administrators generally may rely upon a participant’s self-certification; however, the IRS is
authorized to issue guidance to address situations in which a plan administrator has actual
knowledge to the contrary or there are employee misrepresentations.
Increased dollar threshold for mandatory distributions. For distributions after December 31,
2023, the involuntary distribution threshold will increase from $5,000 to $7,000.
Click here for the EBPAQC non-authoritative resource, SECURE 2.0 Act of 2022 considerations for
auditors.
Click here to read the Senate staff comprehensive analysis of each section of the SECURE 2.0 Act.
Click here to read the SECURE 2.0 Act (included as Division T of the Consolidated Appropriations Act,
2023).
2023 Form 5500 changes
The U.S. Department of Labor, the IRS, and the Pension Benefit Guaranty Corporation issued the third
and final phase of changes to the Form 5500 and Form 5500-SF Short Form related to the
implementation of a September 2021 regulatory proposal (see EBPAQC Alert #478). These changes,
which apply beginning with 2023 plan year reports that generally will be filed beginning in 2024, include:
A change in the participant-counting methodology for determining eligibility for simplified reporting
alternatives available to small defined contribution plans (generally plans with fewer than 100
participants), including the conditional waiver of the audit requirement. Prior to the change, in
counting participants for the purpose of determining whether a plan may file as a small plan,
individuals were considered participants a defined contribution retirement plan when they have
satisfied the plan's age and service requirements for participation (i.e., eligible to participate),
even if they have elected not to participate in the plan. Under the new methodology, defined
contribution retirement plans will use the number of participants with account balances as of the
beginning of the plan year in counting participants. The DOL estimates that nearly 20,000 plans
7
previously considered large plans will no longer be subject to the annual audit requirement due to
this change.
A consolidated Form 5500 reporting option for certain groups of defined contribution retirement
plans. The final rule provides that a defined contribution group (DCG) reporting arrangement is
treated as a new type of DFE that is required to: (1) file a Form 5500 under rules and conditions
generally applicable to large defined contribution pension plans; (2) report specific plan-level
information on the new Schedule DCG regarding each individual plan in the DCG, which includes
an audit report for each large plan and each small plan that does not meet the conditions for a
waiver of the audit; and (3) ensure that each individual plan included in the DCG filing meets
specified eligibility conditions that are consistent with SECURE Act Section 202 statutory criteria.
Improved reporting by pooled employer plans and other multiple employer plans. The final rule
adds a new Schedule MEP (Multiple Employer Pension Plan Information) to the Form 5500 and a
limited number of additional data items elsewhere on the Form 5500 relevant to MEPs. A new
checkbox will be added to the Form 5500 to indicate that Schedule MEP is attached to the Form
5500.
Additional breakout categories added to Schedule H breakout of “Administrative Expenses Paid
by the Plan.” The breakouts for administrative expenses will now be “Salaries and allowances,”
“Contract administrator fees,” “Recordkeeping fees,” “IQPA audit fees,” “Investment advisory and
investment management fees,” “Bank or trust company trustee/custodial fees,” “Actuarial fees,”
“Legal fees,” “Valuation/appraisal fees,” “Other Trustee fees/expenses,” and “Other expenses.”
Changes to Schedule R related to financial and funding reporting by PBGC-covered defined
benefit plans. The changes modify Schedule R, line 19a, to require that all defined benefit
pension plans (except DFEs) with 1,000 or more participants at the beginning of the plan year
show the end-of-year distribution of assets, broken down in seven reconfigured categories of plan
assets, and provide clarification concerning classification of atypical investments; modify
Schedule R, line 19b, to change the available categories for current average duration; and
eliminate Schedule R, line 19c.
The addition of selected Internal Revenue Code compliance questions to Schedule R to improve
tax oversight and compliance of tax-qualified retirement plans.
Technical and conforming changes as part of the annual rollover of forms and instructions.
The Federal Register notices also include appendices that describe the changes to the forms and
instructions as well as a regulatory impact and paperwork burden analyses. A more detailed summary of
the annual reporting changes is included in a fact sheet posted on the DOL’s website (linked here). Mock-
ups of the forms and instructions will be available at reginfo.gov as part of the Paperwork Reduction Act
clearance process. The release of “for information-only” copies of the forms and instructions will happen
later in 2023.
Click here for the News Release, Department of Labor Issues Final Rules on Changes to 2023 Form
5500, Form 5500-SF Employee Benefit Plan Reports.
Click here to review the Federal Register Notice of Final Forms Revision.
Click here to review the Notice for Final Rulemaking.
DOL Audit Quality Study, November 2023
The U.S. Department of Labor (DOL) Employee Benefits Security Administration (EBSA) issued a report,
Audit Quality Study, November 2023, which found deficiencies in the quality of audit work performed by
independent CPAs with respect to financial statement audits of ERISA employee benefit plans for the
2020 filing year. The 2020 form year was chosen because it was the last year before auditors were
required to comply with the new audit standard SAS No. 136, Forming an Opinion and Reporting on
Financial Statements of Employee Benefit Plans Subject to ERISA, as amended, which allowed for the
development of an audit quality baseline prior to the implementation of the new standard.
8
EBSA's assessment of audit quality included a statistical review of 307 plan audits performed by 222 CPA
firms. EBSA found that 70% of the audits fully complied with professional auditing standards or had minor
deficiencies, while 30% of the audits had one or more major deficiencies with respect to one or more
relevant GAAS requirements. While the deficiency rate remains high, it is a statistically significant
improvement over the 2015 results which showed a 39% deficiency rate. The results also show
considerable improvement in the percentage of plans audits with multiple deficiencies.
EBSA found a clear link between the number of EBP audits performed by a CPA and the quality of the
work performed. Specifically, firms that perform 5 or fewer EBP audits a year had a significantly higher
deficiency rate than other auditors in the study. The number of firms in this category has shrunk from
5,207 in 2011 to 2,585 in 2020. Another data point noted in the report is that EBPAQC firm members had
a significantly lower deficiency rate than non-member firms.
As in past studies, the audit areas with more frequent deficiencies were in areas unique to EBP auditing,
including contributions, benefit payments, participant data, and party-in-interest/prohibited transactions.
The report noted that while the issuance of SAS No. 136, as amended, was not particularly relevant to
this study, the DOL believes it is a pivotal change in auditing standards, and the DOL plans to assess its
affect on audit quality in a future project.
In addition to the legislative recommendations that the DOL Office of Inspector General made in its 2004,
2012, and 2014 reports, EBSA's report contained 7 recommendations focused on enforcement and
outreach. These recommendations include EBSA continuing to focus case targeting strategies on CPAs
with smaller EBP audit practices that audit plans with large amounts of plan assets and increasing the
number of large benefit plan practice CPA firms that are reviewed; working with state licensing boards to
enhance the investigation and sanctioning process for CPAs performing significantly deficient work and
encouraging them to accept the results of investigations performed by the AICPA’s Professional Ethics
team and use those results in disciplining CPAs; encouraging changes to the AICPA's Peer Review
program; working with the National Association of State Boards of Accountancy (NASBA) to encourage
state boards to require specific licensing requirements for CPAs who perform EBP audits, to include
specific training and experience in auditing employee benefit plans; expanding its outreach activities to
include plan administrator organizations in order to explain the importance of hiring competent CPAs to
plan administrators and those with responsibility for hiring plan auditors; communicating with each of the
state licensing boards regarding the audit study results and the need to ensure that only competent CPAs
are performing employee benefit plan audits; and encouraging state CPA societies to create EBP audit
training programs.
Click here for the EBSA report, Audit Quality Study, November 2023.
DOL final rule on auditor independence
The Department of Labor released a final rule, Interpretive Bulletin Relating to the Independence of
Employee Benefit Plan Accountants (IB), that establishes guidelines for determining when a qualified
public accountant is independent for purposes of auditing the financial statements required to be included
in the annual report filed with the DOL under ERISA. It revises and restates the previous IB on auditor
independence the DOL issued in 1975.
The AICPA Professional Ethics Division has prepared an AICPA and DOL Independence rules
comparison tool providing a summary and comparison of the more common DOL and AICPA
independence rules that affect auditors of employee benefit plans, and how they differ.
Click here for the AICPA and DOL Independence rules comparison tool.
9
DOL final rule on environmental, social, and governance (ESG) investments
The DOL issued a final rule allowing ERISA plan fiduciaries to consider ESG factors when they make
investment decisions and when they exercise shareholder rights, including voting on shareholder
resolutions and board nominations.
The final rule includes changes to clarify permissibility of consideration of ESG factors, changes to
qualified default investment alternative provisions (QDIAs), changes to clarify the application of the duty
of loyalty, and provisions on shareholder rights including proxy voting.
The final rule will be effective 60 days after publication in the Federal Register, except for a delayed
applicability until one year after publication for certain proxy voting provisions to allow fiduciaries and
investment managers additional time to review any proxy voting policies and guidelines and make any
necessary changes.
Click here for Final Rule on Prudence and Loyalty in Selecting Plan Investments and Exercising
Shareholder Rights.
IRS revenue procedure 2022-40 permits determination letters for 403(b) plans
In revenue procedure 2022-40, the IRS permits the submission of determination letter applications for
section 403(b) individually designed plans. Under this revenue procedure, a plan sponsor that maintains a
section 403(b) individually designed plan will be permitted to submit a determination letter application for
an initial plan determination, for a determination upon plan termination, and in certain other circumstances
identified by the IRS in guidance published in the Internal Revenue Bulletin (IRB). The earliest date a plan
sponsor will be permitted to submit a determination letter application for a section 403(b) individually
designed plan is June 1, 2023.
Click here for IRS revenue procedure 2022-40.
IRS proposed regulations implementing exception to “one bad apple” rule
The SECURE Act created an exception to the “one bad apple” rule for PEPs and other DC MEPs that
qualify as one plan for ERISA purposes. Under the SECURE Act, one participating employer’s failure
won’t jeopardize the MEP’s plan tax status if the plan document provides that the MEP will spin off assets
attributable to employees of a noncompliant employer (unless the Treasury Department determines that
keeping those assets in the plan would be in the employees’ best interest), and the noncompliant
employer (commonly referred to as an “unresponsive participating employer”) will be responsible for any
liabilities with respect to its participating employees and their beneficiaries.
On March 28, 2022, the IRS proposed regulations (Proposed Regulations) to implement the statutory
exception to the one bad apple rule which allows MEPs to maintain their tax-qualified status despite a
participating employer’s errors. The proposal sets conditions for MEPs to use the exception and provides
a framework to address a participating employer’s failures, including detailed notice requirements. The
IRS intends to provide model plan language for required amendments to qualify for the one bad apple
exception after finalizing the regulations. Pending final regulations, IRS will allow reliance on the proposal.
Click here to read the Proposed Regulations.
401(k) and profit-sharing plan contribution limits
In 2023, the limit on employee elective deferrals is $22,500. If permitted by the plan, participants age 50
or over at the end of the calendar year can also make catch-up contributions of up to $7,500 in 2023. In
2023, compensation limits for contributions are $330,000.
10
Click here for the IRS online resource on 401(k) and Profit-Sharing Plan Contribution Limits.
Required Amendments List
The Required Amendments List is an annual list of changes in retirement plan qualification requirements
published by the IRS.
Click here for the IRS Required Amendments Lists.
Disclosure of name of certifying entity in ERISA Section 103(a)(3)(C) financial
statements
In preparing for the 2023 ERISA Section 103(a)(3)(C) audit season, plan auditors may wish to consider
encouraging plan administrators that do not currently disclose the name(s) of the certifying institution(s) in
the notes to the plan financial statements to begin doing so. As discussed below, the DOL believes that
information is an integral part of the annual filing. If the plan administrator does not make such disclosure,
auditors may wish to consider including the information in their auditor's report.
ERISA generally requires plans with 100 or more participants to provide audited financial statements as
part of the annual report filed with the DOL. 29 CFR § 2520.103-1(b)(3) of the DOL's Rules and
Regulations for Reporting and Disclosure under ERISA requires that the notes to the audited financial
statements include disclosure of "any other matters necessary to fully and fairly present the financial
condition of the plan." Because the investment information included in plan financial statements subject to
an ERISA Section 103(a)(3)(C) audit is derived from information provided by the certifying entity, it is
important that the certifying institution meets the requirements in 29 CFR 2520.1038. As such, the DOL
EBSA has indicated that when the plan administrator elects an ERISA Section 103(a)(3)(C) audit, the
name(s) of the qualified institution(s) certifying the investment information is information necessary to fully
and fairly present the financial condition of the plan. The DOL has noted that frequently this information is
not included in the financial statement notes.
Paragraph 2.45 of the AICPA Audit and Accounting Guide, Employee Benefit Plans (EBP Guide), states
that it is important for the notes to the financial statements to clearly identify the certified investment
information, the names of the qualified certifying institutions, and periods covered. Paragraph C.08 of the
EBP Guide includes the following illustration of a disclosure that would generally be included in the notes
to the financial statements when plan management elects an ERISA Section 103(a)(3)(C) audit, which
includes the name of the certifying institution (Note: This illustration presumes that all investment
information has been certified. The note disclosure would need to be revised to identify the certified
investment information and periods covered when only a portion of the investment information is certified
or when there has been a change in trustee or custodian who is certifying the information):
M. Certified Investments
Certain information related to investments and notes receivable from participants disclosed in the
accompanying financial statements and ERISA-required supplemental schedule, including
investments and notes receivable from participants held at December 31, 20X1 and 20X0, and
net appreciation in fair value of investments, interest and dividends, and interest income on notes
receivable from participants for the year ended December 31, 20X1, was obtained by
management and agreed to or derived from information certified as complete and accurate by
DEF Trust Company (the trustee of the Plan).
While disclosure of the name(s) of the certifying institution(s) in the auditor's report is not required,
paragraph 14.66 of the EBP Guide suggests that if the notes to the financial statements do not identify
the names of the qualified certifying institutions and periods covered, then such information may be
included in the auditor's report.
11
The DOL's Office of Chief Accountant (OCA) has the responsibility for enforcing ERISA's reporting and
disclosure requirements. This includes ensuring that the Form 5500 filings are filed timely and correctly
and determining whether plan audits are performed in accordance with professional and regulatory
standards. In situations in which the name(s) of the certifying institution(s) is not included in the financial
statements or auditor’s report, the OCA will contact the plan administrator, requesting such information be
provided (i.e., a copy of the certification from the financial institution). If the plan administrator does not
provide the information in a timely manner, the OCA may initiate a formal enforcement process by
sending a Notice of Rejection (NOR) to the plan administrator. Upon receipt of a NOR, the plan
administrator has 45 days to make any necessary corrections to the Form 5500 filing (including providing
any requested information). If correction is achieved during the 45-day period of the NOR, the
enforcement case will be closed with no imposition of monetary civil penalty against the plan
administrator. However, If correction is not achieved within this period, the DOL may assess monetary
civil penalties from the day after the filing's original due date. If the filing is rejected for a reason other than
the missing disclosure related to the certifying institution but it is later discovered that the name of the
certifying institution is not disclosed, the plan administrator will not receive an additional 45 days to
correct the deficiency; DOL may assess penalties without providing additional notice.
ERISA section 103(a)(3)(C) audit for a plan that does not require an audit
The Department of Labor's (DOL) recent changes to Form 5500 redefined large plans by the number of
participants with account balances on the first day of the plan year. Per Form 5500, a plan with at least
100 participants with active accounts is considered a large plan and an audit is required. This provision
applies to defined contribution plans and is effective for plan years that begin on or after January 1, 2023.
Previously large plans with at least 100 eligible participants required an audit. The DOL estimates that
nearly 20,000 plans previously considered large plans will no longer be subject to the annual audit
requirement due to this change.
This change has led to situations in which plan sponsors have a plan that no longer requires an audit but
would like to have the plan audited as part of fulfilling its own fiduciary duties or for other reasons (e.g.,
the plan has an auto-enrollment feature and the plan sponsor believes the plan will soon require an
audit). Auditors have inquired as to whether an ERISA Section 103(a)(3)(C) audit can be performed if the
plan does not have an audit requirement.
In most cases, there does not appear to be anything in the professional standards, laws, or regulations
that would preclude an auditor from accepting such an engagement. An auditor may accept an ERISA
Section 103(a)(3)(C) audit engagement when no requirement for such audit exists, provided there is no
management-imposed scope limitation on the engagement, except as permitted by the DOL's Field
Assistance Bulletin No. 2009-02, Annual Reporting Requirements for 403(b) Plans.
Under the professional standards, an auditor is precluded from accepting an audit engagement if
management imposes a limitation on the scope of the auditor’s work, such that the auditor believes the
limitation will result in the auditor disclaiming an opinion on the financial statements, and the entity is not
required by law or regulation to have an audit.
AU-C section 210, Terms of an Engagement, paragraph .07 states:
If management or those charged with governance of an entity that it is not required by law or regulation to
have an audit impose a limitation on the scope of the auditor’s work in the terms of a proposed audit
engagement, such that the auditor believes the limitation will result in the auditor disclaiming an opinion
on the financial statements as a whole, the auditor should not accept such a limited engagement as an
audit engagement.
As explained in paragraph .A141-.A142 of AU-C section 703, an ERISA Section 103(a)(3)(C) audit is
unique to employee benefit plans and is not considered a scope limitation under AU-C section 705. As
such, an ERISA Section 103(a)(3)(C) audit may be performed, unless there is another reason the auditor
may know in advance in which management imposes a limitation on the scope of the auditor’s work that
12
will result in a disclaimer of opinion. For example, if the plan has not maintained sufficient accounting
records and supporting documentation and the auditor is unable to apply certain auditing procedures, the
auditor may need to disclaim an opinion on the ERISA plan financial statements and ERISA-required
supplemental schedules.
While the Department of Labor (DOL) has not issued formal, authoritative guidance, Michael Auerbach,
Chief Accountant, DOL Office of the Chief Accountant, did address the subject early in the May 10, 2023,
Employee Benefit Plan Town Hall session. Mr. Auerbach states that he does not see anything in the
regulations that would preclude a plan from having an ERISA Section 103(a)(3)(C) audit because such an
audit is not required.
DOL Compliance Assistance Release No. 2022-01
The DOL’s Employee Benefits Security Administration (EBSA) cautions plan fiduciaries to exercise
extreme care before they consider adding a cryptocurrency option to a 401(k) plan's investment menu for
plan participants.
At this early stage in the history of cryptocurrencies, the DOL has serious concerns about the prudence of
a fiduciary's decision to expose 401(k) plan participants to direct investments in cryptocurrencies, or other
products whose value is tied to cryptocurrencies. These investments present significant risks and
challenges to participants' retirement accounts, including significant risks of fraud, theft, and loss, for the
following reasons:
Speculative and Volatile Investments
The Challenge for Plan Participants to Make Informed Investment Decisions
Custodial and Recordkeeping Concerns
Valuation Concerns
Evolving Regulatory Environment
Click here for Compliance Assistance Release No. 2022-01, 401(k) Plan Investments in
“Cryptocurrencies”.
See the AICPA & CIMA Practice Aid, Accounting for and auditing of digital assets for nonauthoritative
guidance for auditing digital assets such as crypto-assets in the areas of risk assessment, processes and
controls, laws and regulations, and related parties.
Current environment additional audit
considerations
The following are other considerations in the current environment that auditors may want to consider.
Economic environment
When planning and performing an ERISA plan audit, it is important for the auditor to understand the
economic conditions facing the industry in which the plan sponsor operates as well as the effects of these
conditions on the plan. Economic activities relating to factors such as interest rates, availability of credit,
consumer confidence, overall economic expansion or contraction, inflation, and labor market conditions
are likely to have an effect on the audit of the plan’s financial statements.
Auditors may want to be alert for economic and business conditions and events that, when considered
individually or in the aggregate, indicate there could be a substantial negative effect on the plan’s financial
13
condition, including consideration of the plan’s or plan sponsor’s ability to continue as a going concern.
Some primary areas of concern given the current economic conditions may include:
Rising interest rates. A significant amount of U.S. corporate debt outstanding has floating interest
rates and trillions of dollars of derivatives exist which are based on interest rates. In addition,
rising interest rates can affect defined benefit pension plan funding status.
Stock market volatility. When stock markets decline, the value of pension assets also declines.
This may result in plan sponsors facing the prospect of additional required contributions to
underfunded pension plans. In addition, companies with underfunded pension plans face the risk
of defaulting on the debt they carry, which may result in a going-concern issue.
Bankruptcy of the plan sponsor after year-end that may affect the ability of the plan to continue as
a going concern.
The continuing trend of terminating defined benefit pension plans.
Persistent inflation, which threatens a key pillar of the U.S. economyconsumer spending.
Increasing consumer debt levels.
A softening housing boom in some markets.
Nondisclosure agreements
Before agreeing to provide access to personally identifiable information (PII), some third-party service
organizations require the plan administrator and auditor to sign confidentiality agreements or
nondisclosure agreements (NDAs), which place both the plan administrator and the plan auditor in a
difficult position. If the service organization does not provide the plan administrator with the information
requested by the auditor, it could adversely affect the plan’s ability to file the plan’s annual Form 5500.
Withholding such information could constitute a restriction on the scope of the audit and, therefore,
require a modification of the auditors’ opinion. When a disclaimer of opinion is issued, the DOL likely
would reject the filing, and the plan sponsor may be subject to substantial monetary penalties.
In addition, some NDAs include clauses that request the auditor to hold the client harmless, which could
contradict provisions in the engagement letter between the auditor and the plan administrator. The plan
administrator agrees to provide the auditor access to all books, records, and information necessary to
conduct its audit of the plan financial statements. If the service organization has the ability to withhold
plan records from the auditor, the auditor may not be able to rely on the plan administrator’s assertions
that the auditor has been provided access to all the books, records, and information necessary to fulfill
his or her responsibilities.
In some instances, auditors are required by law to make audit workpapers available for review by third
parties, making it impossible to comply with certain provisions of NDA agreements. However, auditors
already are subject to strict professional standards that require them to maintain confidentiality of
information obtained in the course of performing the audit, including proprietary information of the client
itself. In addition to strict professional requirements, auditors are subject to stringent security and privacy
provisions of the Health Insurance Portability and Accountability Act (HIPAA) when auditing health claims
during an audit of a health and welfare plan. Noncompliance with professional standards and/or HIPAA
could result in potentially severe consequences to the CPA, making an NDA unnecessary. The plan
auditor may suggest that the plan administrator instead consider establishing reasonable procedural
protections that provide practical alternatives to NDAs, including de-identifying and/or more carefully
identifying the data to be exchanged in the course of an audit, and discussing these alternatives with
service organizations.
Correcting delinquent participant contributions in a volatile market
In the current economic environment, some plan sponsors may be required to correct delinquent
participant contributions in defined contribution retirement plans while the market is experiencing losses.
The guidance below may assist plan sponsors in calculating excise taxes and lost earnings when plan
investments have declined in value. Following are the relevant DOL and IRS guidelines:
14
IRS excise tax rule
For purposes of calculating the prohibited transaction excise tax under IRC section 4975, the amount
involved if an employer does not timely pay the participant deferrals or contributions to a qualified plan is
based on interest on those elective deferrals. The interest rate is the IRC section 6621. See Rev. Rul.
2006-38. The IRC 6621 rate is the basis for the DOL calculator.
DOL Rule
Lost earnings are calculated based on the greater of the plan’s actual rate of return or the IRS section
6621 underpayment rate. See the “Acceptable Corrections” section of the Voluntary Fiduciary Correction
Program Fact Sheet, which states that VCFP applicants generally must:
Restore to the plan the principal amount involved, plus the greater of lost earnings, starting on the
date of the loss and extending to the recovery date, or profits resulting from the use of the
principal amount, starting on the date of the loss and extending to the date the profit is realized;
In this context, the profit is the interest on the use of the money, i.e., the 6621 underpayment rate
unless the DOL could identify a specific greater profit related to the late deposit.
Click here for the EBPAQC Primer, Timely remittance of employee contributions in defined contribution
retirement plans.
Plan amendments SECURE Act and CARES Act
On August 3, 2022, the IRS released Notice 2022-33, which extends the deadline for adopting any
SECURE Act plan amendments until December 31, 2025, to provide relief for plan sponsors waiting for
final IRS guidance on many of the SECURE Act’s provisions such as required post-death distribution
rules and rules governing the inclusion of long-term part-time employees. The IRS expects SECURE Act
guidance to be issued with the 2023 Required Amendments List. The Notice also extends the deadline for
the 2020 waiver in the CARES Act of required minimum distributions until December 31, 2025.
Note that these amendments can be retroactively adopted; therefore, the plan can implement the
amendments prior to amending the plan instrument. Similarly, plans may have voluntarily adopted
provisions under the CARES Act by placing them in operation without amending the plan as long as the
plan management makes the required amendments to plan documents by December 31, 2025.
As noted in AU-C section 703, the plan instrument is essential to understanding the plan and identifying
and performing audit procedures that are responsive to assessed risks. As such, the auditor is required to
obtain and read the most current plan instrument for the audit period, including effective amendments, as
part of obtaining an understanding of the entity sufficient to perform risk assessment procedures. The
auditor is also required to consider relevant plan provisions that affect the risk of material misstatement at
the relevant assertion level for classes of transactions, account balances, and disclosures when
designing and performing audit procedures. Because SECURE Act and CARES Act provisions may be
implemented before amending the plan instrument, it is important that auditors inquire whether any such
provisions were implemented during the year that are not yet reflected in the plan instrument.
SECURE Act provisions that may be voluntarily adopted and require the plan to be amended include:
increasing the cap on payroll contributions from 10 percent to 15 percent for automatic-enrollment
safe harbor plans (section 102);
allowing long-term part-time workers to participate in 401(k) plans (except in the case of
collectively bargained plans) (section 112);
allowing in-service withdrawals for childbirth and adoption expenses (section 113);
allowing retirees to delay taking required minimum distributions (RMDs) until age 72, up from the
current age of 70 1/2, for participants in 401(k) and other defined-contribution plans, defined-
benefit pension plans (section 114);
15
CARES Act provisions that may be voluntarily adopted and require the plan to be amended include:
allowing participants to take a coronavirus-related distribution (CRD) of up to $100,000 (not to
exceed the participant’s account balance) from their retirement plan without a 10% early
withdrawal penalty. Eligible distributions can be taken up to December 31, 2020. CRDs may be
repaid within three years. The plan management may rely on an employee's certification that the
employee satisfies the conditions for a CRD (section 2202. Special rules for use of retirement
funds);
allowing participants to borrow up to $100,000 from qualified plans an increase from $50,000
previously allowed under Internal Revenue Code section 72(p) for loans made from March 27,
2020 through September 22, 2020, and repayment can be delayed (section 2202. Special rules
for use of retirement funds);
allowing suspension of loan payment due March 27, 2020 through December 31, 2020 for up to
one year (section 2202(b)(2)); and
allowing suspension of 2020 required minimum distributions (section 2203).
Click here for full text of the CARES Act.
Partial plan terminations
Partial plan terminations may occur when there is substantial employer-initiated employee turnover, either
due to a significant event, such as a plant or division closing, or as a result of adverse economic
conditions or other events that are outside of the employer’s control. Furloughed employees do not count
in the turnover number unless they are subsequently laid off within the applicable period. A partial plan
termination may also be the result of plan amendments that adversely affect the rights of employees to
vest in benefits under the plan. Certain factual circumstances may affect the assessment of a partial plan
termination.
A partial plan termination may affect the plan’s financial statements; upon full or partial termination of a
plan, affected participants become fully vested in accrued benefits at the termination date.
In Revenue Ruling 2007-43, the IRS established that a 20% or greater turnover rate in the applicable
period (or impacted by an event) creates a rebuttable presumption that a partial plan termination
occurred. The determination of whether a partial plan termination has occurred is a legal matter,
depending on the facts and circumstances of the turnover rate. Plan sponsors should consult with their
ERISA legal counsel on whether their plan has been subject to a partial plan termination under the law
because the conditions are complicated.
Click here for IRS guidance on partial plan terminations.
Click here for the EBPAQC Plan Advisory on Partial plan terminations.
Audit evidence
Reliability of audit evidence. During the COVID pandemic, accessing client books and records may have
presented hurdles for auditors. This challenge persists as plan sponsors and service providers
experience low employee retention rates. Auditors may be able to obtain clientprepared copies or scans
of key records, but auditors need to consider the authenticity and reliability of those records and perhaps
perform additional audit procedures to be satisfied that those records are complete, accurate, and
authentic.
Click here for EBPAQC Primer, Audit evidence in an employee benefit plan.
16
SOC 1 reports
It is becoming increasingly more common for SOC 1 reports to include a modified service auditor’s report,
carve-outs, or unusual wording. The archived EBPAQC webcast on Using SOC 1 reports in EBP audits,
covers the basics of SOC 1 reports, independent service auditor opinions, including the nature and
impact of modifications, carve-outs, the evaluation of a SOC report, complementary user entity controls,
and other issues. In addition, the EBPAQC is offering a live webcast, Effective Use of SOC 1 Reports in
EBP Audits, on Tuesday, May 21, 2024, which will incorporate SAS No. 145 considerations.
Click here to register for the Paid CPE credit option May 21, 2024, live webcast (2 CPE hours).
Click here to register for the Free No-CPE credit option May 21, 2024, live webcast (no CPE credit
hours).
Actuarial mortality improvement update
The Society of Actuaries’ Retirement Plans Experience Committee (SOA RPEC) RPEC 2023 Mortality
Improvement Update was released in October 2023. This report is used for the development of mortality
improvement assumptions for measuring obligations of retirement programs in the United States.
The most recent SOA RPEC Mortality Improvement Scale MP-2021 was released in October 2021. The
SOA RPEC does not believe it would be appropriate to incorporate, without adjustment, the substantially
higher rates of mortality experienced from 2020 into the graduation and projection models used to
forecast future mortality. Therefore, they have elected not to release a new mortality improvement scale
for 2023.
AICPA Technical Questions and Answers TIS 3700.01, Pension Obligations, discusses the effect of new
mortality tables on nongovernmental employee benefit plans and nongovernmental entities that sponsor
plans. Click here for TIS 3700, Pension Obligations.
Examples of financial statement disclosures
It is important for employee benefit plan financial statement auditors to consider whether plan
management has properly disclosed market volatility and other matters that should be included in the
plan's financial statements. EBP financial statement note disclosures need to be tailored to each
individual plan for any plan changes or amendments that have been made, including a plan freeze or
partial or full termination; circumstances at the plan sponsor (financial position, ability to fund the plan
currently and in the future, etc.); potential market volatility; and other factors.
DOL EDGAR search tool for Form 5500 filings
The DOL’s Employee Benefits Security Administration (EBSA) has a search tool for Form 5500 filings in
which users can search for filings using filters including plan type, plan asset value, number of
participants, employer plan types, business codes, form years, and locations. Form 5500 filings with the
DOL since January 2010 are available in the search tool. The Form 5500 search tool is available at:
https://5500search.dol.gov.
SEC Form 11-K search tool for plan financial statement filings
The SEC Form 11-K Employee Stock Plan Annual Report database for annual report filings of employee
stock purchase, savings and similar plans is an excellent source for example financial statement
presentation and related note disclosures for employee benefit plans. (Note that these financial
statements may contain some disclosures that are not necessary for non-SEC plans; however, for the
17
purposes discussed here, this can be a useful tool.) Utilize the "Search Full-Text of Form 11-K" search
page and enter "market volatility” or other text into the "Search for Text" field. This will result in a listing of
SEC Form 11-K plan filings with related disclosures. Click here for the SEC Form 11-K Employee Stock
Plan Annual Report database.
Pooled employer plans (PEPs)
A PEP is type of multiple employer plan, allowed under the SECURE Act, in which unrelated employers
may participate and which is established by a pooled plan provider (PPP). Plans that satisfy the PEP
requirements are characterized as open multiple employer plans and are treated as a single plan for
purposes of satisfying the requirements of ERISA. It is important to note that the SECURE Act
did not establish a new audit threshold for PEPs. Rather, section 101 of the SECURE Act amended
ERISA section 104(a)(2)(A) to permit the Secretary of Labor to prescribe by regulation simplified reporting
for MEPs subject to ERISA section 210(a) with fewer than 1,000 participants in total, as long as each
participating employer has fewer than 100 participants. The DOL is not currently proposing to amend the
current reporting rules to establish a “simplified report” for such plans. As such, PEPs that have 100
participants or more generally are required to have an annual financial statement audit.
This is the second year that PEPs have been in existence, and auditors continue to work through PEP
reporting and auditing issues. The EBPAQC developed a resource, Pooled employer plans (PEPs)
special considerations, to assist in understanding PEPs and potential complexities for auditors to consider
in determining whether to accept a PEP financial statement audit engagement. See also the IRS
proposed regulations implementing exception to “one bad apple” rulediscussion in the Legislative and
regulatory developments section of this document for additional considerations.
Click here for the EBPAQC resource, Pooled employer plans (PEPs) special considerations.
Clients and auditors may have questions regarding PEP audit engagement acceptance and
independence. The AICPA Professional Ethics staff updated the Frequently Asked Questions: Application
of the independence rules to affiliates of employee benefit plans concluding that a PPP is an affiliate of a
PEP (and vice-versa). Participating employers would not be considered an affiliate of the PEP. However,
if a firm auditing the PEP is providing non-attest services to a participating employer, the firm would need
to consider the threats and safeguards to independence under the AICPA Conceptual Framework for
Independence.
Click here for the AICPA Professional Ethics staff Frequently Asked Questions: Application of the
independence rules to affiliates of employee benefit plans.
On the horizon
Auditing standards
Upcoming auditing standards and guidance implementation dates include:
SAS No. 146, Quality Management for an Engagement Conducted in Accordance with Generally
Accepted Auditing Standards, is effective for engagements conducted in accordance with GAAS for
periods beginning on or after December 15, 2025.
SAS No. 149, Special Considerations Audits of Group Financial Statements (Including the Work of
Component Auditors and Audits of Referred-to Auditors, is effective for audits of financial statements for
periods ending on or after December 15, 2026.
18
Additional resources
AICPA resources and Journal of Accountancy articles
AICPA resource center, Climate & Sustainability/ESG
AICPA resource center, Noncompliance with laws and regulations what you need to know
AICPA Practice Aid, Use of Technology in an Audit of Financial Statements
AICPA Auditing Standards Board Auditing Interpretation No. 1, Considerations Related to the Use of a
SOC 2
®
Report in an Audit of a User Entity’s Financial Statements
AICPA decision tree and flowchart, When does AR-C section 70 apply?: A guide for practitioners who
prepare financial statements for their clients
New audit evidence standard recognizes evolving nature of business (July 9, 2020) by Ken Tysiac
A take on cryptoasset transactions, investments, and risk (September 1, 2021) by Mark D. Mishler, CPA
New EBPAQC resources and tools
The EBPAQC issued the following tools and resources over the last year:
EBPAQC primer, Actuarial methods and assumptions used in measuring plan benefit obligations
in health and welfare benefit plans.
EBPAQC non-authoritative practice aid, Form 5500 considerations for auditors.
EBPAQC primer, Audit evidence in an employee benefit plan.
EBPAQC matrix, Common sources of audit evidence used in testing investment valuations.
EBPAQC non-authoritative tool, Employee benefit plan audit engagement acceptance and
continuance considerations.
EBPAQC non-authoritative tool, Examples of written auditor communications for employee
benefit plan audits.
EBPAQC non-authoritative resource, SECURE 2.0 Act of 2022 considerations for auditors.
An EBPAQC tool for audit evidence by audit area is currently being developed and will be announced in a
future EBPAQC Alert.
2024 EBPAQC webcast calendar
Click here for the EBPAQC web event calendar for January through November 2024, including dates and
times, registration links, and Outlook links to hold the time on your calendar.
DISCLAIMER: This publication has not been approved, disapproved or otherwise acted upon by any
senior technical committees of, and does not represent an official position of the American Institute of
Certified Public Accountants. It is distributed with the understanding that the AICPA Employee Benefit
Plan Audit Quality Center is not rendering legal, accounting or other professional services in this
publication. The application and impact of laws can vary widely based on the specific facts involved. If
legal advice or other expert assistance is required, the services of a competent professional should be
sought.