9.1 Benefit Audits, Compliance Reviews & Correction Programs

Benefit Audits, Compliance Reviews & Correction Programs

Quick Answer: Under ERISA §103(a)(3)(A), employee benefit plans covering 100 or more eligible participants on the first day of the plan year must undergo an annual independent financial statement audit conducted by an Independent Qualified Public Accountant (IQPA). Audits follow FASB Accounting Standards Codification (ASC 960 for defined benefit, ASC 962 for defined contribution, and ASC 965 for health and welfare plans) and AICPA SAS No. 136 (AU-C Section 703). When operational, documentary, or fiduciary compliance failures occur, fiduciaries must navigate voluntary correction frameworks: the IRS Employee Plans Compliance Resolution System (EPCRS) for tax-qualification defects, the DOL Voluntary Fiduciary Correction Program (VFCP) for 19 specific fiduciary breaches, and the Delinquent Filer Voluntary Compliance Program (DFVCP) for late Form 5500 filings.

---

1. Independent CPA Financial Statement Audits Under ERISA

Under Title I of the Employee Retirement Income Security Act of 1974 (ERISA), plan sponsors have a fiduciary obligation to maintain complete and accurate financial records. For "large plans," ERISA §103(a)(3)(A) mandates that the plan administrator engage an Independent Qualified Public Accountant (IQPA) to audit the financial statements and supplemental schedules attached to the annual Form 5500 filing.

┌────────────────────────────────────────────────────────────────────────┐
│                     THE ERISA LARGE PLAN AUDIT THRESHOLD               │
├───────────────────────────────────┬────────────────────────────────────┤
│ General Rule (100+ Participants)  │ Plans with ≥100 eligible partici-  │
│                                   │ pants on Day 1 of the plan year    │
├───────────────────────────────────┼────────────────────────────────────┤
│ 80–120 Transition Rule            │ Plans with 80–120 participants at  │
│                                   │ beginning of year may file in the  │
│                                   │ same category (small/large) as the │
│                                   │ prior year Form 5500 filing        │
├───────────────────────────────────┼────────────────────────────────────┤
│ Form 5500 Modernization (DC Plans)│ For plan years starting 2023+, DC  │
│                                   │ participant count is based only on │
│                                   │ participants with account balances │
└───────────────────────────────────┴────────────────────────────────────┘

A. Accounting Standards Codification (ASC) Framework

The Financial Accounting Standards Board (FASB) establishes the Generally Accepted Accounting Principles (GAAP) specific to employee benefit plans through three dedicated codification topics:

1. FASB ASC 960 (Defined Benefit Pension Plans):

   • Governs defined benefit retirement trusts.
   • Requires financial statements to reflect the Net Assets Available for Benefits at fair value (investments, cash, receivables) and presents the Actuarial Present Value of Accumulated Plan Benefits (vested and non-vested obligations based on historical service and compensation).
   • Highlights the funded status of the pension obligation and actuarial assumptions (discount rate, mortality tables, turnover).

2. FASB ASC 962 (Defined Contribution Retirement Plans):

   • Governs 401(k), 403(b), profit-sharing, money purchase, and Employee Stock Ownership Plans (ESOPs).
   • Requires presentation of net assets available for benefits, changes in net assets, participant-directed vs. non-participant directed investment allocations, contribution receivables from employers and employees, and notes disclosing plan merger or participant loan mechanics.

3. FASB ASC 965 (Health and Welfare Benefit Plans):

   • Governs self-funded and insured health, dental, disability, life, and severance trusts (Voluntary Employees' Beneficiary Associations under IRC §501(c)(9)).
   • Requires accounting for Benefit Obligations, including claims payable, Incurred But Not Reported (IBNR) claims reserves, accumulated eligibility credits, and post-retirement health benefit obligations (under FASB ASC 715).

B. Full-Scope Audits vs. ERISA Section 103(a)(3)(C) Audits (SAS No. 136)

Historically, plan sponsors could elect a "limited-scope audit" under ERISA §103(a)(3)(C), where the independent auditor did not perform audit procedures on investment assets certified by a regulated financial institution. However, the AICPA issued Statement on Auditing Standards (SAS) No. 136, Forming an Opinion and Reporting on Financial Statements of Employee Benefit Plans Subject to ERISA (codified in AU-C Section 703), which fundamentally restructured these engagements:

---

2. Regulatory Compliance Investigations & Examinations

Benefit plans are subject to dual federal regulatory scrutiny from the Department of Labor and the Internal Revenue Service, each operating under separate statutory mandates and enforcement mechanisms.

A. DOL Employee Benefits Security Administration (EBSA) Investigations

EBSA enforces Title I of ERISA, focusing on protecting participant rights, ensuring retirement and health benefit security, and holding plan fiduciaries accountable to the standards of prudence and loyalty (ERISA §404).

• Primary Focus Areas:
  • Timely Remittance of Participant Contributions: Enforcing strict segregation of salary deferrals and loan repayments from employer operating funds. Under DOL regulations, deferrals must be deposited into the plan trust as soon as they can be reasonably segregated from general assets, but no later than the 15th business day of the following month for large plans, or within the 7-business-day safe harbor for small plans (<100 participants).
  • Fiduciary Prohibited Transactions: Investigating party-in-interest transactions (ERISA §406) and conflicts of interest.
  • Fee Transparency & Revenue Sharing: Reviewing compliance with service provider disclosure mandates under ERISA §408(b)(2) and participant disclosures under §404(a)(5).
  • Health Plan Mandates: Investigating compliance with the Mental Health Parity and Addiction Equity Act (MHPAEA), ACA market reforms, and No Surprises Act balance billing protections.
• Enforcement Powers: EBSA investigators possess subpoena power, can compel restitution of lost plan earnings, demand removal of fiduciaries, and assess mandatory civil penalties under ERISA §502(l)—which imposes a mandatory 20% penalty on any applicable recovery amount paid pursuant to a settlement agreement or court order.

B. IRS Employee Plans (EP) Examinations

The IRS focuses on plan qualification requirements under the Internal Revenue Code (IRC §401(a)) to ensure tax-deferred status is preserved legitimately.

• Primary Focus Areas:
  • Nondiscrimination Testing: Reviewing Actual Deferral Percentage (ADP) and Actual Contribution Percentage (ACP) tests under IRC §401(k)/(m), minimum coverage under §410(b), and general nondiscrimination under §401(a)(4).
  • Statutory Limits: Ensuring compliance with annual additions limits under IRC §415(c), elective deferral caps under §402(g), and compensation limits under §401(a)(17).
  • Top-Heavy Compliance & Vesting: Adherence to top-heavy minimum contribution schedules (IRC §416) and statutory vesting rules (IRC §411).
  • Required Minimum Distributions (RMDs): Timely distribution of mandatory benefits under IRC §401(a)(9).
• Audit Consequences: If disqualifying operational or documentary defects are uncovered on audit, the IRS may seek full plan disqualification (immediate taxation of the trust, loss of employer deductions, and retroactive participant taxation) unless resolved under the Audit Closing Agreement Program (Audit CAP).

---

3. IRS Employee Plans Compliance Resolution System (EPCRS)

Governed by Revenue Procedure 2021-30 and significantly expanded by the SECURE 2.0 Act of 2022 (§305), the EPCRS framework enables plan sponsors to correct document and operational qualification failures and avoid plan disqualification.

┌────────────────────────────────────────────────────────────────────────┐
│                     IRS EPCRS CORRECTION STREAMS                       │
├────────────────────────────────────────────────────────────────────────┤
│ 1. SELF-CORRECTION PROGRAM (SCP)                                       │
│    • Operational & certain document failures                           │
│    • No IRS notification, no user fee, no compliance statement         │
│    • Insignificant failures: Correctable anytime (even under audit)    │
│    • Significant failures: SECURE 2.0 allows indefinite self-          │
│      correction of eligible inadvertent failures                       │
├────────────────────────────────────────────────────────────────────────┤
│ 2. VOLUNTARY CORRECTION PROGRAM (VCP)                                  │
│    • Operational, document, and demographic failures                   │
│    • Plan NOT under examination; formal Pay.gov filing & user fee      │
│    • Results in formal, legally binding IRS Compliance Statement       │
├────────────────────────────────────────────────────────────────────────┤
│ 3. AUDIT CLOSING AGREEMENT PROGRAM (AUDIT CAP)                         │
│    • Failures discovered during IRS examination                        │
│    • Requires full retroactive correction + negotiated monetary        │
│      sanction based on Maximum Payment Amount (MPA)                    │
└────────────────────────────────────────────────────────────────────────┘

A. Self-Correction Program (SCP)

• Eligibility: Available to plan sponsors with established administrative practices and internal controls designed to maintain operational compliance.
• Insignificant Operational Failures: Can be self-corrected at any time, even if the plan or plan sponsor is under an active IRS examination.
• Significant Operational Failures: Historically required correction within a three-year period following the plan year of failure. Under SECURE 2.0 (§305), the self-correction window was expanded to allow indefinite self-correction of eligible inadvertent failures (operational failures, loan errors, and certain document failures) provided correction is completed within a reasonable period after discovery and before the IRS identifies the issue on audit.
• Correction Methodology: Must place participants in the financial position they would have occupied had the failure not occurred (e.g., contributing missed employer matching contributions adjusted for lost earnings).

B. Voluntary Correction Program (VCP)

• Eligibility: Plan sponsors can submit failures to the IRS provided the plan is not under examination.
• Filing Process: Electronic submission via Pay.gov using Form 8950 and Form 8951, providing a detailed narrative of the failures, root-cause analysis, proposed correction method, and administrative procedural updates.
• User Fees: Fixed statutory user fees based on the total value of plan assets (e.g., $1,500 for assets under $500,000; $3,000 for assets between $500,000 and $10 million; $3,500 for assets over $10 million).
• Compliance Statement: Upon approval, the IRS issues a formal Compliance Statement. If the sponsor completes corrections within the 150-day implementation window, the IRS agrees not to disqualify the plan based on the disclosed defects.

C. Audit Closing Agreement Program (Audit CAP)

• Application: Applies when qualification defects are discovered during an active IRS examination.
• Sanction Mechanics: The plan sponsor must fully correct all failures, update internal operating controls, and execute a formal closing agreement with a negotiated monetary sanction. The sanction is derived from the Maximum Payment Amount (MPA)—the total potential tax liability resulting from trust taxation, disallowed employer deductions, and participant income inclusions—negotiated downward based on the severity of the failure, compliance history, and good-faith cooperation.

---

4. DOL Voluntary Correction Programs: VFCP & DFVCP

While EPCRS handles tax-qualification issues with the IRS, the Department of Labor provides two dedicated voluntary correction programs to resolve Title I fiduciary breaches and reporting deficiencies.

A. Voluntary Fiduciary Correction Program (VFCP)

The VFCP encourages plan fiduciaries to self-identify, calculate, and voluntarily correct specific fiduciary breaches under ERISA §404 and §406.

• 19 Eligible Transactions: Covers specific categories, including:
  1. Delinquent participant contributions or loan repayments to retirement or welfare plans.
  2. Fair market value sales or purchases of assets between the plan and a party in interest.
  3. Impermissible participant loans or below-market loans to parties in interest.
  4. Payment of excessive service provider administrative fees or improper plan expenses.
  5. Benefit underpayments resulting from miscalculated vesting or compensation data.
• Restoration of Lost Earnings: The plan sponsor must restore all principal losses plus interest. Fiduciaries must utilize the online DOL VFCP Online Calculator, which calculates lost earnings based on the higher of the plan's actual rate of return or the statutory IRS underpayment rate under IRC §6621.
• Incentives & Relief: Upon approved filing and restitution, the DOL issues a formal No-Action Letter, guaranteeing no civil enforcement action will be brought. It also provides automatic exemption from mandatory ERISA §502(l) 20% civil penalties and relief from IRS IRC §4975 excise taxes for eligible transactions under Prohibited Transaction Exemption (PTE 2002-51).

B. Delinquent Filer Voluntary Compliance Program (DFVCP)

Under ERISA §502(c)(2), the DOL can assess statutory civil penalties of up to $2,586+ per day (adjusted annually for inflation) on plan administrators who fail to timely file annual Form 5500 / 5500-SF reports. The DFVCP provides an official mechanism for late filers to voluntarily file delinquent annual reports and pay substantially reduced, capped penalties.

To participate in DFVCP, the plan administrator must electronically submit the delinquent Form 5500 via the DOL EFAST2 filing system, check the DFVCP indicator box, and remit the applicable capped payment through the DOL online penalty payment portal. Importantly, DFVCP relief is only accessible before the plan administrator is notified in writing by the DOL of a failure to file.