21.2 Conflicts of Interest (Precept 7), Confidentiality (Precept 9) & Work Product Control (Precept 10)
Key Takeaways
- Precept 7 strictly prohibits performing professional services where an actual or potential conflict of interest impairs objectivity, unless a rigorous 3-prong exception is satisfied: reasonable belief of unimpaired objectivity, full written disclosure to all affected principals, and express written consent.
- Precept 8 mandates complete written disclosure of all direct and indirect compensation, referral fees, 12b-1 fees, and revenue-sharing arrangements related to professional services.
- Precept 9 establishes a strict duty of confidentiality covering participant census information, Social Security numbers, and employer financials; disclosures are permitted only upon client consent, court order/subpoena, or ARA disciplinary proceedings.
- ERISA cybersecurity guidance from the Department of Labor requires administrators to implement robust data security measures (encryption, multi-factor authentication, vendor assessments) to safeguard confidential participant data.
- Precept 10 requires members to take reasonable steps to prevent clients or third parties from misusing, altering, or cherry-picking their work products to mislead regulators or violate pension laws.
21.2 Conflicts of Interest (Precept 7), Confidentiality (Precept 9) & Work Product Control (Precept 10)
[!NOTE] Ethics in Operational Practice In the daily administration of 401(k) plans, administrators frequently encounter situations where commercial incentives collide with professional duties. A payroll vendor offers a lucrative revenue-sharing rebate; an affiliated wealth management firm requests participant census records to market retail IRAs; or a plan sponsor pressures the administrator to remove a failed nondiscrimination test from the annual compliance binder. Navigating these pressure points requires mastery of Precepts 7, 8, 9, and 10 of the ASPPA Code of Professional Conduct.
Precept 7: Conflicts of Interest
Precept 7: An ASPPA member shall not perform Professional Services when the member's ability to act objectively is impaired, or where a reasonable person with knowledge of all the relevant facts would conclude that the member's ability to act objectively is impaired by an actual or potential conflict of interest, unless the conflict is properly disclosed and consented to.
Objectivity is the foundational benchmark of professional administration. When a conflict of interest exists, the administrator's judgment may become subtly or overtly compromised.
Actual vs. Potential Conflicts
- Actual Conflict: Occurs when a member's current obligations to one principal directly clash with obligations to another principal, or with the member's own financial interests. Example: A TPA also operates an investment advisory branch that receives commissions when recommending specific proprietary funds for a client's 401(k) lineup.
- Potential Conflict: Occurs when an existing relationship or financial interest could foreseeably develop into an actual clash of loyalties in the future. Example: Administering plans for two direct business competitors who are negotiating an adversarial merger.
The "Reasonable Person" Standard
Notice the objective legal threshold embedded in Precept 7: the test is not merely whether the member subjectively believes they can remain fair. It is whether a reasonable person with knowledge of all relevant facts would conclude that the member's objectivity is compromised.
+---------------------------------------------------------------------------------------------------+
| THE THREE-PRONG MANDATORY TEST FOR CONFLICT WAIVERS (PRECEPT 7) |
+---------------------------------------------------------------------------------------------------+
| |
| To perform services involving an actual or potential conflict, ALL THREE PRONGS MUST BE MET: |
| |
| [ PRONG 1: REASONABLE BELIEF OF UNIMPAIRED OBJECTIVITY ] |
| • The member must genuinely and reasonably believe that their professional objectivity and |
| impartiality will not be compromised by the dual relationship or financial interest. |
| |
| [ PRONG 2: FULL WRITTEN DISCLOSURE ] |
| • The member must provide a comprehensive, detailed written disclosure of the conflict, |
| identifying all financial interests, relationships, and potential risks, to ALL affected |
| principals. Oral disclosure is NEVER sufficient! |
| |
| [ PRONG 3: EXPRESS WRITTEN CONSENT ] |
| • ALL affected principals must explicitly provide informed written consent permitting the |
| member to proceed. Tacit, implied, or oral consent violates Precept 7! |
| |
+---------------------------------------------------------------------------------------------------+
Non-Consentable Conflicts
Certain conflicts are so severe that no reasonable person could conclude objectivity remains intact. In such situations, client consent is legally and ethically ineffective:
- Representing both the employer and the plan participants in an adversarial lawsuit regarding unpaid contributions;
- Performing compliance testing on a plan where the administrator is personally accused of embezzling participant funds.
Precept 8: Disclosure of Compensation
Precept 8: An ASPPA member shall disclose to each principal in writing all sources of direct and indirect compensation, referral fees, commissions, or finder's fees received or expected to be received in connection with the performance of Professional Services for that principal.
Precept 8 reinforces federal fee disclosure initiatives under ERISA §408(b)(2). In retirement administration, fee opacity breeds self-dealing.
Categories of Mandatory Compensation Disclosure:
- Direct Compensation: Fees billed directly to the plan sponsor or deducted from plan trust assets (e.g., base administration fees, per-participant charges, Form 5500 preparation fees, loan setup fees).
- Indirect Compensation: Fees received from third-party sources other than the client, including:
- 12b-1 Mutual Fund Distribution Fees: Trailing commissions paid by mutual fund companies based on plan asset balances;
- Shareholder Servicing & Sub-Transfer Agency (Sub-TA) Fees: Payments made by investment managers to recordkeepers for maintaining participant-level sub-accounts;
- Float Income: Interest earned on plan contribution checks or distribution disbursements during clearing periods;
- Vendor Referral Fees: Kickbacks, rebates, or finder's fees received from payroll providers, custodians, or audit firms.
[!IMPORTANT] Written Disclosure is Non-Negotiable: Indirect compensation or revenue-sharing cannot be buried in vague boilerplate disclaimers. Precept 8 demands clear, upfront, written disclosure detailing the formula, dollar amounts, and paying entities before the services are performed.
Precept 9: Confidentiality & Participant Data Protection
Precept 9: An ASPPA member shall not disclose to another party any confidential information obtained through professional assignments unless authorized to do so by the principal or required to do so by law or in connection with an ARA disciplinary proceeding.
Third-party administrators hold the "keys to the kingdom" regarding personal sensitive data. A standard 401(k) annual census file contains:
- Full legal names and residential addresses;
- Social Security numbers (SSNs);
- Exact dates of birth and hire dates;
- Total W-2 and gross compensation data;
- Pre-tax, Roth, and after-tax contribution elections;
- Cumulative participant account balances and outstanding loan balances.
The Scope of Confidentiality
Confidentiality under Precept 9 encompasses all non-public information obtained during an engagement. This duty survives the termination of the client engagement indefinitely. A practitioner cannot use past client census data for academic research, marketing lists, or cross-selling without explicit authorization.
Narrow Permissible Exceptions Under Precept 9:
- Authorized by the Principal: The client provides explicit, informed consent (e.g., the plan sponsor instructs the TPA to send census files to an independent CPA firm for the annual Form 5500 audit).
- Required by Law: The member is compelled by a valid judicial court order or enforceable regulatory subpoena issued by the IRS, DOL (EBSA), PBGC, or a federal grand jury. (A mere informal request from an attorney does not override confidentiality without a subpoena or client consent).
- ARA Disciplinary Proceedings: Responding to official inquiries, complaints, or evidentiary requests from the ARA Disciplinary Committee or Hearing Board.
ERISA Cybersecurity Best Practices
In recent years, the Department of Labor issued comprehensive Cybersecurity Program Best Practices for retirement plan service providers. Under Precept 9 and Precept 3, administrators must maintain rigorous technical safeguards:
+---------------------------------------------------------------------------------------------------+
| TPA CYBERSECURITY DATA SAFEGUARD PROTOCOLS |
+---------------------------------------------------------------------------------------------------+
| |
| • End-to-End Encryption: All census files containing SSNs must be encrypted at rest and in |
| transit using enterprise-grade protocols (AES-256). Emailing unencrypted spreadsheets is |
| a gross administrative violation. |
| • Multi-Factor Authentication (MFA): Mandatory MFA on all portal access points for plan |
| sponsors, participants, and administrative personnel. |
| • Annual Independent Security Audits: SOC 2 Type II compliance reviews verifying data hygiene. |
| • Secure Destruction: Purging participant PII and census records in compliance with document |
| retention schedules using cryptographic or physical shredding standards. |
| |
+---------------------------------------------------------------------------------------------------+
Precept 10: Control of Work Product
Precept 10: An ASPPA member shall take reasonable steps to ensure that the member's work product is not used by the client or third parties to mislead, misrepresent, or violate pension laws. If a member becomes aware that a work product is being misused, the member shall take reasonable steps to correct the misrepresentation.
Administrators frequently generate draft compliance models, preliminary testing scenarios, and hypothetical tax projections. A dangerous ethical dilemma occurs when a client takes an incomplete or preliminary analysis and presents it as a definitive, passed test to an auditor, bank, or participant committee.
The "Preliminary Testing" Dilemma
Suppose an administrator runs a preliminary ADP test in November showing a 3.5% failure that will require $28,000 in refunds to HCEs. The corporate CFO asks for an "illustrative run" showing what happens if three highly paid executives are excluded from the test. The administrator produces the illustrative run, labeling it "Hypothetical Run Only." In March, the administrator discovers the CFO submitted that hypothetical run to the company's independent auditor as the final passing ADP test!
Action Mandates Under Precept 10:
- Preventive Labeling: Every preliminary, draft, or illustrative work product must bear unambiguous watermarks and header text: "DRAFT / PRELIMINARY RUN — NOT FOR FILING — RELIES ON HYPOTHETICAL ASSUMPTIONS."
- Immediate Demand for Correction: When a member learns that a client or third party is misusing their work product, the member must formally demand in writing that the client cease the misrepresentation and provide the true report to all relying parties.
- Direct Clarification: If the client refuses to correct the misrepresentation, the member must take reasonable affirmative steps to prevent fraud, which may include notifying the affected parties (such as the independent auditor) that the work product was unauthorized or invalid.
- Mandatory Withdrawal: If the client persists in fraudulent misuse, the member must resign from the engagement.
Real-World Ethical Dilemmas
Dilemma 1: The Undisclosed Custodial Rebate
Horizon Plan Consultants administers 150 401(k) plans. Horizon enters into an agreement with a mutual fund clearinghouse under which the clearinghouse pays Horizon a 0.15% (15 basis points) annual shareholder servicing fee on all client assets held in proprietary funds. Horizon does not disclose this revenue to its plan sponsor clients, reasoning that "the fees are paid by the fund company from its own profits, so the clients are not paying higher administrative bills."
- Ethical Analysis: Horizon's conduct directly violates Precept 8 (failure to disclose indirect compensation in writing) and Precept 7 (undisclosed conflict of interest). The receipt of third-party payments creates an incentive to steer plan sponsors toward funds that maximize Horizon's revenue. Horizon must provide written disclosure and obtain client consent.
Dilemma 2: The Wealth Management Cross-Sell
A commercial TPA is affiliated with a retail wealth management firm. When participants terminate employment and request distribution forms, the TPA's distribution packet includes a mandatory form requesting the participant's personal phone number, private email address, and home address, which is automatically funneled to wealth advisors to solicit retail IRA rollovers.
- Ethical Analysis: This practice violates Precept 9 (unauthorized disclosure of confidential participant data) and Precept 7 (conflict of interest). Participant census information obtained for plan administration cannot be mined for commercial cross-selling without explicit, informed participant consent.
Common ASPPA QKA Exam Traps
- Exam Trap 1: Oral Disclosures of Conflicts: Questions describe a consultant who sits down with an employer over lunch, verbally explains a potential conflict of interest, and receives an oral "no problem!" from the owner. Under Precept 7, conflict disclosure and client consent must both be in writing.
- Exam Trap 2: Subpoena vs. Attorney Request: An attorney representing a participant in a divorce dispute calls the TPA and demands the participant's account records. The TPA complies, claiming "legal requests are exempt from confidentiality." Under Precept 9, informal attorney inquiries do not waive confidentiality. A formal judicial subpoena, court order, or signed client authorization is legally required.
- Exam Trap 3: Believing Precept 10 Responsibility Ends at Delivery: Candidates often think that once a report is delivered to the client, the administrator is free of liability if the client misrepresents the numbers. Under Precept 10, if an administrator discovers that a client is using their work product to mislead regulators, the administrator has an affirmative ongoing duty to demand correction and take reasonable remedial steps.
- Exam Trap 4: Treating Indirect Revenue as Non-Compensatory: A question states that a recordkeeper receives 10 basis points in sub-TA fees from mutual funds and asks whether disclosure is required since the employer's invoice was not increased. Under Precept 8, all direct and indirect compensation must be disclosed in writing.
A third-party administrator is asked to provide administrative services to a 401(k) plan sponsored by a manufacturing company. The TPA also owns a 25% equity interest in a payroll processing software firm that the manufacturing company intends to hire as the plan's payroll integration vendor. Under Precept 7 of the ASPPA Code of Professional Conduct, which of the following conditions MUST be met before the TPA can perform services for the plan?
An investigator from the Department of Labor's Employee Benefits Security Administration (EBSA) serves a formal administrative subpoena duces tecum on a TPA firm, demanding complete participant census files, payroll records, and compliance testing logs for a client's 401(k) plan. The plan sponsor demands that the TPA refuse to surrender the documents, citing client confidentiality. Under Precept 9 of the ASPPA Code, what is the TPA's professional obligation?
An administrator prepares an illustrative, hypothetical compliance model for an employer showing what the plan's ADP test would look like if the employer made an optional 3% QNEC. The report is clearly marked 'Hypothetical Draft.' Three months later, the administrator discovers that the employer submitted this draft report to the plan's independent auditor, misrepresenting it as the final, passed ADP test. Under Precept 10 of the ASPPA Code, what action must the administrator take?