401(k) Audit Checklist for Plan Sponsors

Before the audit starts

The best thing you can do for your audit is prepare early. Most delays happen because documents aren't ready when the auditor needs them. If you can gather everything on this list before your auditor sends their formal request, you'll be ahead of the game.

Plan documents

• Current plan document (base document and all adoption agreements)
• All amendments adopted during the plan year
• Summary Plan Description (SPD) and any Summary of Material Modifications (SMM)
• IRS determination or opinion letter
• Trust agreement (if separate from plan document)
• Service agreements with recordkeeper, TPA, and investment advisors

Financial records

• Trust/custodial statements — all quarterly and annual statements for the plan year
• Year-end trust statement showing all asset balances
• Investment earnings and fee disclosures (408(b)(2) and 404a-5 notices)
• Bank statements for any plan checking accounts
• Fidelity bond certificate (ERISA requires coverage of at least 10% of plan assets, up to $500,000)

Payroll and contribution data

• Payroll register or summary showing gross pay, eligible compensation, and deferrals for each participant by pay period
• Employee deferral election forms or system records showing deferral percentage changes
• Employer contribution calculation worksheet (match, profit sharing, safe harbor)
• Proof of contribution deposit dates (wire confirmations or bank records showing when contributions were remitted to the trust)
• Year-end W-2 file or compensation summary

Participant data

• Complete participant census: name, date of birth, date of hire, date of termination (if applicable), hours worked, eligible compensation
• Enrollment records for new participants during the plan year
• Auto-enrollment evidence (if applicable) — notices sent, default deferral rates applied
• Hardship distribution documentation (application, approval, supporting records)
• Loan records: origination documents, repayment schedules, outstanding balances
• Distribution records: forms, tax withholding elections, rollover certifications
• QDRO documentation (if any Qualified Domestic Relations Orders were processed)

Compliance testing

• ADP/ACP test results (or safe harbor notice if applicable)
• Coverage test (410(b)) results
• Top-heavy test results
• 415 annual additions test
• Safe harbor notices (if your plan uses safe harbor provisions)
• Eligible automatic contribution arrangement (EACA) or qualified automatic contribution arrangement (QACA) notices

Administrative items

• Prior year audit report and management letter (if applicable)
• Prior year Form 5500 and all schedules
• Minutes from plan committee or board meetings where plan matters were discussed
• Blackout period notices (if any blackout periods occurred during the year)
• Participant fee disclosure notices (404a-5)
• Any DOL or IRS correspondence received during the plan year
• Corrective distributions or refunds processed

Tips for a smooth audit

Designate one point of contact. Having a single person coordinate between the auditor, recordkeeper, and TPA prevents confusion and duplicate requests. This person doesn't need to be an expert — they just need to be responsive and organized.

Respond to requests promptly. The single biggest cause of audit delays is late document submissions. If your auditor asks for something, aim to provide it within a few business days. If you need more time, communicate that proactively.

Don't wait for perfection. If you have most of the documents ready but are waiting on one item, send what you have. Auditors can start working with partial information and fill in gaps as remaining items arrive.

Ask your recordkeeper for help. Most recordkeepers have standard audit packages they can generate. These packages typically include census data, contribution reports, distribution summaries, and loan records in the format auditors expect.

Start early. Don't wait until two weeks before your Form 5500 deadline. Begin the audit process at least 4-6 months before your filing deadline to avoid unnecessary stress and extension fees.

A note on PEP audits

If your plan is a Pooled Employer Plan, you'll need all of the above — plus documentation for each individual adopting employer. This includes separate census data, contribution records, and compliance testing results per adopter. See our PEP audit page for more details on what's involved.