401(k) Audit Checklist: Documents Your Auditor Will Request
The 38-item document request list for an ERISA 401(k) plan audit, organized the way auditors organize it, with the reason behind each request.
Last updated · Source data: plan year 2024 Form 5500 filings
What documents does a 401(k) audit require?
Expect requests in eight groups: plan documents and amendments, trust or custodial statements (with the Section 103(a)(3)(C) certification), a full-year census, payroll registers reconciled to contributions, deposit dates for every remittance, distribution and loan support, nondiscrimination testing, and service providers’ SOC 1 reports, plus the draft Form 5500.
The 401(k) audit document request list
| Document or data | Why the auditor asks | Usual source |
|---|---|---|
| 1. Plan governance and documents | ||
| Executed plan document, adoption agreement, and every amendment in force during the year | The plan document defines eligibility, compensation, contribution formulas, vesting, loans, and distributions; every test in the audit is a test against it. SAS 136 requires management to acknowledge responsibility for maintaining a current plan instrument. | Sponsor, document provider or TPA |
| IRS determination letter or pre-approved plan opinion letter | Evidence the plan’s form is tax-qualified; the financial statements disclose tax status. | Sponsor, document provider |
| Trust agreement and custodial agreement | Establishes who holds plan assets and who may certify investment information. | Trustee or custodian |
| Summary plan description and summaries of material modifications | Cross-checked against the document for operational consistency and participant communications. | Sponsor |
| Plan committee charter, minutes, and investment policy statement | Shows who governs the plan, how decisions are made, and supports the auditor’s understanding of controls and fiduciary oversight. | Sponsor |
| ERISA fidelity bond | ERISA §412 requires a bond of at least 10% of funds handled (minimum $1,000, maximum $500,000, or $1,000,000 for plans holding employer securities); reported on Schedule H, line 4e. | Sponsor, insurance broker |
| Service agreements and ERISA §408(b)(2) fee disclosures | Identifies service organizations, fee arrangements, and expenses paid from plan assets. | Recordkeeper, TPA, adviser |
| 2. Trust and investments | ||
| Trust or custodial statements for the full plan year, including the year-end statement | Supports investments, investment income, contributions received, benefits paid, and expenses at the trust level. | Trustee or custodian |
| ERISA Section 103(a)(3)(C) certification of investment information (accuracy and completeness) | Determines the audit scope. The certifier must be a bank, trust company, or insurance carrier that is regulated, supervised, and subject to periodic examination; the auditor evaluates whether the election is permissible. | Trustee or custodian |
| Year-end participant balance report reconciled to the trust | Proves that participant accounts equal the assets in trust; unreconciled differences are a finding. | Recordkeeper |
| Fair-value support for assets outside the certification | Self-directed brokerage windows, real estate, limited partnerships, or employer stock held elsewhere are audited in full, including fair-value hierarchy disclosures. | Custodian, valuation provider |
| Investment activity detail: purchases, sales, income, and expense allocations | Supports the statement of changes in net assets and the ERISA schedules (Schedule H, lines 4i and 4j). | Recordkeeper, custodian |
| 3. Participant data and payroll | ||
| Full-year census: every employee with hire, rehire, and termination dates, date of birth, hours, compensation, and deferral elections | The population for every participant-level test — eligibility, compensation, contributions, vesting — and for the participant counts reported on Form 5500. | Sponsor HR and payroll |
| Payroll registers for each payroll system and pay period, reconciled to Form W-3 and to the census | Confirms the compensation base and the deferral amounts withheld; each system is tested separately. | Payroll provider |
| Deferral election history and auto-enrollment notices | Ties the amount withheld to the participant’s election (or default) in effect for each pay period. | Recordkeeper, sponsor |
| Personnel records for sampled participants | Supports hire and termination dates used for eligibility, vesting, and forfeiture testing. | Sponsor HR |
| 4. Contributions | ||
| Contribution remittance log: pay date, amount withheld, and date deposited to the trust, for every payroll | Tests timeliness under 29 CFR 2510.3-102. Late participant contributions are reported on Schedule H, line 4a with a supplemental schedule and corrected with lost earnings. | Sponsor payroll, recordkeeper |
| Employer matching and nonelective contribution calculations, including true-ups | Recalculated on a sample against the document’s formula and compensation definition. | Sponsor, TPA |
| Forfeiture account activity and use | Forfeitures must be used per the document and, under IRS proposed regulations, within 12 months after the end of the plan year in which they arise. | Recordkeeper |
| Rollover contributions received, with source-plan documentation | Confirms amounts accepted are eligible rollovers. | Recordkeeper |
| Corrective contributions and related calculations | Supports amounts and earnings deposited to fix prior errors under EPCRS or VFCP. | Sponsor, TPA |
| 5. Distributions and loans | ||
| Distribution requests, approvals, and Forms 1099-R | Tests that payments went to eligible participants, at the correct vested amount, with required consents and withholding. | Recordkeeper |
| Hardship withdrawal documentation | Supports the immediate and heavy financial need and the amount necessary to satisfy it under the plan’s hardship provisions. | Recordkeeper, sponsor |
| Required minimum distribution listing | Confirms RMDs were paid to participants who reached the required beginning date. | Recordkeeper |
| Participant loan applications, amortization schedules, payment history, and default reports | Tests loans against IRC §72(p) limits and the loan policy, and identifies deemed distributions for missed payments. | Recordkeeper, payroll |
| Benefit payments reconciled between recordkeeper and trust | Ensures every payment left the trust once and only once. | Recordkeeper, custodian |
| 6. Compliance testing | ||
| ADP/ACP nondiscrimination tests (or safe harbor notice and contribution support) | Failed tests require corrective distributions or contributions; the financial statements may need a payable or disclosure. | TPA or recordkeeper |
| IRC §402(g), §415(c), and §401(a)(17) limit tests | Deferrals, annual additions, and compensation above statutory limits must be corrected. | TPA or recordkeeper |
| Coverage (§410(b)) and top-heavy tests | Confirms the plan covers a nondiscriminatory group and identifies any required top-heavy minimum contribution. | TPA or recordkeeper |
| Corrective distributions and the related refunds | Supports amounts refunded, earnings, and the timing that determines excise tax exposure. | Recordkeeper |
| 7. Service organizations | ||
| SOC 1 Type 2 reports for the recordkeeper, trustee or custodian, and payroll provider | The auditor relies on the service organization’s controls for processing it does not observe directly; without the report, more direct testing is required. | Each service provider |
| Bridge letters covering the gap between the SOC 1 period and the plan year-end | Extends reliance to the full plan year. | Each service provider |
| The sponsor’s mapping of complementary user entity controls (CUECs) to its own procedures | SOC 1 reliance assumes the sponsor performs the user controls the report lists — reviewing payroll files, approving distributions, reconciling reports. | Sponsor |
| 8. Form 5500 and reporting | ||
| Substantially complete draft Form 5500 with schedules, before the report date | SAS 136 (AU-C 703) requires the auditor to read the draft for material inconsistencies with the audited financial statements before dating the report. | Form 5500 preparer |
| Prior-year Form 5500, audited financial statements, and management letter | Opening balances, comparative figures, and unresolved prior findings. | Sponsor, predecessor auditor |
| Schedule of assets held at year-end (Schedule H, line 4i) and reportable transactions (line 4j) | ERISA supplemental schedules on which the auditor reports. | Trustee, recordkeeper |
| Management representation letter and legal letters, if any litigation | Required written representations, including the SAS 136 acknowledgments on the plan instrument, plan administration, and the certification election. | Sponsor, counsel |
| Subsequent-events information: plan amendments, mergers, terminations, or provider changes after year-end | Disclosed in the financial statements when material. | Sponsor |
A first-year audit adds history to this list — documents since adoption and prior-year records for opening balances. See the first-year audit guide. Under an ERISA Section 103(a)(3)(C) election the investment items are replaced by the certification; everything else remains.
The five items that most often delay a 401(k) audit
| Item | What goes wrong |
|---|---|
| ERISA Section 103(a)(3)(C) certification | Arrives late, covers the wrong period, or is signed by an entity that does not qualify. Request it in the first quarter and confirm the signer. |
| SOC 1 reports and bridge letters | Report period ends before plan year-end and nobody requests the bridge letter; user entity controls never mapped. |
| Payroll-to-census reconciliation | Multiple payroll systems, mid-year provider changes, or compensation codes that do not tie to the plan definition. |
| Remittance log | Deposit dates missing or reconstructed from memory; each payroll needs a dated trust receipt. |
| Support for terminated participants | Personnel files and distribution paperwork scattered across HR, payroll, and the recordkeeper. |
Records quality is also the cheapest fee reduction available: auditors price the hours they expect to spend chasing items. A complete, reconciled package delivered before fieldwork is what separates a July 31 filing from an October 15 one — see the deadline guide and the cost guide.
How much of this applies to a typical plan?
All of it, scaled by size. The median audited retirement plan in plan year 2024 had 357 participants, and 24,961 of 72,776 audited retirement plans (34.3%) had between 100 and 249 — plans with one payroll, one recordkeeper, and a request list that fits on two pages. Sample sizes, not the list, grow with the participant count. Plans with employer stock, multiple payrolls, or Form 11-K obligations add items to the trust and reporting groups.
Rankings derived from U.S. Department of Labor Form 5500 filings, plan year 2024. Read the full methodology.
Audit checklist FAQs
When should I start gathering 401(k) audit documents?
Governance documents, service agreements, SOC 1 reports, and the certification request can be assembled in the first quarter, before fieldwork. Year-end items — census, payroll registers, trust statements, and the participant balance report — are ready four to eight weeks after the plan year ends. Sponsors who deliver the full list before fieldwork begins typically finish before July 31 without an extension.
Do I still need SOC 1 reports if the recordkeeper is a large national provider?
Yes. The auditor relies on the service organization’s controls only through a SOC 1 Type 2 report covering the plan year (plus a bridge letter for any gap), and only if the sponsor performs the complementary user entity controls the report lists. Size of the provider does not substitute for the report.
What is the ERISA Section 103(a)(3)(C) certification and who provides it?
A written statement from the plan’s trustee or custodian — a bank, trust company, or insurance carrier that is regulated, supervised, and subject to periodic examination by a state or federal agency — certifying that the investment information it furnished is complete and accurate. It allows the auditor to exclude that investment information from audit procedures; contributions, distributions, loans, and participant data are still audited in full.
Does the auditor need every participant’s file?
No. The auditor selects samples of participants for eligibility, compensation, deferral, match, distribution, and loan testing. The full census and payroll registers are needed to define the population and choose the sample; personnel files are requested only for the participants selected.
What if we changed payroll providers or recordkeepers during the year?
Expect requests for both systems: registers and reconciliations from each payroll provider for its portion of the year, and a conversion reconciliation showing participant balances transferred out of the old recordkeeper and into the new one. Conversions add testing hours and are a common source of first-year findings.
Why does the auditor want the draft Form 5500 before signing?
AU-C section 703 (SAS 136) requires the auditor to obtain and read a substantially complete draft of Form 5500 before dating the report, to identify material inconsistencies between the form and the audited financial statements. The report cannot be issued until that draft exists.
This page summarizes ERISA, Department of Labor and IRS rules, and AICPA auditing standards in plain language for research purposes; your auditor’s request list governs.