First-Year 401(k) Audit: What to Expect
What triggers the first audit, what the auditor will ask for, how long it takes, what the first year costs relative to later years, and the findings that appear most often when a plan is audited for the first time.
Last updated · Source data: plan year 2024 Form 5500 filings
What happens in a first-year 401(k) audit?
A plan’s first audit comes in the plan year that begins with 100 or more participants with account balances — 121 or more if it filed as a small plan the prior year. The auditor tests opening balances, contributions, distributions, and participant data; the report attaches to Form 5500.
What triggers a plan’s first audit?
| Situation | Rule | First audit year |
|---|---|---|
| A growing plan crosses the threshold | A plan that filed as a small plan may keep filing as small while it begins the year with 80–120 participants (29 CFR 2520.103-1(d)). The first plan year that begins with 121 or more participants with account balances is a large-plan year. | The year beginning with 121+ (or 100+ if the plan did not use the 80–120 election). |
| A new plan starts large | A plan whose first plan year begins with 100 or more participants with account balances files as a large plan from its first Form 5500. | The first plan year — including a short first year, unless the audit is deferred under 29 CFR 2520.104-50 for a year of seven months or fewer. |
| A merger or acquisition | Merging an acquired company’s plan, or adding its employees, can push the beginning-of-year count past the threshold in one step. | The plan year that begins after the merger with 100+ (or 121+) participants with balances. |
| A small plan loses its audit waiver | Small plans avoid the audit only if at least 95% of assets are “qualifying plan assets” or a fidelity bond covers the non-qualifying portion, with required disclosures (29 CFR 2520.104-46). A small plan that fails those conditions must be audited. | The plan year in which the waiver conditions are not met. |
| Counting rule since 2023 | For plan years beginning on or after January 1, 2023, defined contribution plans count only participants with account balances at the beginning of the year — not every eligible employee. Some plans fell out of audit status; plans near 100 should confirm the count each January. | Re-test every plan year on the first day of the year. |
Full threshold rules, including the small-plan audit waiver, are in Does my plan need an audit?
The first-audit zone in the data
| Plan size (participants, beginning of year) | Audited plans | Share |
|---|---|---|
| Under 100 participants | 367 | 0.5% |
| 100–249 | 24,961 | 34.3% |
| 250–499 | 19,494 | 26.8% |
| 500–999 | 11,914 | 16.4% |
| 1,000–4,999 | 11,935 | 16.4% |
| 5,000 or more | 4,105 | 5.6% |
24,961 of 72,776 audited retirement plans (34.3%) had 100–249 participants — the band where most first audits happen. Plans under 100 appear through the 80–120 rule and plans that elected large-plan filing. Median audited plan: 357 participants. 4,052 firms signed audits in plan year 2024; the state directories show which ones do it at volume near you.
Rankings derived from U.S. Department of Labor Form 5500 filings, plan year 2024. Read the full methodology.
Timeline for a first-year audit
| When | What happens | Who |
|---|---|---|
| January | Confirm the January 1 count of participants with account balances and the 80–120 election history; conclude on large-plan status. | Sponsor, recordkeeper |
| February | Shortlist and engage an auditor with real plan-audit volume; sign the engagement letter with the SAS 136 acknowledgments. | Plan committee |
| March | Receive the first-year document request list; request the ERISA Section 103(a)(3)(C) certification, SOC 1 reports, and prior-year trust statements. | Sponsor |
| April – May | Planning, walkthroughs of payroll and contribution processes, and opening-balance work (AU-C 510). | Auditor |
| May – June | Fieldwork: participant-level testing of eligibility, compensation, deferrals, match, distributions, and loans; plan-document review. | Auditor, sponsor |
| July | Draft financial statements and a substantially complete draft Form 5500 to the auditor; file July 31 or extend with Form 5558. | Sponsor, preparer |
| August – October 15 | Resolve findings, obtain the signed report, file on the extended deadline if used. | All |
Fiscal-year plans shift every row: the audit is due with Form 5500 on the last day of the seventh month after the plan year ends. See the deadline guide.
What the auditor requests in year one
A first-year request list is the standard list plus history. Beyond the current-year census, payroll registers, remittance log, trust statements, distributions, loans, and testing covered in the full audit checklist, expect requests for:
- Every governing document since adoption — the executed plan document and adoption agreement, all amendments, the IRS determination or opinion letter, the trust agreement, and current service agreements — because the auditor must read the plan as it has operated, not only as it reads today.
- Prior-year records for opening balances — the prior year-end trust or custodial statement, the recordkeeper’s year-end participant balance report, the prior-year census, and the last three Forms 5500 — to satisfy AU-C 510 without a prior audit to rely on.
- Governance evidence — committee minutes, the investment policy statement, the fidelity bond, and fee disclosures under ERISA §408(b)(2).
- Service-organization reports — SOC 1 Type 2 reports for the recordkeeper, custodian, and payroll provider, with bridge letters covering any gap to year-end, and the sponsor’s mapping of complementary user entity controls.
- The certification for an ERISA Section 103(a)(3)(C) audit, in the certifier’s standard form, covering the full plan year.
What a first-year audit costs
| Component | Typical effect | Why |
|---|---|---|
| Baseline fee, 100–249 participants | $8,000 – $14,000 per year | Most first-time audits fall here; single payroll and one recordkeeper keep scope tight. |
| First-year premium | Roughly 10–25% above a comparable recurring year | Opening balances, plan-document review from adoption, walkthroughs of every process, and a longer request list. |
| ERISA Section 103(a)(3)(C) election | 15–40% below a full-scope audit | Requires a qualifying certification from the trustee or custodian; most recordkept 401(k) plans are eligible. |
| Additional payroll system or mid-year provider change | Adds hours | Each system is reconciled and tested separately; conversions add opening-balance work. |
| Late deposits or known operational errors | Adds hours | Findings require corrected calculations, Schedule H, line 4a reporting, and often a correction filing. |
Honest labeling: audit fees are not reported in a reliable Form 5500 field. These figures are editorial estimates consistent with the cost guide, not outputs of the filing dataset. A first audit of a plan near the 100-participant threshold typically runs $9,000–$14,000 all in.
Common first-year findings
| Finding | Rule and what goes wrong | How it is resolved |
|---|---|---|
| Late deposit of employee deferrals | Participant contributions must be deposited as soon as they can reasonably be segregated from employer assets — and never later than the 15th business day of the following month, which is an outer limit, not a safe harbor. The 7-business-day safe harbor applies only to plans with fewer than 100 participants (29 CFR 2510.3-102). | Reported on Schedule H, line 4a with a supplemental schedule; corrected with lost earnings, typically through the DOL Voluntary Fiduciary Correction Program, which since March 17, 2025 includes a self-correction path for small, promptly corrected amounts. |
| Wrong definition of compensation | Deferrals or match calculated on a payroll compensation code that excludes (or includes) bonuses, commissions, or overtime contrary to the plan document. | Corrective contributions plus earnings under the IRS Employee Plans Compliance Resolution System (EPCRS); amend the payroll mapping. |
| Eligibility and auto-enrollment failures | Employees enrolled late, excluded, or not auto-enrolled per the document; rehires treated as new hires. | EPCRS correction; for auto-enrollment failures, reduced or no corrective contribution if corrected within the safe-harbor windows. |
| Missing or unsigned plan documents and amendments | No executed adoption agreement, missing interim amendments, or required SECURE 2.0 amendments not yet adopted (generally due December 31, 2026 for calendar-year non-governmental plans under IRS Notice 2024-2). | Locate or re-execute; adopt outstanding amendments by the remedial amendment deadline; document operational compliance in the interim. |
| Participant loan administration | Payments not started after issuance, defaulted loans not reported as deemed distributions, loans exceeding the IRC §72(p) limits. | Report deemed distributions on Form 1099-R; EPCRS correction where the failure is the employer’s. |
| Hardship and distribution support | No documentation of hardship need, distributions paid at the wrong vesting percentage, missing spousal consent where required. | Reconstruct support; correct overpayments or underpayments under EPCRS. |
| Forfeitures held too long | Forfeiture balances carried for years instead of being used per the document. IRS proposed regulations (2023) require use within 12 months after the end of the plan year in which the forfeiture arises. | Apply forfeitures to contributions or expenses as the document directs; amend if the document is silent. |
| Fidelity bond missing or too small | ERISA §412 requires a bond of at least 10% of funds handled — minimum $1,000, maximum $500,000, or $1,000,000 for plans holding employer securities. Bond information is reported on Schedule H, line 4e. | Purchase or increase the bond; the auditor discloses the shortfall. |
| Unreconciled census and participant counts | Census that does not tie to payroll or to the recordkeeper; terminated participants with balances omitted from the count; wrong participant counts on Form 5500. | Build a year-end reconciliation from payroll to census to recordkeeper before fieldwork; correct the count on Form 5500. |
| SOC 1 report gaps | No SOC 1 Type 2 report obtained for the recordkeeper or payroll provider, no bridge letter for the gap period, and complementary user entity controls never mapped to sponsor procedures. | Obtain the reports early; document who performs each user control. |
None of these findings is unusual, and none by itself makes an audit fail. Under SAS 136 the auditor communicates reportable findings in writing to the plan committee; the sponsor corrects them under EPCRS (IRS) or VFCP (DOL) and moves on. What the Department of Labor penalizes is the absence of an adequate audit, not the presence of corrected errors.
First-year audit FAQs
How many participants trigger a 401(k) audit?
100 or more participants with account balances at the beginning of the plan year makes a plan a large plan that must attach an independent audit to Form 5500. Under the 80–120 rule, a plan that filed as a small plan the prior year may keep filing as small until a plan year begins with 121 or more.
Does a first-year audit cover prior years?
Not as a full audit of those years. Under AU-C 510 the auditor must obtain sufficient evidence that the opening balances — participant accounts, investments, and any receivables — are not materially misstated, which for a previously unaudited plan means testing prior-year activity and reconciling the recordkeeper to the trust at the opening date. That work is the main source of the first-year premium.
How long does a first-year 401(k) audit take?
Plan on eight to fourteen weeks from kickoff to signed report, versus six to twelve for a recurring engagement, including the sponsor’s time gathering payroll, census, and plan documents. Engaging in the first quarter of the year keeps the July 31 deadline realistic; a Form 5558 extension to October 15 is common for first audits.
Can a first-year audit use the ERISA Section 103(a)(3)(C) election?
Yes, if a qualifying bank, trust company, or insurance carrier certifies the investment information as complete and accurate. The election is available in any plan year, reduces fees by roughly 15–40%, and does not reduce the testing of contributions, distributions, loans, or participant data that produces most first-year findings.
What happens if the auditor finds errors?
Findings are normal in a first audit and are not penalties. The auditor communicates reportable findings in writing to the plan committee; late deposits are disclosed on Schedule H, line 4a; and operational errors are corrected under the IRS Employee Plans Compliance Resolution System or the DOL Voluntary Fiduciary Correction Program. Uncorrected findings, not corrected ones, create exposure.
Can we defer a first audit?
Only in narrow cases. A plan year of seven months or fewer may defer its audit to the following year under 29 CFR 2520.104-50, attaching one audit covering both periods to the next Form 5500. The 80–120 rule can postpone large-plan status for a plan hovering between 100 and 120, but a plan year beginning with 121 or more participants with balances must be audited.
This page summarizes ERISA, Department of Labor and IRS rules, and AICPA auditing standards in plain language for research purposes; confirm specifics with your ERISA counsel or auditor.