Limited-Scope vs. Full-Scope 401(k) Audit
The ERISA Section 103(a)(3)(C) audit replaced the limited-scope audit under AICPA SAS 136. What the election covers, who may certify, what changed in the report, and what it means for cost.
Last updated · Source data: plan year 2024 Form 5500 filings
What is the difference between a limited-scope and a full-scope 401(k) audit?
In an ERISA Section 103(a)(3)(C) audit — the successor to the limited-scope audit under SAS 136 — the auditor does not test investment information certified by a qualified bank, trust company, or insurance carrier. A full-scope audit tests everything, including investments. Contributions, distributions, and participant data are audited either way.
The rule: ERISA Section 103(a)(3)(C) and DOL Regulation 2520.103-8
ERISA Section 103(a)(3)(C) lets a plan administrator exclude from the accountant’s examination any statement or information prepared by a bank or similar institution or an insurance carrier that is regulated, supervised, and subject to periodic examination by a state or federal agency, provided that institution certifies the information as complete and accurate. Department of Labor regulation 29 CFR 2520.103-8 implements the election; 29 CFR 2520.103-5 sets out what the certifying institution must furnish.
For decades this produced the “limited-scope audit,” in which the auditor disclaimed an opinion on the financial statements as a whole because investments — usually the largest number on the balance sheet — were outside the audit. AICPA Statement on Auditing Standards No. 136 (codified as AU-C section 703) retired that format. For financial statement periods ending on or after December 15, 2021, the engagement is an ERISA Section 103(a)(3)(C) audit, with a new form of opinion and new obligations on both the sponsor and the auditor.
Section 103(a)(3)(C) audit vs. full-scope audit
| Dimension | ERISA Section 103(a)(3)(C) audit (formerly limited scope) | Full-scope audit |
|---|---|---|
| Legal basis | Election by the plan administrator under ERISA §103(a)(3)(C) and 29 CFR 2520.103-8; reported under AICPA SAS 136 (AU-C 703). | Standard ERISA §103(a)(3)(A) audit under generally accepted auditing standards, with no scope exclusion. |
| Investment information | Excluded from audit procedures to the extent it is prepared and certified as complete and accurate by a qualified institution. The auditor tests that the financial statements agree to or derive from the certified information. | Audited in full: existence, ownership, valuation (including fair-value hierarchy support), and investment income and expense. |
| Who may certify | A bank, trust company, or similar institution, or an insurance carrier, that is regulated, supervised, and subject to periodic examination by a state or federal agency. Broker-dealers, recordkeepers, and TPAs do not qualify unless a qualifying trust company or bank issues the certification. | No certification is used, or none is available from a qualifying institution. |
| Assets outside the certification | Full audit procedures still apply to any asset the certification does not cover — self-directed brokerage windows at non-qualifying custodians, real estate, limited partnerships, or employer stock held elsewhere. | All assets are audited. |
| What the auditor tests either way | Employee and employer contributions, participant data (eligibility, compensation, deferral elections), allocations to accounts, distributions, participant loans, plan expenses, and compliance with plan provisions. | Same, plus the investment work above. |
| Opinion (periods ending on or after December 15, 2021) | A two-part ERISA Section 103(a)(3)(C) opinion: (1) the amounts and disclosures not covered by the certification are fairly presented under GAAP, and (2) the certified investment information agrees to or is derived from the certification. No disclaimer. | A standard opinion on the financial statements as a whole (unmodified, qualified, or adverse). |
| Opinion before SAS 136 (the “limited-scope” era) | A disclaimer of opinion on the financial statements as a whole, issued as a matter of form because of the scope limitation. | A standard opinion. |
| Sponsor’s added responsibilities | Determine that the election is permissible, that the certifying institution qualifies, and that the certified information is appropriately measured, presented, and disclosed — and acknowledge those responsibilities in writing at engagement acceptance. | Provide custodial statements and fair-value support for every asset; no election-related determinations. |
| Form 5500 coding | Schedule H, line 3(b) indicates an audit performed pursuant to 29 CFR 2520.103-8; line 3(a) records the opinion type. | Schedule H, line 3(b) marked “neither”; line 3(a) records the opinion type. |
| Availability | Not accepted by the SEC for plans that file Form 11-K, which require a full-scope audit under PCAOB standards. Otherwise available annually at the administrator’s election. | Required for Form 11-K filers, for assets held outside a qualifying institution, and whenever no qualifying certification exists. |
| Typical fee (editorial estimate) | Roughly 15–40% below a full-scope audit of the same plan, because investment valuation and income testing are the most hour-intensive areas. | Baseline; fair-value testing of alternative or hard-to-value assets can require valuation specialists. |
Fee effects are editorial estimates; Form 5500 has no reliable audit-fee field. See the cost guide for the full fee framework.
What changed under SAS 136?
| Element | Before: limited-scope audit | After: ERISA Section 103(a)(3)(C) audit |
|---|---|---|
| Name | Limited-scope audit | ERISA Section 103(a)(3)(C) audit |
| Auditor’s report | Disclaimer of opinion on the financial statements as a whole | Two-part opinion on the non-certified information and on the agreement of the certified information; a new report layout specific to ERISA plans |
| Engagement acceptance | General GAAS preconditions | Management must acknowledge responsibility for maintaining a current plan instrument, administering the plan, determining the election is permissible, and providing a substantially complete draft Form 5500 before the report date |
| Evaluating the certification | Auditor confirmed a certification existed | Auditor evaluates whether the certifying institution qualifies, whether the certification covers accuracy and completeness, and whether the certified information is appropriately measured, presented, and disclosed |
| Plan provisions | Tested; findings communicated informally or in a management letter | “Reportable findings” from procedures on plan provisions must be communicated in writing to those charged with governance |
| Form 5500 | No specific requirement | Auditor must obtain and read a substantially complete draft Form 5500 for material inconsistencies with the audited financial statements before dating the report |
| Supplemental schedules | Reported on | Reported on with a defined form of words that references the ERISA schedules (e.g., Schedule H, line 4i) |
| Effective date | Periods ending before December 15, 2021 | Periods ending on or after December 15, 2021 (SAS 136 as deferred by SAS 141; early adoption was permitted) |
The practical shift is accountability. Under the old format the sponsor simply handed over a certification; under SAS 136 the sponsor must determine — and state in writing — that the election is permissible, and the auditor must evaluate that determination. An invalid certification no longer produces a harmless disclaimer; it produces a deficient audit.
Is your plan eligible for the election?
- Qualifying certifier. A bank, trust company, or insurance carrier that is regulated, supervised, and periodically examined by a state or federal agency. A recordkeeper’s affiliated trust company usually qualifies; a broker-dealer or the recordkeeping entity itself does not.
- Complete and accurate. The certification must cover both accuracy and completeness of the investment information, for the full plan year, and be signed by an authorized representative.
- Coverage. Only assets held by the certifying institution are covered. Investments held elsewhere are audited in full, which is why the savings depend on how much of the trust the certification reaches.
- Appropriate measurement. Management must conclude that the certified information is measured, presented, and disclosed appropriately — for example, that a certified value reflects fair value, not contract value, where GAAP requires it.
- Not an 11-K filer. Plans that file Form 11-K with the SEC need a full-scope, PCAOB-standard audit regardless.
What the filings show: 2,023 disclaimer opinions in plan year 2024
| Opinion as coded on Schedule H, line 3(a) | Filings | Share |
|---|---|---|
| Unmodified (clean) | 75,047 | 96.9% |
| Qualified | 247 | 0.3% |
| Disclaimer | 2,023 | 2.6% |
| Adverse | 2 | 0.0% |
| Not reported | 108 | 0.1% |
Share of 77,427 audited filings. Opinion type is transcribed exactly as filed.
Three plan years after SAS 136 took effect, 2,023 filings (2.6%) still carry a disclaimer code. Read those as artifacts of the limited-scope convention: Schedule H kept its disclaimer checkbox, some preparers still code an ERISA Section 103(a)(3)(C) report the way they coded limited-scope reports for thirty years, and a small number are genuine disclaimers or reports on 103-12 investment entities. A disclaimer in this dataset is therefore usually a legacy reporting convention or coding choice — not evidence of a failed audit. Qualified and adverse opinions (247 and 2 filings respectively) are the categories that warrant follow-up. Each firm profile shows the firm’s own opinion mix on the same basis, and the methodology explains the coding.
Rankings derived from U.S. Department of Labor Form 5500 filings, plan year 2024. Read the full methodology.
Cost and effort implications
The election removes the most hour-intensive part of a plan audit — existence and valuation testing of investments — so an ERISA Section 103(a)(3)(C) engagement typically prices 15–40% below a full-scope audit of the same plan (editorial estimate). Three things erode the saving: assets held outside the certifying institution, a certification that arrives late or from the wrong entity, and self-directed brokerage windows at non-qualifying custodians. Sponsor effort does not fall proportionately: management still owns the eligibility determination, the written acknowledgments, the draft Form 5500 the auditor must read, and every non-investment area of the audit, which is where most findings occur.
When choosing scope, request the certification in the first quarter, confirm the certifier’s status in writing, and tell candidate auditors which election you intend to make so quotes are comparable. The document checklist lists what the certification must contain.
Limited-scope and full-scope audit FAQs
Is an ERISA Section 103(a)(3)(C) audit a real audit?
Yes. It is a full GAAS audit of everything except the investment information a qualified bank, trust company, or insurance carrier certifies. Contributions, participant data, allocations, distributions, loans, expenses, and compliance with plan provisions are tested, and the auditor issues an opinion under SAS 136 rather than the disclaimer that defined the old limited-scope audit.
Can my recordkeeper certify the investments?
Only if the certification comes from a qualifying institution — a bank, trust company, or insurance carrier that is regulated, supervised, and subject to periodic examination by a state or federal agency. Many recordkeepers route the certification through an affiliated trust company, which qualifies; a certification signed by a broker-dealer, TPA, or the recordkeeping entity itself does not, and an audit that relies on it is deficient.
Can a plan switch between full-scope and 103(a)(3)(C) audits from year to year?
Yes. The election belongs to the plan administrator and is made each plan year. Tell the auditor at engagement, because the election changes the procedures, the report, the engagement letter acknowledgments, and the fee.
Why does my Form 5500 show a disclaimer of opinion?
Before SAS 136, every limited-scope audit ended in a disclaimer as a matter of form, and Schedule H still offers a disclaimer checkbox. Filings for plan years after 2021 that show a disclaimer usually reflect that legacy convention or a preparer coding an ERISA Section 103(a)(3)(C) report the old way. A genuine scope-limitation disclaimer is rare; qualified and adverse opinions are the categories that warrant follow-up.
What does a plan that files Form 11-K need?
A full-scope audit performed under PCAOB standards. The SEC does not accept the ERISA Section 103(a)(3)(C) scope exclusion for Form 11-K financial statements, so plans that offer registered employer securities typically need a full-scope audit even if a qualifying custodian certifies the investments.
How much does a 103(a)(3)(C) audit save?
Typically 15–40% versus a full-scope audit of the same plan, as an editorial estimate; Form 5500 does not report fees. Savings shrink when a large share of assets sits outside the certification, because those assets are audited in full either way.
This page summarizes ERISA, Department of Labor regulations, and AICPA auditing standards in plain language for research purposes; confirm specifics with your ERISA counsel or auditor.