A strong employee benefit plan audit checklist does three jobs at once: it tells the plan sponsor exactly which documents to produce, it maps every participant-level test to the evidence behind it, and it runs on a timeline that keeps the Form 5500 deadline safely out of reach. It is also the backbone of the offshore audit-prep model SA Globus runs for CPA firms across the United States: census files scrubbed, payroll tied out, and testing schedules prepared before your senior opens the engagement.
This guide gives you the full checklist, the controls auditors focus on, a 30-day prep timeline, the findings that show up most often in 401(k) and 403(b) audits, and a practical picture of where an offshore team takes work off your staff’s plate.
When a Plan Needs an Audit, and Why the Window Is Tight
Most defined contribution plans need an independent audit once they become a large plan filer, generally when the plan has 100 or more participants with account balances at the beginning of the plan year. Plans near the threshold may qualify for the 80–120 participant rule, which lets a plan keep filing in the same category it used the prior year.
The deadline is what makes benefit plan season so compressed. Form 5500 is due on the last day of the seventh month after the plan year ends, which is July 31 for a calendar-year plan. Filing Form 5558 extends that by up to two and a half months, to October 15. Many firms push most of their benefit plan work into the extension window, which is exactly when tax season backlog, staff vacations, and individual extensions collide. The firms that hit October 15 calmly are the ones that start the checklist in spring.
What the Employee Benefit Plan Audit Checklist Must Include
Auditors will issue their own request list, but plan sponsors who wait for it lose weeks. A better approach is to pre-build the employee benefit plan audit checklist by category and send it with the engagement letter. Every number in the plan’s financial statements needs a source report, a reconciliation, and participant-level support behind it.
Plan documents and governance files
Start with the plan’s legal foundation: the signed plan document and every amendment, the adoption agreement, the summary plan description and any summaries of material modifications, the IRS determination or opinion letter, the trust or custodial agreement, and the prior-year Form 5500 with its audited financial statements. Add investment committee minutes, the investment policy statement if one exists, the fidelity bond, and a current list of service providers with their contracts and fee disclosures.
Recordkeeper, custodian, and service-provider reports
Request the full-year trust statements from the custodian and the annual plan reports from the recordkeeper: contributions, distributions, loans, investment activity, and participant balances. If the plan uses an ERISA Section 103(a)(3)(C) audit, obtain the certification from the qualifying institution. Request the SOC 1 Type 2 reports for the recordkeeper and payroll provider, along with bridge letters covering any gap to plan year-end. Note the complementary user entity controls in each report, because the sponsor is expected to have them in place.
Payroll, census, and participant-level data
This is where most of the hours go. Collect payroll registers for the full year, the employee census with hire, termination, rehire, and birth dates, the plan’s definition of compensation, contribution remittance records with deposit dates, deferral election forms or electronic elections, and support for a sample of distributions, hardship withdrawals, and loans. Include the nondiscrimination testing results (ADP/ACP and top-heavy) and any corrective distributions made.
Internal Controls That Need to Be Documented Before Fieldwork
Benefit plan auditors spend real time understanding the sponsor’s controls, especially where the plan relies on outside providers. Documenting them up front shortens the planning phase and reduces surprises.
Payroll-to-plan controls
Show who sets up new hires in payroll, who enters deferral elections, and who reviews the contribution file before it goes to the recordkeeper. Show how the sponsor confirms that the pay codes feeding plan compensation match the plan document’s definition, including bonuses, commissions, and overtime.
Timely remittance of participant deferrals
Under Department of Labor rules, participant deferrals become plan assets as soon as they can reasonably be separated from the employer’s general assets. The outer limit is the 15th business day of the following month, but that is not a safe harbor for large plans, and auditors look at how quickly the sponsor actually deposits. (Plans with fewer than 100 participants have a seven-business-day safe harbor.) A deposit log that lists each payroll date, remittance date, and amount is one of the most valuable items on the whole checklist.
Eligibility, enrollment, and distribution approvals
Document how eligibility dates are tracked, how auto-enrollment is applied if the plan has it, and who approves distributions, hardships, and loans. Make sure the sponsor can evidence review of the user entity controls listed in each SOC 1 report, such as reviewing recordkeeper reports and reconciling payroll to remittances.
A 30-Day Employee Benefit Plan Audit Checklist Timeline
Days 30 to 21: collect documents and scrub the census
Send the checklist, pull recordkeeper and trust reports, and request SOC 1 reports. Clean the census: fix missing dates, flag rehires, and confirm that every eligible employee appears. A clean census at this stage saves days of back-and-forth later.
Days 20 to 11: tie out payroll and test the data
Reconcile total plan compensation and deferrals from payroll to the recordkeeper’s contribution report, pay period by pay period. Build the remittance timeliness schedule. Prepare sample support for eligibility, deferral rates, employer match calculations, distributions, and loans, so the audit team can test rather than chase.
Days 10 to 1: assemble, review, and hand over
Tie the trust statement to the recordkeeper’s net assets and to the draft financial statements. Prepare the supplemental schedules the Form 5500 requires, such as the schedule of assets held at year-end. Run a senior review of the full package against the checklist, then hand it to the engagement team as one organized folder.
The Most Common Benefit Plan Audit Findings and How to Prevent Them
Compensation definition and deferral errors
The single most common operational error is applying the wrong definition of compensation, for example excluding bonuses the plan document includes, or the reverse. Close behind are deferral elections that were never implemented or were implemented late. Both are prevented by mapping every payroll pay code to the plan document before testing starts.
Late deposits, eligibility misses, and loan errors
Late remittances can lead to prohibited transactions, lost earnings corrections, and Form 5500 disclosures. Missed eligibility (employees who should have been offered the plan but were not) and loans that exceed limits or default without proper treatment round out the usual list. Most can be fixed using IRS and DOL correction programs, but only if they are found early enough to correct before the filing.
Platform-Specific Evidence: Recordkeepers and Payroll Systems
Recordkeeper portals and plan sponsor reports
Major recordkeepers each provide an annual audit package or a set of standard plan sponsor reports: contribution detail by source, distribution and loan reports, participant balance listings, and fee reports. Knowing which report on each platform answers each checklist line removes a full round of client questions.
Payroll systems such as ADP, Paychex, and Gusto
Payroll registers, deduction reports, and earnings-by-pay-code reports are the raw material for compensation and deferral testing. Exporting them in a consistent format and tying them to the recordkeeper file is detailed, repeatable work, and exactly the kind that moves well to an offshore team.
How an Offshore Audit-Prep Partner Delivers the Checklist Faster
What SA Globus prepares before fieldwork starts
SA Globus works as a silent back-office team for CPA firms. Our accountants scrub census data, reconcile payroll to recordkeeper contribution reports, build remittance timeliness schedules, prepare sample support files, and draft supplemental schedules, all in your firm’s workpaper format and reviewed by a senior before delivery. Your team keeps the judgment calls, the testing conclusions, and the client relationship.
Capacity for the July-to-October crunch
Because work moves overnight across the time-zone difference, a census sent at the end of your day can come back reconciled the next morning. Firms use this to absorb peak benefit plan season without hiring seasonal staff, and to keep their US team focused on review. The same team can also support your payroll and tax preparation work outside audit season. If you also audit nonprofits, our not-for-profit audit checklist guide follows the same approach.
A Checklist Turns Benefit Plan Season Into a Process
A complete employee benefit plan audit checklist covers plan documents, provider reports, payroll and census data, documented controls, a 30-day prep timeline, and a review step before the auditor starts. Firms that run it this way finish closer to budget, raise fewer findings late in the engagement, and file well ahead of the extended deadline.
Send this checklist to your plan sponsor clients with the engagement letter, and start the 30-day clock at least 60 days before your planned fieldwork date. If your firm needs extra capacity for benefit plan season without adding headcount, talk to the SA Globus team about how offshore audit-prep support fits your practice.
Not sure where your firm should start? Book a free discovery call with SA Globus and get a plan built around your actual workload.
Frequently Asked Questions (FAQs)
Which plans need an employee benefit plan audit?
Generally, a plan needs an independent audit when it files as a large plan, which for most defined contribution plans means 100 or more participants with account balances at the beginning of the plan year. Plans close to the threshold may use the 80–120 participant rule to keep their prior-year filing status.
When is the Form 5500 due for a calendar-year plan?
Form 5500 is due on the last day of the seventh month after the plan year ends, which is July 31 for a calendar-year plan. Filing Form 5558 extends the deadline by up to two and a half months, to October 15.
What documents belong on an employee benefit plan audit checklist?
Plan documents: the plan document and amendments, adoption agreement, SPD, IRS determination or opinion letter, trust agreement, and prior-year Form 5500.
Provider reports: trust statements, recordkeeper annual reports, SOC 1 reports with bridge letters, and the 103(a)(3)(C) certification if applicable.
Participant data: payroll registers, census, deferral elections, remittance records, distribution and loan support, and nondiscrimination testing results.
What are the most common 401(k) audit findings?
The most frequent findings are using the wrong definition of compensation, late deposits of participant deferrals, deferral elections not implemented correctly, missed eligibility, and loan errors. Most can be corrected through IRS and DOL correction programs if found early.
Can an offshore team work with our recordkeeper and payroll reports?
Yes. Offshore staff work from the reports your client already exports, such as recordkeeper contribution and distribution reports and payroll registers from systems like ADP, Paychex, or Gusto, and turn them into reconciled, review-ready schedules in your firm’s workpaper format.
Why choose SA Globus for benefit plan audit-prep support?
SA Globus is a back-office partner for US CPA firms, staffed by Chartered Accountants and CPA-trained professionals. We deliver senior-reviewed census scrubs, payroll tie-outs, remittance schedules, and sample support so your firm can take on more benefit plan engagements without adding headcount.
Discover more from SA Globus
Subscribe to get the latest posts sent to your email.
