An employee benefit plan audit doesn’t have to be expensive or disruptive. But for plans that aren’t ready, it often is – late fees, extended fieldwork, findings that require retroactive corrections, and a process that drags weeks past the Form 5500 deadline.

The difference between a smooth audit and a stressful one usually comes down to preparation, not luck.

This guide walks you through what to expect every step of the way. We cover the two types of audits, what auditors test, the documentation you’ll need, and how to organize for a process that takes three to four months from engagement to final report.

If your plan just crossed 100 participants and you’re facing your first audit, start here.

Not sure whether your plan needs an audit? Start with our 401(k) Audit Requirements Guide.

What is an employee benefit plan audit?

An Employee Benefit Plan (EBP) audit is an independent review of your plan’s financial statements and operations. It confirms that day-to-day administration aligns with both your governing documents and federal regulations.

Rather than a simple report card, think of it as an annual check-up. It identifies operational gaps and compliance issues (IRS/DOL) before they turn into costly problems.

Two types of EBP audits: limited scope vs. full scope

The first step of the process is understanding which type of audit applies to your plan. There are two options, and they’re quite different in scope, cost, and complexity.

Limited scope audits (103(a)(3)(C))

Limited scope audits are by far the most common — roughly 90% of plans go this route. Your auditor tests contributions, distributions, loans, and eligibility, but does not independently test investment information. Instead, the custodian (your bank, insurance company, or broker-dealer) certifies the investment data, and the auditor relies on that certification.

The practical result: lower audit fees, typically 20 – 40% less than a full scope audit, with no sacrifice in the areas that matter most for day-to-day plan operations.

Full scope ERISA audits

Full scope audits are required when your custodian can’t or won’t provide the required certification. In that case, your auditor tests everything, including investment balances and activity. It’s more comprehensive and more expensive, but if your custodian can’t certify, you don’t have a choice.

When engaging your auditor, confirm early which type applies to your plan. If you’re unsure, your third-party administrator (TPA) or custodian can clarify.

What EBP auditors test

Regardless of audit type, auditors examine the same core operational areas. Understanding what they’re looking for — and what they flag most often — helps you get ahead of problems before they surface.

Contributions

Auditors verify that employee and employer contributions were calculated correctly and deposited on time. The benchmark for small plans is the 7-day safe harbor. Contributions should be deposited within seven business days of each payroll. Late deposits are the single most common finding in employee benefit plan audits, and they trigger a correction process that includes calculating and depositing lost earnings.

If your payroll-to-plan reconciliation isn’t set up correctly, this is where it shows.

Distributions

Auditors review a sample of distributions to confirm they were properly authorized, calculated correctly, and supported by required documentation. This review includes beneficiary designation forms and, where applicable, spousal consents. Missing beneficiary forms are a persistent issue. If a participant took a distribution and the form isn’t in the file, it becomes a finding.

Participant loans

If your plan allows loans, auditors check that outstanding balances stay within legal limits (the lesser of $50,000 or 50% of the participant’s vested account balance) and that repayment terms don’t exceed five years (except for home purchase loans). Loans that exceed these limits require correction and documentation.

Eligibility and compliance

This section covers whether employees were enrolled according to the plan document and whether required annual testing was completed. The tests auditors look for include ADP/ACP (deferral and contribution nondiscrimination) testing and top-heavy testing. The most common finding here: eligible employees who weren’t enrolled. That triggers retroactive enrollment and makeup contributions, which is both administratively complex and costly.

The EBP audit timeline

A well-run audit takes three to six months from engagement to final report. Here’s what each phase looks like in practice.

Months 1 – 2: Engage and gather

The earlier you engage your auditor, the better. Aim for six to nine months before your Form 5500 deadline. For calendar-year plans, that means starting no later than October or November of the plan year.

Once you’ve signed the engagement letter, your auditor will send a document request list. One item that frequently delays audits: the SOC 1 report from your plan’s service providers. These reports document the internal controls at your recordkeeper, custodian, and TPA. They can take four to six weeks to obtain, so request them immediately.

Designate a single point person to manage auditor communications. Plans with a clear internal contact move through fieldwork faster and incur fewer billable hours on back-and-forth coordination.

Months 3 – 4: Fieldwork

This is the active audit phase. You’ll submit your documentation package, and the auditor will begin testing. When they send follow-up requests, aim to respond within two to three business days. Delays in this phase push the whole timeline back and can increase audit costs.

If the auditor identifies findings during fieldwork, address them promptly. Some findings are minor and easily corrected; others may require formal correction programs. Getting ahead of them now is far better than discovering them at filing time.

Months 5 – 6: Finalize and file

Once fieldwork wraps up, the auditor prepares draft financial statements for your review. After you sign off, you’ll receive the final audit report, which gets attached to your Form 5500 filing.

For calendar-year plans, the Form 5500 deadline is 31 July. With an extension, you have until 15 October. Missing these deadlines carries significant penalties, up to $250 per day, so keep the timeline visible and non-negotiable.

Documentation: what you’ll need for the EBP audit

Audit prep is largely a documentation exercise. The plans that move through audits fastest are the ones that have organized, labeled files ready before the engagement even starts.

Here’s what auditors typically request:

Plan documents

Gather your plan document with all amendments, the IRS determination letter, the trust agreement, and the Summary Plan Description (SPD). You’ll also need service provider contracts and SOC 1 reports for each provider.

Financial records

Year-end financial statements, quarterly account statements, and reconciliations between your payroll system and the plan’s records.

Operational records

Payroll registers, contribution calculations with backup, and proof of deposit timing. For distributions, you’ll need request forms, beneficiary designations, and spousal consents. For loans, gather the original applications, repayment schedules, and payment history. Round this out with an employee census that shows eligibility dates and enrollment status.

Compliance documentation

Testing results for ADP/ACP, top-heavy, and coverage testing. Proof that required participant notices (like Safe Harbor notices or QDIA notices) were distributed.

One practical tip: organize everything in folders that mirror your auditor’s request list. Clear labeling reduces the time auditors spend hunting for documents — and in an audit billed by the hour, that adds up.

Common findings and how to prevent them

Most audit findings fall into a handful of recurring categories. Knowing what they are makes them preventable.

Late contribution deposits

Late deposits are both the most common finding and one of the easiest to prevent. The fix requires calculating lost earnings and correcting the deposit through the Department of Labor’s Voluntary Correction Program (VCP) if the late deposit is significant. Prevention comes down to process: automate deposit timing and monitor it monthly against the payroll calendar.

Incorrect eligibility

When an eligible employee wasn’t enrolled in the plan, the correction involves retroactive enrollment and makeup contributions, often with employer matching. Prevent this with quarterly census reviews and automated eligibility tracking that flags new or missed participants.

Missing documentation

A distribution without a beneficiary designation form, or a loan without a signed application, is a finding — even if the underlying transaction was handled correctly. Require documentation before processing transactions, and use an electronic document management system that makes it impossible to skip required files.

Operations that don’t match the plan document

If your plan document says one thing and your actual practice reflects another, auditors will find it. The correction may require amending the plan document or correcting operations through VCP. Conduct an annual review of your plan document, and communicate any operational changes to your TPA promptly.

How Trullion simplifies EBP audits

EBP audits are often stressful for a predictable reason: documentation is scattered, reconciliations live in spreadsheets, and support for key balances has to be rebuilt under deadline pressure.

Trullion helps eliminate that scramble by structuring the accounting and documentation behind your financial reporting — before the auditor arrives.

Instead of relying on disconnected spreadsheets and email threads, accounting teams use Trullion to centralize source agreements, automate complex accounting calculations, and maintain a clear audit trail from underlying documentation to financial statement impact.

For employee benefit plans, that means:

  • Supporting documentation is linked directly to the balances it drives
  • Changes are tracked automatically, creating transparency for auditors
  • Reconciliations are systemized rather than manually recreated during fieldwork
  • Calculations and assumptions are clearly documented and reviewable

Auditors gain direct visibility into how balances were calculated and what source documentation supports them — reducing back-and-forth requests and shortening review cycles.

The result is less time spent gathering support, fewer manual errors, and a smoother EBP audit process — because the accounting is structured, traceable, and audit-ready year-round.

Stop the EBP audit scramble

The plans that get through an employee benefit plan audit smoothly share three traits: they engage their auditor early, they keep their documentation organized throughout the year, and they respond to requests quickly.

The plans that struggle are the ones that treat audit prep as a once-a-year scramble: pulling files, chasing records, and discovering problems under deadline pressure.

The good news is that the scramble is optional. With the right systems in place, you can walk into every audit ready and walk out with a clean report.

Trullion gives plan administrators centralized documentation, automated reconciliation, and continuous compliance monitoring — so every audit is one you’ve already prepared for. Schedule a demo today to see Trullion in action.

Author

Katie Cavanaugh