When Is a 401(k) Audit Required? The 100-Participant Rule

A 401(k) plan generally requires an independent audit once it reaches 100 or more participants with account balances at the beginning of the plan year. That threshold, set under the Employee Retirement Income Security Act of 1974 (ERISA), triggers large-plan status and requires the plan sponsor to attach audited financial statements to its annual Form 5500 filing with the Department of Labor (DOL). For plan years beginning on or after January 1, 2023, the participant count is based solely on participants with account balances, a significant change from the prior method that counted all employees eligible to participate.

Why the 100-Participant Threshold Triggers a 401(k) Audit

ERISA requires most employer-sponsored retirement plans to file a Form 5500 annual report with the DOL each year. The form serves as the primary disclosure and compliance document for the plan, and the size of the plan determines exactly what must be included.

Plans with fewer than 100 participants generally qualify as “small plans” and may file the streamlined Form 5500-SF without attaching an audit. Plans with 100 or more participants are “large plans” under ERISA and must file the full Form 5500, which includes audited financial statements prepared by an Independent Qualified Public Accountant (IQPA). The audit opinion is not optional and cannot be waived.

The DOL and IRS jointly administer the Form 5500 filing system. The DOL’s Employee Benefits Security Administration (EBSA) oversees plan audit quality, and its guidance on selecting an auditor makes clear that the auditor must be licensed, independent, and experienced with ERISA-plan engagements.

What “Large Plan” Means in Practice

A large plan is required to:

• File the complete Form 5500 (not the short-form 5500-SF).
• Attach audited financial statements from an independent qualified public accountant.
• Include Schedule H (financial information) rather than the simplified Schedule I.
• Provide a complete list of plan assets (Schedule of Assets) along with other required schedules.

Failing to attach a required audit opinion does not make the Form 5500 delinquent in the technical sense, but the DOL treats an incomplete filing as if it were never filed, which can expose the plan sponsor to significant penalties.

The 2023 Change: Counting Participants With Balances

Before plan years beginning in 2023, the participant count included every employee who was eligible to participate in the 401(k), regardless of whether they had actually enrolled or had any money in the plan. That approach swept in large numbers of employees who had simply never elected a contribution, inflating headcounts and pulling many plans across the 100-participant audit threshold.

Starting with plan years beginning on or after January 1, 2023, only participants who have an account balance at the beginning of the plan year are counted. New plans count participants with balances at the end of their first plan year. The change came through a formal DOL rulemaking that revised Form 5500 reporting requirements and was published in the Federal Register in 2023.

The practical effect is substantial. The DOL estimated that approximately 19,500 plans would fall out of the large-plan audit requirement under the new counting method, because those plans had more than 100 eligible employees but fewer than 100 with actual account balances. For those plan sponsors, the 2023 change eliminated an annual audit cost that was previously unavoidable.

Who Counts as a Participant With a Balance

Under the new rule, participants counted toward the threshold include:

• Active employees who have deferred into the plan and have a balance.
• Terminated employees who still have a balance remaining in the plan and have not yet received a full distribution.
• Retirees receiving benefits or with a balance pending distribution.

Employees who are eligible to enroll but have never contributed and have no balance do not count. Beneficiaries receiving benefits after a participant’s death are typically included in the participant count as well.

Why This Matters for Growing Plans

The balance-based counting method creates a more predictable threshold for many small and mid-size employers. A company can hire aggressively and add many new eligible employees without crossing the audit threshold, as long as those employees have not yet enrolled. However, plan sponsors should track enrolled-participant counts carefully. A year of strong auto-enrollment participation or a plan merger can push a plan across 100 balances quickly and create a first-year audit requirement.

The 80-120 Rule: A Buffer for Plans Near the Line

ERISA regulations include a transition provision often called the 80/120 rule. When a plan’s participant count at the beginning of the plan year is between 80 and 120, and a Form 5500 was filed for the prior year, the plan may elect to file in the same category (small or large) as it did the prior year. In practice, a plan that filed as a small plan can continue to file as a small plan until its participant count reaches 121, even after it crosses 100. Once a plan reaches more than 120 participants, it must transition to large-plan filing and obtain an audit for that plan year.

Conversely, a plan that has been filing as a large plan can switch back to small-plan status in any year its participant count drops below 100 at the beginning of that plan year. There is no multi-year waiting period to step back down.

The 80/120 rule exists to reduce administrative whiplash for plans that hover near the threshold. However, it does not remove the obligation to monitor the count each year. A plan sponsor who inadvertently crosses 120 without commissioning an audit faces the same non-compliance exposure as one who ignored the 100-participant trigger entirely.

For a deeper look at how this buffer rule applies in practice, see Modus’s guide to the 80/120 participant rule.

What the 401(k) Audit Actually Covers

A 401(k) plan audit is an audit of the plan’s financial statements, not a general review of the plan’s investment performance or HR policies. The auditor examines the plan’s financial statements and issues a written opinion on whether those statements present fairly, in all material respects, the plan’s net assets available for benefits and the changes in those net assets for the plan year.

In practice, the audit typically covers:

• Plan assets: verifying the existence, ownership, and proper valuation of investments held by the plan’s trustee.
• Contributions: confirming that employee deferrals and employer contributions were remitted to the plan promptly and accurately.
• Benefit payments and distributions: testing that distributions and loans were processed correctly and in compliance with plan terms.
• Administrative expenses: reviewing fees paid from plan assets for reasonableness and proper authorization.
• Plan document compliance: identifying whether the plan was operated in material compliance with its written plan document and ERISA requirements.

Full-Scope vs. ERISA Section 103(a)(3)(C) Audits

Before SAS No. 136 (AICPA AU-C Section 703), most 401(k) plan audits were conducted as “limited-scope audits,” where the auditor disclaimed an opinion on the portion of plan assets held and certified by a qualified financial institution. That structure has been replaced.

Under AICPA SAS No. 136, effective for plan years ending on or after December 15, 2021, audits of ERISA plans now come in two forms:

• Full-scope audits. The auditor performs procedures on all plan assets, including investment information, and issues a single opinion on the plan’s financial statements.
• ERISA Section 103(a)(3)(C) audits. When investment information is certified by a qualified institution (such as a regulated bank, trust company, or insurance company), the plan sponsor can elect this audit type. The auditor performs procedures on the non-investment portions of the financial statements and issues a two-part opinion: one part on whether the financial statements fairly present information other than the certified investment information, and a second part on whether the certified investment information is fairly presented in conformity with the certification. This is not a scope limitation; it is a separate audit structure with its own reporting requirements.

The vast majority of 401(k) plans use the ERISA 103(a)(3)(C) structure because their assets are held at regulated custodians. The plan sponsor, not the auditor, must make the election to use this audit type, and the plan document must permit it.

When the Audit Must Be Completed and Filed

The Form 5500 for a calendar-year plan is due on July 31 of the following year. For a plan year ending December 31, 2025, the filing deadline is July 31, 2026. Plan sponsors can extend the deadline by 2.5 months by filing Form 5558 with the IRS, moving the deadline to October 15. The audit report must be complete and attached before the Form 5500 is filed.

Most plan audits take 8 to 14 weeks from the time the auditor receives all requested documentation. For calendar-year plans, that means sponsors who want to file on time, without an extension, should engage their auditor in March or April. Plans that consistently wait until June often end up filing on extension, which is common but not ideal.

Consequences of Missing the Audit Requirement

Not attaching a required audit to a Form 5500 is treated as a failure to file. The DOL can assess civil penalties of up to $2,739 per day for each day the plan administrator fails or refuses to file a complete annual report. The DOL uses its Delinquent Filer Voluntary Compliance Program (DFVCP) as an incentive for self-correction for plans that come forward voluntarily before receiving a DOL notice. Under the DFVCP, large plans are capped at $2,000 per delinquent annual report, up to a maximum of $4,000 per plan for multiple late years. Small plans face lower caps of $750 per report and $1,500 per plan.

Beyond penalties, a missing audit is a significant fiduciary red flag. ERISA holds plan sponsors and fiduciaries personally liable for breaches of their duties. A DOL investigation triggered by a missing audit can expand into a broader review of plan administration, and enforcement actions in 2024 resulted in EBSA recovering nearly $1.4 billion for plan participants across the country.

Plan sponsors who discover they should have obtained an audit for a prior year should consult with an ERISA attorney and an auditor before using the DFVCP. The correction process involves both a retroactive audit and a late filing, and the sequence matters.

Working With a Qualified 401(k) Auditor

The DOL requires that a 401(k) plan auditor be a licensed or certified public accountant. Federal law also requires the auditor to be independent, meaning no financial interest in the plan or plan sponsor that would compromise objectivity.

Beyond the baseline licensing requirement, the DOL and the AICPA’s Employee Benefit Plans Audit Quality Center strongly encourage plan sponsors to select auditors with meaningful experience in ERISA plan audits specifically. Benefit plan audits involve unique compliance considerations, specialized financial statement presentation, and plan-document compliance testing that general-purpose auditors may not routinely perform.

Modus’s employee benefit plan audit practice handles 401(k), 403(b), defined benefit, and profit-sharing plan audits, and uses source-linked workpapers and structured document requests to reduce the preparation burden on plan sponsors’ internal teams.

The broader audit and assurance services Modus provides follow the same methodology: structured, evidence-based, and designed to give plan sponsors a clear picture of their compliance posture without unnecessary back-and-forth.

Related reading: Employee Benefit Plan Audit: How to Prepare

Frequently Asked Questions

When is a 401(k) audit required?

A 401(k) audit is required when the plan qualifies as a “large plan” under ERISA, which generally means 100 or more participants with account balances at the beginning of the plan year. For plan years beginning on or after January 1, 2023, the count is based on participants who actually have a balance in the plan, not all employees who are eligible to participate.

Does every 401(k) plan need an annual audit?

No. Plans with fewer than 100 participants with account balances are generally small plans and are exempt from the audit requirement. They file the Form 5500-SF and do not attach audited financial statements. The 80/120 rule allows plans that previously filed as small plans to continue doing so until their participant count reaches 120.

What changed about 401(k) audit requirements in 2023?

Starting with plan years beginning on or after January 1, 2023, plan sponsors count only participants who have an account balance, not all employees eligible to participate. Previously, an employee who was eligible to join the plan but had never enrolled still counted toward the 100-participant threshold. The new method removed approximately 19,500 plans from the audit requirement nationally.

How long does a 401(k) audit take?

Most 401(k) plan audits take 8 to 14 weeks once the plan sponsor has delivered all requested documentation. For calendar-year plans, sponsors should expect to engage an auditor by March or April to file the Form 5500 by the July 31 deadline without needing an extension.

What happens if a 401(k) plan skips a required audit?

Filing a Form 5500 without a required audit is treated as an incomplete or delinquent filing. The DOL can assess penalties of up to $2,739 per day, with no cap. The DOL’s Delinquent Filer Voluntary Compliance Program (DFVCP) allows sponsors to self-correct with reduced penalties, capped at $4,000 per plan for large plans, but both a retroactive audit and a corrected filing are typically required.

What is an ERISA Section 103(a)(3)(C) audit?

An ERISA Section 103(a)(3)(C) audit, formerly called a limited-scope audit, is a type of 401(k) plan audit where the plan sponsor elects to have the auditor rely on investment information certified by a qualified financial institution (such as a bank or trust company) rather than independently auditing all plan assets. The auditor issues a two-part opinion under this structure. This is not a lesser audit; it is a separate audit type under AICPA SAS No. 136 and applies to most 401(k) plans whose assets are held at regulated custodians.