ERISA Audit and Form 5500: The Plan Audit Requirement Explained

An ERISA audit is an independent financial audit of an employee benefit plan required by the Employee Retirement Income Security Act of 1974. The audit requirement is triggered through Form 5500, the annual report that most ERISA-covered plans must file with the Department of Labor (DOL). Generally, any plan that qualifies as a “large plan,” meaning 100 or more participants with account balances at the start of the plan year, must attach an audited financial statement to its Form 5500 filing. That threshold, and the way it is counted, changed significantly for plan years beginning on or after January 1, 2023.

What Is an ERISA Audit?

ERISA Section 103 requires that large employee benefit plans obtain an annual audit from an Independent Qualified Public Accountant (IQPA). The auditor examines the plan’s financial statements and issues an opinion on whether they present fairly, in all material respects, the plan’s financial position and the results of its operations. That opinion is then attached to the Form 5500 annual report filed jointly with the DOL and IRS through the EFAST2 electronic filing system.

The purpose is straightforward: Congress created ERISA to protect the retirement assets of American workers, and independent audit oversight is a core mechanism for ensuring plan assets are properly accounted for and disclosed to participants and the government.

Which Plans Are Covered?

ERISA covers a wide range of employee benefit plans, including:

• Defined contribution plans: 401(k), 403(b), profit-sharing, money purchase, and stock bonus plans.
• Defined benefit pension plans: traditional pension plans promising a specified monthly benefit.
• Welfare benefit plans: plans providing medical, dental, vision, life insurance, disability, or similar benefits. A welfare plan generally triggers an audit only when it is funded (for example, holds assets in a trust) and covers 100 or more participants. Plans that are unfunded, fully insured, or a combination of the two are typically exempt from the audit requirement even with 100 or more participants, though they may still file Form 5500.

One-participant plans (owner-only businesses) and certain government or church plans are generally exempt from ERISA’s audit requirement, though they may still have separate filing obligations.

How Form 5500 Triggers the ERISA Audit Requirement

Form 5500 is the annual return/report filed by most ERISA-covered plans. Think of it as a combined tax return and financial disclosure for benefit plans. It collects information about plan finances, investments, operations, and compliance. Filing is mandatory and must be done electronically.

The form itself is what determines whether an audit is needed. When a plan reports 100 or more eligible participants (under the rules described below), it must include audited financial statements as an attachment. Without those statements, the Form 5500 is considered incomplete, and an incomplete filing is treated as a failure to file.

Filing Deadline

For calendar-year plans, Form 5500 is due by July 31 of the following year. Plans may extend the deadline by 2.5 months (to October 15) by filing Form 5558 by the original due date. For plan year 2025, calendar-year filers face a deadline of July 31, 2026, with the extension running to October 15, 2026.

Missing the deadline carries serious consequences. The DOL can assess penalties of up to $2,739 per day for each day a filing is late (as adjusted for inflation effective January 2025), with no statutory maximum. The IRS can pile on an additional penalty of up to $250 per day, capped at $150,000 per plan year. The DOL’s Delinquent Filer Voluntary Compliance Program (DFVCP) offers reduced penalties for sponsors who come forward proactively.

The 100-Participant Threshold and the 2023 Rule Change

The bright-line trigger for the ERISA audit requirement is 100 participants. But “participants” means something very specific, and the definition changed materially for plan years beginning on or after January 1, 2023.

The Old Method: Eligible Participants

Before 2023, plans counted all eligible participants, including employees who were eligible to participate but had never enrolled and had no account balance. A company with 121 eligible employees would be a large plan even if only 50 of those employees had actually deferred money into the plan.

The New Method: Participants With Account Balances

Under the revised Form 5500 rules effective January 1, 2023, defined contribution plans count only participants with an account balance at the beginning of the plan year. Former employees with leftover balances count. Eligible employees with zero balances do not.

The DOL estimated this change would remove roughly 19,500 defined contribution plans from the large-plan category, relieving them of the audit requirement. For plan sponsors near the 100-participant line, this is meaningful: a plan with 130 eligible employees but only 85 with actual account balances is now a small plan under the new count and does not need an audit, provided it meets the conditions of the DOL small plan audit waiver at 29 CFR 2520.104-46.

The 80-120 Rule (Transition Relief)

Even before the 2023 change, the rules included a soft transition band called the 80-120 rule. A plan with between 80 and 120 participants at the beginning of the plan year may continue to file in the same category (large or small) as it did the prior year, provided the plan filed a Form 5500 the prior year. Once a plan exceeds 120 participants, large-plan status and the audit requirement kick in regardless of prior-year status.

The 80-120 rule still applies under the new participant-counting methodology. It gives growing plans some runway before the audit obligation locks in.

What the ERISA Audit Actually Covers

An ERISA audit is not simply a review of contributions and disbursements. The auditor examines the plan’s complete financial statements, which typically include:

• The statement of net assets available for benefits.
• The statement of changes in net assets available for benefits.
• Notes to the financial statements, including disclosures about investments, contributions, and benefit obligations.

The auditor also reviews supplemental schedules required by the DOL, such as the schedule of assets held for investment and the schedule of reportable transactions. These schedules are filed as part of the Form 5500 and are available to the public.

ERISA Section 103(a)(3)(C) Audits

Many plans hold investment assets at a qualified institution, such as a bank, insurance company, or registered broker-dealer, that provides a certification of the account values. Under ERISA Section 103(a)(3)(C), plan administrators can instruct the auditor to rely on that certification for the certified investment information rather than independently testing it.

This arrangement was historically called a “limited scope audit.” Under AICPA Statement on Auditing Standards No. 136 (SAS 136), now AU-C section 703, which became effective for plan years ending on or after December 15, 2021, the terminology and reporting changed. The auditor now issues a two-part opinion: an unmodified opinion on whether the certified investment information agrees with the custodian certification, and a separate opinion on the non-certified financial information. This replaces the old disclaimer of opinion, giving plan participants and regulators a more transparent and useful report.

Who Qualifies as an ERISA Auditor?

The IQPA must be licensed as a CPA and must meet independence requirements. The DOL has long expressed concern about audit quality in the EBP space. Its quality studies have found that smaller firms with fewer ERISA clients produce a disproportionate share of deficient audits. Plan sponsors are not required to use a specialist firm, but hiring an auditor with meaningful ERISA experience reduces the risk of a deficient report and the regulatory scrutiny that follows.

The DOL’s Employee Benefits Security Administration (EBSA) oversees plan compliance and has the authority to reject deficient audits and refer matters for further enforcement action.

Consequences of Skipping or Botching the ERISA Audit

Plan sponsors who fail to include a required audit with their Form 5500 face a technically incomplete filing, which triggers penalties. But the exposure goes further:

• DOL investigation. An incomplete Form 5500 is a red flag that can trigger a plan examination. EBSA has the authority to compel production of records, interview fiduciaries, and assess additional penalties.
• Fiduciary liability. Plan administrators are ERISA fiduciaries. Failing to arrange a required audit is a breach of fiduciary duty, exposing responsible parties to personal liability.
• Participant harm. Without independent oversight, financial errors and misappropriation can go undetected, directly harming participants whose retirement assets are at stake.

How Modus Approaches ERISA Plan Audits

Modus’s employee benefit plan audit practice focuses on the quality and efficiency plan sponsors need. The ERISA audit process is document-intensive: contribution reconciliations, participant census data, investment confirmations, benefit payment testing, and DOL supplemental schedules all need to be gathered and examined under tight filing deadlines. Modus uses AI-assisted workpaper tools to streamline the evidence-gathering process, which shortens turnaround time and reduces the back-and-forth burden on the plan administrator. Source-linked workpapers also make it straightforward to walk through conclusions if questions arise post-filing.

Some plan sponsors have broader needs, such as annual financial statement audits alongside their EBP audit or assurance work connected to a transaction. Modus’s broader audit and assurance capabilities cover those engagements as well.

Related reading: ESOP, 403(b), and Pension Plan Audits: What Is Different

Frequently Asked Questions

What triggers an ERISA audit?

An ERISA audit is triggered when an employee benefit plan meets the “large plan” threshold and must attach audited financial statements to its Form 5500 annual report. For defined contribution plans (such as 401(k) plans), large-plan status is generally reached when the plan has 100 or more participants with account balances at the beginning of the plan year, using the counting methodology effective for plan years beginning on or after January 1, 2023.

What is the difference between a large plan and a small plan under ERISA?

A large plan has 100 or more participants with account balances at the start of the plan year and must include audited financial statements with its Form 5500. A small plan has fewer than 100 such participants and may file the shorter Form 5500-SF without an audit requirement. Plans with between 80 and 120 participants can continue to file under their prior-year category under the 80-120 transition rule.

Did the participant counting rules for the ERISA audit threshold change?

Yes. For plan years beginning on or after January 1, 2023, defined contribution plans count only participants with an account balance rather than all eligible participants. This change removed approximately 19,500 plans from large-plan status, eliminating their audit requirement. Plans that were borderline large under the old rules should recount under the new methodology.

What is an ERISA Section 103(a)(3)(C) audit?

An ERISA Section 103(a)(3)(C) audit (formerly called a limited scope audit) is a type of ERISA audit where the auditor relies on a certification from a qualified financial institution for the investment information, rather than independently testing the fair value of those investments. Under SAS 136 (effective for plan years ending on or after December 15, 2021), the auditor issues a two-part opinion rather than the older disclaimer of opinion, providing more useful information to stakeholders.

What are the penalties for not filing Form 5500 on time?

The DOL can assess up to $2,739 per day (as of 2025) for each day a Form 5500 is filed late, with no maximum cap. The IRS may assess up to $250 per day, capped at $150,000 per plan per year. Plan sponsors who have missed prior filings can use the DOL’s Delinquent Filer Voluntary Compliance Program to file late returns at significantly reduced penalty rates.

Does every 401(k) plan need an ERISA audit?

No. 401(k) plans with fewer than 100 participants with account balances at the beginning of the plan year (or between 80 and 120 participants eligible to file as a small plan under the prior-year rule) are not required to obtain an audit. One-participant plans, typically owner-only businesses, are generally exempt from the Form 5500 audit requirement altogether and may file Form 5500-EZ instead.