ESOP, 403(b), and Pension Plan Audits: What Is Different

Do ESOP, 403(b), and pension plans need audits? Yes. Each of these plan types is subject to an annual independent audit once it is a large plan, which generally means 100 or more participants with account balances at the start of the plan year. The audit requirement flows from ERISA and is enforced through the Form 5500 filing, which must include audited financial statements for large plans. While the participant threshold is the same across plan types, the substance of each ESOP audit, 403(b) audit, and pension plan audit differs in meaningful ways. ESOPs involve employer stock valuation, 403(b) plans carry unique asset and regulatory complexity, and defined benefit pension plans require coordination with actuarial reports.

What Triggers an Employee Benefit Plan Audit Under ERISA

ERISA Section 103 requires that most large employee benefit plans include audited financial statements with their annual Form 5500 filing. The Department of Labor (DOL), IRS, and Pension Benefit Guaranty Corporation jointly administer the Form 5500 Series and use it to oversee plan operations, protect participants, and confirm that assets are properly reported.

The 100-Participant Threshold

A defined contribution plan is generally classified as a “large plan,” and therefore subject to an audit, when it has 100 or more participants with account balances on the first day of the plan year. This counting methodology changed for plan years beginning on or after January 1, 2023. Previously, plans counted all eligible participants, including those who had never contributed and had no balance. The revised rule counts only participants who actually have an account balance, which removed thousands of plans from the audit requirement.

The DOL estimated the change would eliminate the audit requirement for roughly 20,000 plans. For plan sponsors whose headcount sits near the threshold, verifying the accurate participant count before filing is now more important than ever.

The 80-120 Rule

A transitional buffer called the 80-120 rule prevents plans from bouncing in and out of audit status year to year. If a plan was filed as a small plan in the prior year, it can continue filing as a small plan until participants with balances reach 121. Conversely, once a plan crosses 120, it retains large-plan status until participant count falls below 100. This rule applies to all plan types covered by ERISA.

Auditor Qualifications and SAS 136

Federal law requires that the auditor be an independent, licensed CPA. The AICPA’s Statement on Auditing Standards No. 136, effective for audits of ERISA plan financial statements for periods ending on or after December 15, 2021, governs how auditors conduct and report on ERISA plan audits. SAS 136 formalized new requirements around management’s responsibilities, the former “limited-scope” audit (now called an “ERISA Section 103(a)(3)(C) audit”), and the format of the auditor’s report. Under this standard the auditor no longer issues a disclaimer of opinion for a certified-investment audit but instead issues a two-pronged report. Any plan sponsor hiring an auditor today should confirm that the firm is experienced with SAS 136 requirements specifically for the plan type involved.

ESOP Audits: What Makes Them Different

An ESOP audit shares the same ERISA framework as other employee benefit plan audits, but the subject matter is more complex. An ESOP holds employer stock as its primary or sole investment, and that creates audit challenges that do not arise in a typical 401(k) or 403(b) audit.

Annual Valuation of Employer Stock

The centerpiece of every ESOP audit is the annual independent appraisal. Internal Revenue Code Section 401(a)(28)(C) requires that employer securities not readily tradable on an established securities market be valued by an independent appraiser at least annually, and ERISA requires that the ESOP pay no more than adequate consideration, meaning fair market value. For privately held companies, no public market price exists, so the valuation is a formal business appraisal rather than a lookup.

The auditor’s job is not to independently re-value the company, but to evaluate whether the valuation process was appropriate. Was the appraiser truly independent? Was the methodology reasonable and well-documented? Did the trustee exercise proper oversight in relying on the report? These questions require auditors who understand business valuation standards in addition to GAAP financial reporting.

Accounting for ESOP shares follows ASC 718-40 (formerly SOP 93-6). For a leveraged ESOP, compensation cost is measured at the average fair value of shares during the period they are committed to be released to participants, not at the historical cost paid for the shares. This means that rising company valuations increase the compensation expense recognized each year, which can have a material effect on the plan sponsor’s financial statements.

Leveraged ESOPs Add Complexity

Many ESOPs are funded through a loan: the ESOP borrows money (often from the company or a bank) to purchase shares, and the loan is repaid as shares are released over time. Unallocated shares sitting in the suspense account during the repayment period are not yet “owned” by participants and must be tracked separately. Auditors test that shares are being released correctly per the plan document and that the loan terms comply with ERISA’s prohibited transaction exemption rules.

Repurchase Obligation

Unlike a 401(k) invested in publicly traded mutual funds, participants in a private-company ESOP must be offered a put option when they receive a distribution, giving them the right to sell shares back to the company at fair value. Auditors review whether the plan and the company have adequately assessed and planned for this repurchase obligation, since it can represent a significant future cash demand on the sponsor.

For a deeper look at how employee benefit plan audits work more broadly, see Modus’s employee benefit plan audit services.

403(b) Plan Audits: Key Differences From a 401(k)

A 403(b) plan is a tax-sheltered annuity arrangement available to public schools, nonprofit hospitals, universities, and other tax-exempt organizations. Most 403(b) plans that are subject to ERISA follow the same audit threshold rules as 401(k) plans, where 100 or more participants with account balances triggers a large-plan audit, but several features make 403(b) audits distinctly different in practice.

Which 403(b) Plans Are Subject to ERISA

Not every 403(b) plan is governed by ERISA. Governmental plans (state and local employers) and church plans are generally exempt from ERISA’s Title I requirements, including the audit obligation. Plans sponsored by private nonprofit organizations, such as hospitals, charities, and private universities, are typically ERISA-covered and will need an audit when they reach the large-plan threshold.

Church-sponsored 403(b)(9) plans are automatically classified as church plans and exempt from Form 5500 filing and the associated audit requirement, unless the organization elects ERISA coverage. Plan sponsors at religious organizations should confirm their plan’s ERISA status with counsel before assuming an audit is not required.

Pre-2009 Contract Complexity

403(b) plans that existed before January 1, 2009, often contain annuity contracts and custodial accounts accumulated over decades. Because some older contracts were written before modern recordkeeping requirements applied, opening balances from those periods can lack the documentation an auditor needs to test prior-period balances. While the industry has largely worked through the most acute problems of this era, plans with long histories may still carry contract complexity that requires additional audit procedures.

Investment Mix and Vendor Management

403(b) plans frequently use multiple insurance company annuity contracts and mutual fund custodial accounts held across several vendors. Reconciling participant-level data across vendors, confirming that all accounts are properly aggregated for plan reporting, and obtaining complete investment schedules from each carrier can be time-consuming. Auditors must obtain confirmations or third-party reports from each record keeper, and incomplete vendor cooperation is a recurring challenge in 403(b) audits.

SECURE 2.0 Changes Affecting 403(b) Plans

The SECURE 2.0 Act extended long-term, part-time employee eligibility rules to ERISA-covered 403(b) plans, with provisions generally effective for plan years beginning after December 31, 2024. This change may affect participant counts and administrative complexity for nonprofit plan sponsors going forward.

Defined Benefit Pension Plan Audits: The Actuarial Dimension

Defined benefit (DB) pension plans promise participants a specific monthly benefit at retirement, calculated by a formula based on salary, years of service, and other factors. Unlike defined contribution plans where investment risk falls on participants, DB plans place investment and longevity risk on the employer. This creates an audit challenge that goes well beyond reviewing investment statements.

Actuarial Assumptions Drive the Numbers

Every year, the plan’s actuary prepares a valuation that calculates the plan’s projected benefit obligation and the required minimum contribution. The actuary relies on assumptions about discount rates, mortality tables, salary growth, retirement patterns, and turnover. Small changes in any of these inputs can produce large swings in the reported liability.

During the audit, the auditor reviews the actuarial report, tests that it was prepared by a qualified actuary, and evaluates whether the assumptions used are reasonable and consistent with prior years. When assumptions change, auditors confirm that the change is appropriately disclosed in the financial statements. This work often involves consultation with the auditing firm’s own actuarial specialists.

Schedule SB and Funding Requirements

Single-employer defined benefit plans must meet annual minimum funding standards under ERISA Section 302 and Internal Revenue Code Section 412, with the detailed minimum-required-contribution calculation set by Internal Revenue Code Section 430 and its parallel ERISA Section 303. The funding calculation is reported on Schedule SB of the Form 5500. Auditors confirm that the amounts on Schedule SB reconcile with the actuarial report and that any required contributions were actually funded on time. Late or missed contributions are a significant compliance issue that must be disclosed.

PBGC Involvement

Most private-sector defined benefit plans are insured by the Pension Benefit Guaranty Corporation (PBGC), which also has its own annual premium filings and, in distressed situations, can assert termination authority. Auditors do not audit PBGC filings directly, but they consider PBGC-related disclosures and whether the plan faces a potential underfunding or termination risk that warrants additional financial statement disclosure.

Frozen and Terminating Plans

Many employers have frozen their defined benefit plans, meaning current employees no longer accrue new benefits, or are moving through a plan termination process. Frozen plans still require an annual audit as long as they have assets and participants. Terminating plans have their own set of complex audit and disclosure requirements, including annuity purchases and participant notification obligations.

For questions about how these audits fit within a broader assurance engagement, Modus’s audit and assurance services cover plan and organizational audits.

How to Choose an Auditor for a Specialized Plan

Not all CPA firms are equally qualified to audit ESOPs, 403(b) plans, or pension plans. The DOL has documented recurring quality problems with EBP audits and emphasizes that plan sponsors should select auditors with demonstrated, specific experience in the plan type. Questions worth asking a prospective auditor include:

• How many ESOPs (or 403(b) plans, or defined benefit plans) do you audit each year?
• Is your firm a member of the AICPA’s Employee Benefit Plan Audit Quality Center (EBPAQC)?
• How do you handle the stock valuation review in an ESOP audit?
• What is your process for coordinating with actuaries on a defined benefit engagement?

An AI-native audit process can help reduce friction in all of these plan types, particularly around data gathering, participant reconciliation across multiple record keepers, and documentation of complex areas like stock valuations or actuarial assumption reviews.

Related reading: 80-120 Participant Rule: When a 401(k) Audit Is Required

Frequently Asked Questions

Does an ESOP require an audit every year?

Yes, if the ESOP has 100 or more participants with account balances on the first day of the plan year, an independent audit is required annually as part of the Form 5500 filing. Plans below 100 participants generally file as small plans and are not required to include audited financial statements.

Do 403(b) plans need an audit?

ERISA-covered 403(b) plans with 100 or more participants with balances must have an annual audit. Governmental plans and church plans are typically exempt from ERISA’s audit requirement, though church organizations can elect ERISA coverage voluntarily. Private nonprofit employers sponsoring 403(b) plans generally are subject to the requirement.

What makes an ESOP audit different from a regular 401(k) audit?

The primary difference is the employer stock component. ESOPs hold employer shares, usually in a private company, that must be valued annually by an independent appraiser under Internal Revenue Code Section 401(a)(28)(C). The auditor reviews the appraisal process, confirms shares are being allocated correctly under ASC 718-40, and tests the ESOP loan if the plan is leveraged. These procedures require specialized knowledge that goes beyond a standard defined contribution plan audit.

How does participant counting work after the 2023 rule change?

For plan years beginning on or after January 1, 2023, only participants who have an account balance at the start of the plan year are counted toward the 100-participant threshold. Employees who are eligible to participate but have never contributed or have a zero balance are excluded. This change eliminated the audit requirement for many smaller plans that previously crossed the threshold only due to eligible-but-inactive employees.

What role does an actuary play in a pension plan audit?

The plan’s actuary prepares an annual valuation that calculates the plan’s benefit obligation and required contribution using assumptions about discount rates, mortality, and salary growth. The auditor reviews the actuarial report, evaluates whether assumptions are reasonable and consistent, and confirms that the Schedule SB figures on the Form 5500 match the actuarial work. For complex plans, the auditing firm may engage its own actuarial specialists to assist with this review.

When does a pension plan no longer need an audit?

A defined benefit pension plan that has been fully terminated and all assets distributed to participants (or annuity contracts purchased) no longer needs an annual audit because there are no plan assets remaining. A frozen plan, where benefit accruals have stopped but assets and participants remain, continues to require an audit until it meets the requirements for small-plan status or is fully terminated.