You never hired your 100th employee — yet your 401(k) administrator just told you the plan needs an independent audit this year. How is that possible? Because since 2023, the trigger is no longer how many people are merely eligible for your plan. It is how many participants actually hold an account balance on the first day of the plan year — and with auto-enrollment, long-term part-time eligibility, and former employees who left balances behind, plenty of 60-person companies now clear the 100-participant line without realizing it.
That surprise usually arrives with a price tag: a first-time plan audit typically costs a small or mid-size business somewhere in the range of $8,000 to $12,000, takes several months of back-and-forth with an auditor, and has to be attached to your Form 5500 filing. Miss the requirement and the filing counts as incomplete, with penalties running from the original deadline. This guide explains exactly what triggers the audit, how the 80-120 rule can buy you an extra year, and the preparation checklist that makes a first audit boring instead of painful.
Why Your Plan Suddenly Needs an Audit
Under ERISA, an employee benefit plan that covers 100 or more participants at the beginning of the plan year is a "large plan." Large plans must file Form 5500 with audited financial statements and an opinion letter from an independent qualified public accountant (IQPA). Small plans file a shorter return and skip the audit entirely.
Three details catch first-timers off guard:
The count happens on day one. What matters is the participant headcount on the first day of the plan year — January 1 for a calendar-year plan — not the average over the year or the headcount when you file. If you cross the line mid-year, the audit obligation starts with the following plan year, which gives you time to prepare.
Since 2023, only participants with account balances count. Before plan years beginning in 2023, every eligible employee counted — even someone who never contributed a dollar. The Department of Labor changed the methodology so that only participants with an account balance at the beginning of the year count toward the 100-participant threshold. For many businesses with low participation rates, that change removed the audit requirement. But it cuts the other way too: former employees who left balances in the plan still count, and automatic enrollment plus new long-term part-time eligibility rules keep pushing balances into more accounts each year.
Separated employees with balances count. Anyone who quit or was terminated but left money in the plan is still a participant for counting purposes. A company with 70 active employees and 35 ex-employees who never rolled their balances over is a 105-participant plan. Regularly sweeping out small balances — plans may force out former-employee balances under the legal cash-out limit — is one of the simplest ways to manage your headcount, and it is also good plan hygiene.
A quick self-test
Pull your recordkeeper's participant report as of the first day of the current plan year and count every account with a balance greater than zero — active, terminated, retired, and beneficiary accounts included. If the total is 100 or more, you are almost certainly a large plan for this year. If it is between 80 and 120, read the next section before you hire an auditor, because you may have an election to make.
The 80-120 Rule: The Buffer That Prevents Flip-Flopping
Congress knew headcount bounces around, so there is a buffer: if your plan filed as a small plan last year, it may keep filing as a small plan this year so long as the beginning-of-year count is 120 or fewer. Only when the count exceeds 120 does the audit become mandatory. Once you file as a large plan, the mirror rule applies — you can drop back to small-plan status only after falling below 100.
| Last year's filing | Beginning-of-year count | This year's status |
|---|---|---|
| Small plan | 120 or fewer with balances | Small — no audit required |
| Small plan | 121 or more with balances | Large — audit required |
| Large plan | 100 or more with balances | Large — audit required |
| Large plan | 99 or fewer with balances | Small — no audit required |
Two exceptions worth knowing. First, the 80-120 rule does not apply in a plan's first year: a brand-new plan with 100 or more participants with balances at the end of its first year files as a large plan and needs an audit. Second, electing small-plan status when you qualify is optional, not automatic — confirm with whoever prepares your Form 5500 that the election was actually made, because filing the wrong schedule is itself a compliance failure.
What the Audit Actually Involves
A 401(k) audit is a financial-statement audit of the plan itself — not of your company. The IQPA examines whether the plan's financial statements are fairly stated and whether the plan operated according to its own written document and ERISA's requirements. Expect the auditor to test:
- Contributions: that employee deferrals were deposited promptly and employer match and profit-sharing amounts follow the plan's formula
- Eligibility and compensation: that the people let into the plan, and the pay figures used for their contributions, match the plan document's definitions
- Distributions and loans: that payouts, hardship withdrawals, and participant loans were authorized, documented, and repaid on schedule
- Participant data and census: that the headcount, hire dates, hours, and termination dates feeding the recordkeeper are accurate
- Internal controls: that someone independent reviews payroll feeds, approves distributions, and reconciles accounts — the classic segregation-of-duties check
Fieldwork typically runs several weeks, followed by a management letter documenting any deficiencies and a final audit report that gets attached to the Form 5500. The whole cycle commonly stretches over two to four months, which is why auditors tell first-timers to engage them in the first quarter rather than the summer.
One more person to line up early: the auditor must be independent. The CPA firm that keeps your corporate books can audit your plan only under strict independence conditions, and many small businesses simply hire a specialist employee-benefit-plan audit firm to keep the lines clean.
Deadlines and the Cost of Getting It Wrong
For calendar-year plans, Form 5500 — with the audit report attached — is due July 31 of the following year. Filing Form 5558 by that date buys a one-time extension to October 15. Most large-plan filers take the extension as a matter of routine, because the audit rarely finishes by July.
Three penalty traps matter:
- No audit means no complete filing. A Form 5500 filed without a required IQPA report is treated as incomplete, as if you had not filed at all.
- Late penalties run from the original deadline. Even if you properly extended to October 15, penalty calculations start the day after July 31 — so a filing completed October 20 is roughly 80 days late, not five.
- Voluntary correction is dramatically cheaper. The DOL's delinquent-filer correction program caps penalties at a small fraction of what regulators can assess once they find the failure themselves. If you discover a missed filing, correcting it before you are caught is one of the highest-return phone calls you will ever make.
Your First-Audit Preparation Checklist
The difference between a smooth audit and a miserable one is almost entirely preparation. Auditors consistently say the same thing: organized sponsors finish faster and pay less, because fewer billable hours go to chasing documents. Work through this list before fieldwork starts:
Gather the plan's paper trail. The adoption agreement and all amendments, the summary plan description, the IRS determination or opinion letter, service agreements with the recordkeeper and custodian, trustee statements, and board or committee minutes authorizing the plan and its amendments.
Pull payroll and census records. Full-year payroll registers, W-2 totals, the census file with hire dates, hours, and termination dates, and proof of when each deferral deposit left payroll and reached the trust. Late deferral deposits — even by a few days — are among the most common findings in first audits, so reconcile every pay date now.
Collect the prior filings. The last several years of Form 5500 filings with all schedules, plus any correspondence with regulators. The auditor uses these to confirm consistency and to check whether last year's small-plan election affects this year's status.
Reconcile the trust. Year-end statements from the custodian, the recordkeeper's participant-level totals, and proof the two tie to each other and to the payroll records. Unexplained gaps between what payroll sent and what the trust received are exactly what auditors are paid to find.
Document loans, distributions, and forfeitures. Every loan request and repayment schedule, every distribution or rollover authorization, and the forfeiture account activity. Orphan forfeiture balances sitting unallocated for years are a repeat finding.
Review fidelity bonding and fiduciary files. ERISA requires bonding for people handling plan assets, and auditors will ask for evidence. Also assemble your fee disclosures and any documentation showing the plan's investment committee actually meets and reviews the fund lineup.
Hire the IQPA early and budget realistically. Plan on $8,000 to $12,000 for a straightforward small-plan audit, more for complex plans — and start the search in the first quarter. The good specialist firms book up by spring, and a rushed summer engagement costs more and finds less patience for disorganized records.
The Findings That Trip Up First-Timers (and How to Avoid Them)
Most first-audit findings cluster in the same handful of areas, which means they are preventable:
Late employee contributions. The rule requires deferrals to reach the trust as soon as reasonably possible — for small plans there is a commonly cited seven-business-day safe harbor, but the real standard is promptness. Set up same-day or next-day funding from payroll and calendar a monthly check that every deposit cleared.
Wrong definition of compensation. Your plan document defines which pay counts — base salary only, or bonuses, commissions, and overtime too. Payroll systems frequently use a different definition than the document, silently over- or under-contributing for years. Compare the two definitions line by line before the auditor does.
Eligibility mistakes in both directions. People let in too early cost the plan; people kept out too long create a correction liability with lost-earnings calculations. With long-term part-time employees entering eligibility, re-verify your hours-tracking now rather than during fieldwork.
Loan and distribution paperwork gaps. Missing promissory notes, loans exceeding legal limits, hardship withdrawals without substantiation. Require the recordkeeper's approval workflow for every transaction and keep the authorizations where the auditor can see them.
Stale participant data and lost ex-employees. Bad addresses, uncashed checks, and missing beneficiaries for terminated participants with balances. Annual address scrubs and timely small-balance force-outs keep the census — and your participant count — honest.
None of these requires exotic expertise to fix. They require a monthly reconciliation habit: payroll to recordkeeper, recordkeeper to trust, and the census to HR records. Build that habit in the year before your first audit and fieldwork becomes a verification exercise instead of an excavation.
Keep the Monthly Reconciliation Habit Going
Here is the unglamorous truth behind every clean audit opinion: somebody reconciled payroll contributions to the recordkeeper every single month, kept the census current when people joined and left, and filed the paperwork where it could be found. That discipline is pure bookkeeping — separate plan accounts tracked cleanly, deposits matched to bank movements, and a paper trail an outsider can follow. If your general ledger already works that way, extending the habit to the 401(k) is straightforward; if it does not, the plan audit will expose it.
Simplify Your Financial Management
Running a retirement plan teaches the same lesson as running the business behind it: clean, reconcilable records turn stressful compliance events into routine ones. Beancount.io offers plain-text accounting that is transparent, version-controlled, and AI-ready, so every transaction stays traceable from source to statement. Get started for free and give your books the same audit-ready discipline your 401(k) now requires.
