A Defined contribution plan audit is an independent examination of a company's retirement plan financial statements and operations, required under ERISA when a plan crosses certain participant thresholds. Plan sponsors with 100 or more eligible participants at the start of the plan year generally need an audit as part of their Form 5500 filing, performed by a qualified CPA firm independent of the plan sponsor. Audit costs typically range from a few thousand dollars for a small, straightforward plan to well over $25,000 for a large plan with multiple investment options or prior-year errors to remediate. The rest of this guide breaks down the participant-count trigger in detail, what the audit actually examines, and the factors that drive cost up or down. The 100-Participant Rule, Explained Plainly The Employee Retirement Income Security Act (ERISA) requires plans with 100 or more eligible participants at the beginning of the plan year to file as a "large plan" with the Department of Labor, which triggers the independent audit requirement attached to Form 5500. There is an important exception plan sponsors often miss: the 80-120 participant rule. If the number of participants at the beginning of the plan year is between 80 and 120, the plan may file in the same category (large or small) as it filed the prior year. This means a plan that filed as a small plan can continue to do so, without triggering the audit requirement, as long as its beginning-of-year count stays at 120 or below. This buffer exists specifically so growing companies are not forced into an audit the moment they cross 100 participants by a handful of employees. Important recent change: For plan years beginning on or after January 1, 2023, the Department of Labor changed how the 100-participant threshold is counted for defined contribution plans (such as 401(k) plans). Under the prior rule, the count included all eligible employees, whether or not they actually participated. Under the new rule, only participants with an account balance at the beginning of the plan year are counted. This is a significant change. Plans with many eligible-but-non-participating employees may now fall below 100 counted participants and avoid the large-plan audit requirement entirely. The DOL estimated the change would remove the audit requirement for roughly 20,000 defined contribution plans. The 80-120 rule still applies, but now uses this account-balance count. Any assessment of whether a plan needs an audit should use the current account-balance methodology, not the older eligible-employee count. One clarification that prevents miscounts: for defined contribution plans under the current rule, the count is participants with an account balance at the start of the plan year, which includes not just active contributing employees but also terminated or retired employees who still hold a balance in the plan. Sponsors sometimes undercount by looking only at current active contributors. For plan years before 2023, the count was broader still, including all eligible employees regardless of participation. Does Every Growing Plan Trigger an Audit Right Away? Not immediately, because of the 80-120 rule above, but the trigger becomes unavoidable once the plan consistently sits above 120 participants or the sponsor chooses to file as a large plan. A common scenario: a company hires aggressively during a growth year, crosses 100 participants by year's end, and the finance team only realizes the audit requirement applies when preparing the Form 5500 months later, leaving little time to select an auditor and gather records. This is the single most common reason plan sponsors end up paying rush fees or scrambling for an auditor close to the filing deadline. Tracking participant counts each plan year, not just at filing time, avoids this. Filing Deadline: Form 5500 is due the last day of the seventh month after the plan year ends, which is July 31 for a calendar-year plan. A one-time 2.5-month extension to October 15 is available by filing Form 5558 by the original due date. Because the audit report must be attached to a completed Form 5500, the practical deadline for finishing audit fieldwork is tighter than these dates suggest, which is why late auditor selection drives rush fees. What Does a defined contribution plan Auditor Actually Examine? A Defined contribution plan audit, is not the same as a corporate financial statement audit, even though both result in an opinion. The auditor examines: Plan financial statements, including the statement of net assets available for benefits and changes in those net assets Participant contributions and whether they were remitted to the plan in a timely manner, a frequent source of findings Eligibility and enrollment records, confirming the plan administrator correctly applied plan terms Distributions and loans, checking that they were processed and approved according to the plan document Investment valuations, particularly for plans holding less liquid or non-standard investment options Late remittance of employee contributions is consistently one of the most common findings in EBP audits, since Department of Labor guidance treats delayed deposits as a fiduciary breach even when the delay is short and unintentional. When late remittances are identified, they are correctable. The Department of Labor’s Voluntary Fiduciary Correction Program (VFCP) lets sponsors self-correct delinquent participant contributions by depositing the missed amounts plus lost earnings, and the IRS Employee Plans Compliance Resolution System (EPCRS) covers related qualification failures. Correcting proactively, and documenting the correction, is far less costly than having the issue surface unresolved in an audit or DOL inquiry. Limited Scope Versus Full Scope: A Distinction That Changes the Audit Plan sponsors using a qualifying trustee or custodian, such as a bank or insurance company that certifies investment information, can elect a limited scope audit, where the auditor does not independently verify the certified investment data. A full scope audit requires the auditor to test investment valuations directly, which generally takes more time and costs more. The AICPA (through SAS 136) has moved away from the term "limited scope" toward "ERISA Section 103(a)(3)(C) audit" under newer auditing standards, but the practical distinction for plan sponsors remains the same: a certified-investment election narrows what the auditor needs to independently test, which affects both audit duration and fee. What Drives the Cost of a ndefined contribution plan Audit? Audit fees vary based on several factors that plan sponsors can usually identify before requesting a proposal: Plan size and complexity: A plan with a single recordkeeper and standard mutual fund investments costs less to audit than one with multiple investment platforms, company stock, or alternative investments. First-year audit versus repeat engagement: A first-time EBP audit typically costs more because the auditor has no prior-year workpapers to build from and needs to understand plan documents and processes from scratch. Audit scope election: A full scope audit, where investment valuations are tested directly rather than relying on trustee certification, generally costs more than a limited scope or Section 103(a)(3)(C) audit. Quality of plan recordkeeping: Plans with clean, well-organized census data, timely contribution records, and an updated plan document typically move through audit fieldwork faster than plans with scattered records across multiple systems or providers. Findings requiring remediation: If the audit uncovers issues like late contribution remittances or eligibility errors, additional time goes into documenting these findings and advising on correction, which adds to the overall fee. For most mid-sized plans, audit fees commonly fall somewhere between $8,000 and $18,000 annually, though this range shifts meaningfully based on the factors above, and sponsors should treat any quote received without a plan census and prior Form 5500 review as a rough estimate at best. What Happens If a Required Audit Is Skipped or Filed Late? Form 5500 filings missing a required audit report, or filed with a qualified or adverse audit opinion that isn't resolved, draw attention from the Department of Labor. The DOL has run targeted enforcement initiatives specifically focused on EBP audit quality, since deficient audits were found across a meaningful share of CPA firms performing this niche audit type in past DOL studies. Selecting a CPA firm with specific Employee Benefit Plan audit experience, rather than a general practice firm doing one occasionally, reduces this exposure. Plan sponsors are personally responsible as fiduciaries for selecting a qualified auditor, so this is not a decision that can be delegated entirely to a recordkeeper or third-party administrator without sponsor oversight. The financial exposure is concrete. Under ERISA Section 502(c)(2), the DOL can assess a civil penalty of up to $2,739 per day, with no maximum, for a late or incomplete Form 5500, and the IRS can separately assess up to $250 per day (capped at $150,000 per plan year). These are two distinct penalties for the same late filing. Sponsors who discover a delinquency before the DOL contacts them can use the Delinquent Filer Voluntary Compliance Program (DFVCP), which caps the penalty at a substantially reduced amount, typically in the range of a few hundred to a few thousand dollars per filing. Where CPA Outsourcing Fits Into This Picture Many CPA firms handling EBP audits face the same constraint every audit season: a narrow filing window, a shortage of staff with EBP-specific training, and a workload that spikes sharply around the same few months. Outsourcing the fieldwork-heavy, repetitive portions of an EBP audit, like testing contribution remittance timing, distribution sampling, and census data reconciliation, to a dedicated outsourcing partner lets the engagement partner focus on judgment-heavy areas and final review. This is the core of what our Assurance & CPA Outsourcing practice supports for US CPA firms: structured EBP audit fieldwork support that follows the engagement partner's methodology and review standards, rather than a generic offshore staffing arrangement. How Pierag Consulting Supports CPA Firms and Plan Sponsors Pierag Consulting works with US CPA firms on Employee Benefit Plan audit fieldwork, financial statement audit support, and compilation engagements through structured CPA outsourcing arrangements. This includes contribution testing, census data reconciliation, and workpaper preparation aligned to the engaging firm's own audit methodology and review process. Frequently Asked Questions How many participants trigger a mandatory defined contribution plan audit? A plan generally needs an audit once it has 100 or more eligible participants at the start of the plan year, though the 80-120 participant rule allows a one-year buffer for plans growing past the 100 mark for the first time. What is the difference between a limited scope and a full scope defined contribution plan audit? A limited scope audit, now often called a Section 103(a)(3)(C) audit, relies on a qualifying trustee's certification of investment data rather than independent testing. A full scope audit requires the auditor to independently verify investment valuations, which generally increases cost and fieldwork time. Why do defined contribution plan audits often find issues with contribution timing? The Department of Labor treats delayed remittance of employee contributions as a fiduciary breach, even for short delays. This is one of the most frequently cited findings in EBP audits because many plan sponsors do not have a documented, consistent remittance timeline. Does a first-year define contribution plan audit cost more than a repeat audit? Yes, typically. A first-year audit requires the auditor to build an understanding of plan documents, processes, and prior history from scratch, since there are no prior-year workpapers to reference, which generally increases the time and cost involved. Who is responsible for selecting a qualified defined contribution plan auditor? The plan sponsor, acting as a fiduciary, is responsible for selecting a qualified, independent auditor. This responsibility cannot be fully delegated to a recordkeeper or third-party administrator without sponsor oversight.