Nobody schedules their first 401(k) audit. It arrives.
Growth is gradual. You hire a few people. Then a few more. Auto-enrollment nudges your participation rate up. Employees leave, and their balances stay behind.
Nobody wakes up one morning and announces, “We are now a large plan.”
Then one day your TPA runs the participant count and casually mentions that you may want to start thinking about hiring an auditor.
If your headcount is climbing, this one’s for you: what to put in place before an audit is required.
How participants are counted
For plan years beginning on or after January 1, 2023, 401(k) plans count participants with account balances as of the first day of the plan year.
That includes active, terminated and retired employees, as well as deceased participants whose beneficiaries are entitled to benefits. (For a full breakdown, read this article.)
If that number is over 100, the IRS and DOL consider your plan “large” for Form 5500 purposes, and you must file an independent audit. One exception: the 80-120 rule gives plans hovering near the threshold some wiggle room. Once you exceed 120, however, the exception goes away.
When to start paying attention
- You crossed 75 participants, and plan continued growth.
- Your terminated employees aren’t cashing out their small balances.
- You added auto-enrollment and participation jumped overnight.
- You acquired a company and inherited its plan participants.
The surprising part: your first audit looks backward
We recently spoke with a prospective client who was genuinely taken aback to learn we’d need to look at prior years’ financials. (We get it; it’s not intuitive.)
Here’s why we ask. When we audit a previously small plan for the first time, our opinion covers the statement of net assets, which reflects everything that has accumulated in participant accounts since the plan started. To understand where you are today, we have to understand how you got there.
So we test beginning balances. Which means prior years’ financial information. That means requesting records from periods when you weren’t being audited.
This is standard. It applies to every first-time audit. And it’s precisely why the documents you keep at hand today determine how smooth—or painful—that first audit turns out to be.
The checklist: what to put in place before an audit is required
Here’s what belongs in a well-built audit file, organized the way an auditor will eventually ask for it.
1. Plan documents and governance
- Signed plan document and adoption agreement
- Every amendment, signed and dated
- IRS determination or opinion letter
- Summary Plan Description and any Summaries of Material Modifications
- Trust agreement
- Service provider agreements: recordkeeper, TPA, payroll, advisor
- ERISA fidelity bond, current and at the right coverage amount
- Investment policy statement
- Committee charter and meeting minutes
The one sponsors scramble for: amendments. Someone signs them, emails them around, and never files them anywhere permanent. Create one “Plan Document” folder and put every executed amendment in it the day you sign it.
2. Payroll and contribution records
- Payroll registers for every pay period.
- Documentation of how your plan defines eligible compensation, and how payroll codes map to it
- Deferral elections and change forms, with effective dates
- Remittance records showing the date each deposit hit the trust
- Employer match and profit-sharing calculations, with the formula used
- Forfeiture account activity: what came in, what went out, and what it was used for
THIS!!! So often we hear, “We no longer have the records,” because the plan sponsor changed providers, sold a company, or something else happened. From a governmental agency perspective, these are not valid excuses. If I could put blinking lights around this section, I would! Instead, I’ll just reiterate: Payroll registers for every pay period, period.
Another one to note: deposit timing evidence. Knowing the contribution was made isn’t enough. We need to see the date the money left your company account and the date it landed in the plan’s trust. Save the payroll file and trust confirmation together.
3. Participant-level records
- Enrollment forms and eligibility determinations
- Beneficiary designations
- Distribution, rollover, and loan paperwork
- Hardship distribution documentation and substantiation
- QDROs (Qualified Domestic Relations Orders in the event of a participant’s divorce)
- Required participant notices (safe harbor, automatic enrollment, QDIA, fee disclosure) plus proof of delivery
The one sponsors scramble for: proof that notices actually went out. “We always send those” is not documentation. Save the notice itself, the distribution list, and the date sent.
4. Financial and filing history
- Prior years’ Form 5500 filings
- Trust and recordkeeper statements, year-end and beginning-of-year
- SOC 1 reports from your recordkeeper and payroll provider
- Compliance testing results and documentation of any corrections
- Errors: Late deposit calculations, lost earnings, and any Form 5330s
The surprise one for sponsors: prior-year statements. Recordkeeper portals don’t keep everything forever, and access changes when providers do. Download your year-end statements annually and keep your own copy.
If you already know an audit is imminent, pair this checklist with How to prepare for your first 401(k) plan audit.
Storage habits that hold up
Know the retention rules. ERISA requires records supporting your Form 5500 to be kept at least six years from the filing date. Keep records needed to determine a participant’s benefit entitlement as long as they’re relevant, which practically means indefinitely. When in doubt, hold on to it.
- Build folders by plan year, not by document type. One folder per plan year, consistent subfolders inside. When the request list arrives, everything for that year is already in one place.
- Name files so a stranger could find them. “2026-03_payroll-register.pdf” beats “scan_final_v2.pdf” every time.
- Save PDFs, not portal links. Links expire; providers change.
- Document the “why” while you still remember it. Late deposit in Q2? Eligibility correction in September? Drop a short note in that year’s folder explaining what happened and how it was resolved. Future you will be grateful!
- Assign one owner and one backup to the file. Audit prep should never live exclusively on one person’s drive.
- Put 15 minutes on the calendar each quarter. File what’s accumulated, note anything unusual, move on. Four short sessions beat one frantic week.
This is more or less what our client Kyle Mishler, Director of Operations at Civiltech Engineering, described when asked how she stays audit-ready year-round. Check out her time-saving tips here.
Not there yet? You still have options
If you’re approaching the threshold but haven’t crossed it, this may be the best time to see whether your processes hold up. Agreed-Upon Procedures let you test the areas you’re least sure about, without a full audit. An AUP finds the gaps while fixing them is still easy and inexpensive.
The short version
Growth is good news. A surprise request for three-year-old payroll records… not so much.
The plan sponsors who sail through their first audit aren’t the ones with perfect plans. They’re the ones who started a folder before anyone asked.
Wondering whether you’re headed for an audit, or want a second set of eyes on what you’ve got? Contact your friendly neighborhood auditor.
Photo by cottonbro studio.
