Employee Benefit Plan Audit Report: Opinions, Deadlines, and Penalties

An employee benefit plan audit report is the independent CPA’s opinion letter and accompanying audited financial statements that a large ERISA-covered plan attaches to its annual Form 5500. It tells fiduciaries, participants, and the Department of Labor whether the plan’s numbers can be trusted, and it is required whenever a retirement, health, or welfare plan crosses the large-plan threshold.

When Your Plan Needs an Audit

The trigger is participant count. A plan with 100 or more participants who hold account balances at the beginning of the plan year is a large plan filer and must attach an audited financial statement to its Form 5500.¹

For plan years beginning on or after January 1, 2023, that count works differently. The revised method includes only participants who actually have an account balance, not everyone who was eligible to enroll.² Some plans that used to require audits now qualify as small plans and can skip one entirely.

The 80-120 Rule

Plans near the threshold get a cushion. If your plan had between 80 and 120 participants at the start of the plan year and filed as a small plan the year before, you can elect to keep filing as a small plan. It runs the other way too: a plan that filed large the prior year can keep filing large even after slipping below 100.³

Small Plans Still Have Conditions

Filing as a small plan does not automatically waive the audit. At least 95 percent of the plan’s assets must be qualifying plan assets, meaning they sit with a regulated financial institution such as a bank, insurance company, or registered broker-dealer. If less than 95 percent qualifies, anyone handling the non-qualifying assets must be covered by a fidelity bond at least equal to the value of those assets.³ The administrator also has to check the waiver box on Schedule I, add certain information to the Summary Annual Report, and be ready to give participants copies of institution statements and bond evidence on request.

What’s Inside the Report

The auditor’s report is a structured letter signed by the CPA firm. Under AU-C Section 703, the ERISA-specific auditing standard, the letter has a set format.⁴

Opinion

This section states the auditor’s conclusion on whether the financial statements are presented fairly under generally accepted accounting principles, and identifies the opinion type. Most readers turn here first, because it tells you at a glance whether the plan’s numbers hold up.

Basis for Opinion

Here the auditor confirms the work followed generally accepted auditing standards, affirms independence and ethical compliance, and states that the evidence gathered supports the opinion.

Responsibilities of Management

The report spells out what falls on the plan sponsor: preparing financial statements in accordance with GAAP, maintaining internal controls that prevent material misstatements, and giving the auditor access to everything needed for the engagement.

Responsibilities of the Auditor

The auditor describes the procedures performed and explains that the goal is reasonable assurance, not absolute certainty, that the financial statements are free of material misstatement. The auditor also communicates planned scope, timing, and any significant findings to those charged with governance.

The Four Types of Opinions

The opinion the auditor issues has real consequences for the plan’s compliance standing.

Unqualified (clean). The financial statements are fairly presented in all material respects. This is what every sponsor wants.
Qualified. There is a material misstatement or an area the auditor couldn’t examine, but the rest of the statements are fairly presented. A missing or incomplete supplemental schedule can produce one. The letter will say “except for” the identified issue.
Adverse. The financial statements are materially misstated and do not fairly represent the plan’s financial position. This is the most severe finding.
Disclaimer. The auditor couldn’t gather enough evidence to form any opinion, usually because management restricted access. A traditional disclaimer of this kind is treated as a filing deficiency, separate from the acceptable disclaimer that comes out of an ERISA Section 103(a)(3)(C) audit described below.

An adverse opinion or an unacceptable disclaimer can bring DOL enforcement. Deficient reports may draw a Notice of Rejection followed by daily penalties if problems aren’t corrected in time.

The Financial Statements That Travel With the Opinion

The full audit package pairs the opinion letter with the plan’s financial statements and required schedules.

Statement of Net Assets Available for Benefits

The plan’s balance sheet. It shows total assets, liabilities, and net assets as of the last day of the plan year. Investments are the biggest line and are generally reported at fair value. Contributions receivable and benefits owed but not yet paid also appear here.

Statement of Changes in Net Assets Available for Benefits

The plan’s income statement. Additions cover employer and employee contributions plus net investment income or loss. Deductions cover benefit payments and administrative expenses like recordkeeping fees and audit costs.

Notes and Supplemental Schedules

The notes are an integral part of the audited statements, not extras. Required disclosures include the plan description, significant accounting policies, and party-in-interest transactions such as those with the sponsor or service providers.

Two supplemental schedules ride along. The Schedule of Assets Held for Investment at end of year lists every plan investment by issuer, maturity date, interest rate, cost, and current value.⁵ The Schedule of Reportable Transactions captures any single transaction, or series of related transactions, exceeding 5 percent of plan assets during the year.⁶

ERISA Section 103(a)(3)(C) Audits

What used to be called a limited scope audit is now formally an ERISA Section 103(a)(3)(C) audit. The name changed when SAS 136 took effect for plan years ending on or after December 15, 2021, but the substance is the same.⁴

When a plan’s investment assets are held by a qualified institution such as a regulated bank or insurance company, that institution can provide a written certification that the investment information it prepared is both complete and accurate.⁷ Accuracy and completeness both have to be stated; one without the other does not satisfy the regulation.

With a valid certification, the plan administrator can elect to exclude the certified investment information from the auditor’s examination. The auditor still performs a full audit of contributions, benefit payments, administrative expenses, and internal controls, but does not independently test the certified investment data.

The resulting opinion letter includes a disclaimer on the investment information, and the overall opinion on the financial statements taken as a whole is a disclaimer. This is an acceptable outcome under DOL rules, unlike a traditional disclaimer caused by management restricting records. Most large plans use this election because their assets already sit at regulated custodians, making it the most common type of employee benefit plan audit in practice.

Filing Deadline and Extension

Form 5500, including the attached audit report for large plans, is due by the last day of the seventh month after the plan year ends. For a calendar-year plan, that’s July 31.

Form 5558 buys an automatic extension of up to two and a half months, moving the deadline to October 15 for calendar-year plans. The extension is automatic as long as Form 5558 is filed by the original due date and the requested date is no later than the 15th day of the third month after the normal due date.⁸

What a Missing or Deficient Report Costs

The DOL reviews Form 5500 filings and their attached audit reports for compliance.⁹ Penalty rates depend on the type of deficiency:

Missing or deficient auditor’s report. $150 per day, capped at $50,000.
Significant reporting errors such as errors on Schedule H or a missing Schedule of Assets. $100 per day, capped at $36,500.
Non-critical missing or deficient items. $10 per day, capped at $3,650.

Per-day calculations run from the original filing due date regardless of extension, through the date of the Notice of Intent. The DOL can assess higher rates depending on the facts.⁹

Separately, the IRS imposes its own penalty of $250 per day, up to $150,000, for a late 5500-series return.¹⁰ IRS penalties stack on top of DOL penalties, so a plan that ignores its filing obligations can face substantial combined exposure.

If You’re Already Late: The DFVCP

Administrators who catch a missed deadline before the DOL does have a way to limit the damage. The Delinquent Filer Voluntary Compliance Program lets you file late Form 5500s at reduced penalty rates, but only if the DOL has not already notified you of a failure to file.¹¹

The basic penalty under the program is $10 per day from the original due date, with caps that vary by plan size:

Small plans. $750 per filing, with a per-plan cap of $1,500. Plans sponsored by a 501(c)(3) get a lower per-plan cap of $750.
Large plans. $2,000 per filing, with a per-plan cap of $4,000.
Top hat, apprenticeship and training plans, and late M-1 filings. Flat penalty of $750.

The trade is that you get much lower penalties but waive the right to contest the amount. The program is not available for amended filings, one-participant plans, Form 5500-EZ filers, or any plan that has already received a Notice of Intent to Assess a Penalty.¹¹ If you had an extension but still filed late, penalties are calculated from the original due date, not the extended one.

1
U.S. Department of Labor. Selecting an Auditor for Your Employee Benefit Plan
2
U.S. Department of Labor. Changes for the 2023 Form 5500 and Form 5500-SF Annual Return/Reports
3
U.S. Department of Labor. Frequently Asked Questions On The Small Pension Plan Audit Waiver Regulation
4
AICPA & CIMA. EBP Audits: Time to Implement SAS 136 (AU-C 703)
5
Office of the Law Revision Counsel. 29 USC 1023 – Annual Reports
6
U.S. Department of Labor. Instructions for Form 5500 Annual Return/Report of Employee Benefit Plan
7
eCFR. 29 CFR 2520.103-8 – Limitation on Scope of Accountants Examination
8
Internal Revenue Service. Application for Extension of Time To File Certain Employee Plan Returns (Form 5558)
9
U.S. Department of Labor. Reporting Compliance Enforcement Manual Chapter 5
10
Internal Revenue Service. 401(k) Plan Fix-It Guide – You Havent Filed a Form 5500 This Year
11
U.S. Department of Labor. Delinquent Filer Voluntary Compliance Program