401(k) 5500 Audit Requirement: Rules, Limits, and Compliance Guide for 2026

To comply with federal regulations in 2026, most 401(k) plans with 100 or more participants with account balances at the start of the plan year must undergo an independent financial audit. This audit accompanies the annual Form 5500 filing to ensure the plan operates fairly and remains financially sound for its beneficiaries.

Federal law under the Employee Retirement Income Security Act (ERISA) mandates that retirement plan sponsors provide transparency regarding the financial health of their benefit plans. For many growing businesses, the transition from a "Small Plan" to a "Large Plan" brings the significant administrative and financial hurdle of the 401(k) 5500 audit requirement. As of 2026, these rules have stabilized following major shifts in participant counting methodologies, yet they remain a primary focus for Department of Labor (DOL) enforcement.

Understanding the 401(k) Audit Mandate

The primary purpose of a 401(k) audit is to provide an independent third-party opinion on the plan’s financial statements. The Department of Labor (DOL) and the Internal Revenue Service (IRS) use this information to protect the interests of plan participants and beneficiaries. An audit verifies that the plan is operating in accordance with both its own written plan document and the strict standards set by ERISA.

The audit is performed by an Independent Qualified Public Accountant (IQPA). This professional examines the plan’s financial records to determine if the information presented in the Form 5500 accurately reflects the plan's financial status. Beyond mere numbers, the auditor checks for operational compliance—ensuring contributions are deposited on time, distributions are calculated correctly, and only eligible employees are participating.

For plan sponsors, the audit is not merely a "check-the-box" exercise. It is a critical fiduciary oversight mechanism. In the eyes of the DOL, the audit acts as a safeguard against mismanagement, fraud, and errors that could jeopardize the retirement security of the American workforce.

The "Large Plan" vs. "Small Plan" Distinction

The requirement for an audit hinges on whether a plan is classified as "Large" or "Small." This classification is determined on the first day of the plan year (January 1 for calendar-year plans).

The 100-Participant Threshold

Generally, any plan that starts a plan year with 100 or more participants is considered a Large Plan and is subject to the audit requirement. However, the definition of a "participant" underwent a massive shift in recent years, which remains the standard in 2026.

The Shift to "Account Balance" Counting

Prior to the 2023 plan year, a "participant" included anyone eligible to participate, even if they had never contributed a cent to the plan. This often forced small companies with high turnover and many indifferent employees to pay for expensive audits.

In 2026, we continue to follow the refined rule: only participants with an account balance at the beginning of the plan year are counted toward the 100-participant threshold.

• Included: Active employees with balances, retired or terminated employees who left their money in the plan, and beneficiaries of deceased participants with accounts.
• Excluded: Employees who are eligible to participate but have a $0 balance in the plan.

This change significantly reduced the burden on employers who have a large workforce but low participation rates. It aligns the audit requirement with the actual financial risk present in the plan.

The 80-120 Participant Rule Explained

To prevent companies from switching back and forth between Large and Small plan status due to minor fluctuations in headcount, the DOL provides the "80-120 Rule." This rule offers a layer of flexibility for plans hovering right around the 100-participant mark.

If a plan filed as a "Small Plan" in the previous year (meaning it did not require an audit), it can continue to file as a Small Plan as long as the participant count with account balances remains under 120 at the beginning of the current plan year.

Once the count hits 121 at the beginning of a plan year, the plan must file as a Large Plan and include an audit. Conversely, if a plan has been filing as a Large Plan, it must drop below 80 participants with account balances to transition back to Small Plan status without an audit.

Practical Application of the 80-120 Rule

Consider a company that had 95 participants with account balances on January 1, 2025, and filed as a Small Plan. On January 1, 2026, they have 115 participants with account balances. Under the 80-120 rule, they can elect to continue filing as a Small Plan for 2026, avoiding the audit requirement for another year despite being over the 100-person threshold.

What Does an IQPA Audit Entail?

An independent audit is a comprehensive review. The auditor does not just look at the total assets; they dive into the "pipes" of the plan to ensure money is flowing correctly. There are two primary types of audits currently performed in 2026.

ERISA Section 103(a)(3)(C) Audits

Formerly known as "Limited Scope" audits, these are the most common. Under this provision, the auditor does not need to perform audit procedures on investment information that is certified as complete and accurate by a "qualified institution," such as a bank or an insurance company that acts as the plan’s trustee or custodian.

While the auditor relies on the certification for the value of the assets, they still must perform extensive testing on:

• Participant Data: Ensuring birth dates, hire dates, and compensation are accurate.
• Contributions: Verifying that the amounts deducted from payroll match what was deposited into the plan and that they were deposited within the DOL’s strict timeframe (usually within a few business days).
• Distributions: Checking that payments made to participants (loans, hardships, or retirement) were processed according to the plan document and that taxes were correctly withheld.
• Plan Operations: Reviewing the plan document to ensure the employer is following its own rules regarding matching, vesting, and eligibility.

Non-Section 103(a)(3)(C) Audits (Full Scope)

If the plan's assets are held by an entity that is not a qualified bank or insurance carrier (such as a brokerage firm that does not provide the specific ERISA certification), the auditor must perform a "full scope" audit. This involves verifying the existence and valuation of all plan investments, which is significantly more time-consuming and expensive.

Key Deadlines and Filing Requirements in 2026

The 401(k) audit must be completed in time to be attached to the Form 5500, which is filed electronically through the DOL’s EFAST2 system.

Failure to meet these deadlines can result in the DOL rejecting the filing. A Form 5500 filed without the required audit report is considered an "incomplete" filing, which is treated by the DOL as if the form was never filed at all.

Consequences of Non-Compliance

The penalties for failing to provide an audit or filing a late Form 5500 are among the most severe in the corporate world. In 2026, these penalties are adjusted for inflation and can accrue daily.

1. DOL Penalties: The Department of Labor can assess penalties of over $2,500 per day for late or incomplete filings. There is no statutory cap on these penalties, meaning a late filing caught years later can result in six-figure fines.
2. IRS Penalties: Separate from the DOL, the IRS can impose penalties for failure to file the annual return of a registration statement. While generally lower than DOL fines, they still add a significant financial burden.
3. Plan Disqualification: In extreme cases of mismanagement uncovered by a lack of audit, the IRS can disqualify the plan, meaning all contributions become immediately taxable to employees and the employer loses its tax deductions.
4. Fiduciary Liability: Plan sponsors (the business owners or executives) are personally liable for losses to the plan. If a lack of oversight leads to financial loss for participants, the sponsors' personal assets could be at risk.

The DOL offers the Delinquent Filer Voluntary Compliance Program (DFVCP), which allows plan sponsors to voluntarily correct late filings for significantly reduced penalties. This is often the best "troubleshooting" path for a company that realizes they missed an audit requirement in a previous year.

Preparing Your Business for a 5500 Audit

Preparation is the key to minimizing the cost and disruption of a 401(k) audit. Auditors typically begin their work in the spring or early summer for calendar-year plans.

Essential Documentation

You will need to provide the auditor with several categories of data:

• The Plan Document: Including the original adoption agreement and all subsequent amendments.
• Payroll Records: To verify that employee deferrals and employer matches were calculated correctly.
• The SOC 1 Report: This is a report from your plan service provider (like Fidelity, Vanguard, or Empower) that describes their internal controls. Your auditor will use this to ensure the provider's systems are reliable.
• Participant Files: Including election forms for contribution percentages and beneficiary designations.
• Distribution Paperwork: Documentation for any money that left the plan during the year.

Internal Controls

Auditors look for a "clean" process. If your payroll system is integrated with your 401(k) provider's system, the audit is usually much smoother. Manual entries and spreadsheet-based tracking are high-risk areas where auditors will spend more time (and charge more money) to verify accuracy.

Common Pitfalls and Troubleshooting

Many companies find themselves in trouble not because they ignored the rules, but because they misunderstood the nuances of participant counting.

The "Frozen" Plan Trap: Even if a company stops allowing new contributions (freezes the plan), an audit is still required as long as there are 100 or more people with balances remaining in the plan. The requirement only disappears when the plan is fully liquidated and a "final" Form 5500 is filed.

The "Late Deposit" Issue: This is the most common audit finding. The DOL requires that participant deferrals be deposited as soon as they can be reasonably segregated from the employer's general assets. For most companies, this is within 1–3 business days of the pay date. If your auditor finds deposits took 10 days, they will flag this as a "prohibited transaction," requiring the employer to pay lost interest back into the participants' accounts and file an excise tax form (Form 5330) with the IRS.

Selection of a Non-Specialized Auditor: Many companies use their local tax accountant for the 401(k) audit. However, ERISA audits are highly specialized. The DOL frequently reviews audit reports, and if the auditor fails to follow specific AICPA standards for employee benefit plans, the DOL may reject the audit and require a re-audit by a different firm at the employer's expense.

FAQs

1. Does a 401(k) audit require a physical visit to my office?

In 2026, most 401(k) audits are conducted virtually. Auditors use secure portals to review payroll data, plan documents, and SOC reports. While a physical visit may occur if internal controls are deemed high-risk or if records are only available in paper format, the industry standard has moved toward remote auditing to increase efficiency and reduce travel costs.

2. How much does a 401(k) audit typically cost in 2026?

Costs vary based on the size of the plan and the quality of your records, but generally, an audit for a plan with 100–500 participants ranges from $10,000 to $20,000. If the plan requires a "full scope" audit or has significant compliance issues that require extra testing, fees can exceed $25,000.

3. If I have 105 employees but only 70 have money in the 401(k), do I need an audit?

No. Under the rules in effect for 2026, the audit threshold is based on participants with account balances. Since only 70 people have balances, you are considered a Small Plan and are exempt from the audit requirement, regardless of how many employees are "eligible" to join.

4. Can the same firm that does my company's corporate tax return do the 401(k) audit?

Yes, provided the firm is an Independent Qualified Public Accountant and maintains independence according to DOL and AICPA standards. However, many companies prefer to use a specialized firm to ensure the audit meets the DOL's rigorous review standards, as 401(k) audits are a frequent target of DOL quality inspections.

5. What is the difference between a 5500-SF and a regular 5500 with an audit?

Form 5500-SF (Short Form) is for small plans that meet specific eligibility requirements, including having fewer than 100 participants and having all assets held in "safe" investments with readily determinable fair values. Large plans cannot use the 5500-SF and must use the standard Form 5500, which includes the audit report as an attachment (Schedule H).

Recommendations for Plan Sponsors

If you are approaching the 100-participant mark with account balances, your first step should be a "clean-up" of small, abandoned accounts. Often, a plan stays over the 100-person threshold because former employees have left $500 or $1,000 in the plan.

Actionable Steps:

1. Review your plan’s "force-out" provision: Most plans allow you to automatically distribute accounts with balances under $7,000 (the 2026 limit) to an IRA for the former employee. Executing these force-outs can drop your participant count below the 100-person threshold and save the company the $15,000+ cost of an annual audit.
2. Engage an auditor early: If you know you will exceed the threshold, do not wait until July. Auditors are in high demand during "5500 season," and engaging one in January or February can often result in lower fees and a more thorough pre-audit review.
3. Audit your payroll process: Ensure that your "date of segregation" (the day money leaves your bank for the 401(k) provider) is consistent and fast. This is the first thing an auditor—and the DOL—will look at.

Staying compliant with 401(k) 5500 audit requirements in 2026 requires a proactive approach to participant data management and a clear understanding of the "account balance" counting rules. By monitoring these metrics closely, plan sponsors can manage their fiduciary duties effectively while avoiding unnecessary administrative costs.