Uncategorized

When Do You Need a 401(k) Audit? The 100-Participant Rule and the 80-120 Exception

By The Ledgerism Editorial Team · The Ledgerism Brief Editorial Team produces original, methodology-disclosed accounting and tax research—data trackers, databases, and reference guides built to be the most-cited source in the field. Every figure is verified against primary sources including FASB, the IRS, the PCAOB, NASBA, the AICPA, and state boards of accountancy.

When do you need a 401k audit? In most cases, you need one when your 401(k) plan covers 100 or more participants at the start of the plan year, which makes it a “large plan” under ERISA. At that point the plan administrator must hire an independent qualified public accountant to audit the plan’s financial statements and attach the report to Form 5500.

The short answer: when

You need a 401(k) audit when the plan is a “large plan,” which generally means it has 100 or more participants at the beginning of the plan year (ERISA Section 103(a)(3)(A); 29 CFR 2520.104-46). The audit must be performed by an independent qualified public accountant, and the resulting report is filed as an attachment to the plan’s annual Form 5500. Plans under 100 participants are usually exempt. Two wrinkles, the 80-120 rule and a 2023 counting change, can shift that line.

The 100-participant rule

The baseline test under ERISA divides employee benefit plans into “large plans” and “small plans.” A large plan is one that covers 100 or more participants as of the beginning of the plan year. A small plan covers fewer than 100. Only large plans carry the independent audit requirement of ERISA Section 103(a)(3)(A), which directs the plan administrator to engage an independent qualified public accountant to examine the plan’s financial statements and report whether they are presented fairly.

Small plans are generally exempt from that audit obligation under a Department of Labor regulation, 29 CFR 2520.104-46, provided certain conditions are met around how plan assets are held and disclosed. The audit requirement attaches to the plan, not the employer, so a single company sponsoring several plans tests each one separately.

The count is taken at one specific moment, the first day of the plan year. For a calendar-year plan, that is January 1. A plan that ends the year with 140 participants but started it with 92 is still tested against the January 1 figure of 92. This timing detail matters more than many sponsors expect, because it sets the baseline for both the audit question and the Form 5500 schedule you file. An audit is a different engagement from a financial statement review or compilation, and the distinctions are worth understanding before you scope the work; our explainer on audit vs. review vs. compilation covers where each fits.

The 80-120 participant rule exception

The 80-120 participant rule is the most useful exception for growing employers, and it lives in the Form 5500 instructions rather than the statute. The rule works like this: if the number of participants reported at the beginning of the plan year is between 80 and 120, and a Form 5500 was filed for the prior plan year, the plan administrator may elect to file in the same category, small or large, that it used the prior year.

The practical effect is significant. A plan that was a small filer last year, then grows and crosses 100 participants this year but stays at or below 120, can continue to file as a small plan. That means no audit for that year. The plan only loses the option once its beginning-of-year participant count exceeds 120, at which point it must file as a large plan and obtain the audit.

The rule is symmetrical. A shrinking plan that was a large filer can stay in the large category while it sits in the 80-120 band, which keeps reporting consistent year to year. The election is not automatic in the sense of being forced on you; it is an option the administrator chooses, so a sponsor that prefers to begin auditing early can do so. For most employers, though, the value is in deferring the audit cost and effort until growth is clearly past the 120 mark. If you are weighing that cost, see our overview of how much an audit costs.

The 2023 participant-counting change

For plan years beginning on or after January 1, 2023, the Department of Labor changed how participants are counted for the large-plan determination for defined contribution plans, including 401(k) plans. The change came through a final rule published in the Federal Register on February 24, 2023, affecting the Form 5500 and Form 5500-SF for 2023 plan years.

Under the prior method, the participant count for the audit threshold included all eligible employees, whether or not they had actually enrolled or held an account balance. An employee who was eligible but had never deferred a dollar still counted toward the 100-participant line. That approach pushed many small employers with auto-eligibility or broad eligibility terms into large-plan status, and therefore into an audit, even when relatively few people were actively saving.

The 2023 rule shifted the count for defined contribution plans to participants with account balances at the beginning of the plan year. Eligible employees who have no account balance no longer count toward the threshold. For a plan with many eligible but non-participating employees, the counted number can drop sharply, and a plan that would have been a large plan under the old method may now test as a small plan with no audit requirement. The Department of Labor projected that the change would remove tens of thousands of small plans from the audit requirement, easing cost for smaller employers (DOL final rule, Federal Register, Feb. 24, 2023). Note that this counting change applies to defined contribution plans; defined benefit plans continue under the prior participant-counting approach.

Participant thresholds at a glance

The table below summarizes how the participant count, the 80-120 election, and the 2023 counting method interact to determine whether an audit is required and which Form 5500 you file. The count basis assumes a defined contribution plan such as a 401(k) for plan years beginning on or after January 1, 2023.

What happens if you do not get one

An audit is not optional once a plan is a large plan, and the Form 5500 is treated as incomplete without it. When a large plan files Form 5500 without the required independent qualified public accountant’s report, the Department of Labor can reject the filing as deficient and treat the plan as not having filed at all. That exposure runs through the plan’s annual reporting obligation, and the clock keeps running until a complete filing is accepted.

The penalties are steep. Under ERISA Section 502(c)(2), the DOL may assess a civil penalty for a deficient or non-filed annual report, set by regulation and adjusted annually for inflation. The penalty exceeds $2,500 per day, with the 2025 inflation-adjusted maximum at $2,670 per day (29 CFR 2575.502c-2; DOL annual penalty adjustment). Because a missing audit can void the entire filing, those daily amounts can accumulate quickly against a plan that believed it had filed on time.

There is a relief valve. The Delinquent Filer Voluntary Compliance Program, run by the DOL, lets administrators who self-correct before being caught pay sharply reduced, capped penalties rather than the full daily exposure. DFVCP is the standard route for a plan that discovers a missed audit or late filing and wants to fix it on favorable terms.

How to prepare

Preparation starts well before the filing deadline. Form 5500 is due seven months after the plan year ends, which is July 31 for a calendar-year plan, and the deadline can be extended two and a half months to October 15 by filing Form 5558. The audit has to be complete in time to attach the report, so engaging an auditor early in the year, rather than in the summer crunch, gives the plan room to gather records and resolve questions.

Have the core documents ready: the plan document and any amendments, the trust or custodial statements, the recordkeeper’s reports, payroll and contribution records, and the prior year’s Form 5500 and audit report. The auditor will test contributions, distributions, participant data, and the internal controls around them, so clean, reconciled records shorten the engagement. Plan sponsors who understand internal controls testing tend to move through the process faster because they can show how deferrals are calculated, deposited on time, and reconciled.

Decide on the audit type with your auditor. Historically plans could elect a “limited scope” audit, now called an ERISA Section 103(a)(3)(C) audit, in which a qualified institution such as a bank or insurance carrier certifies the investment information so the auditor does not re-test it. The alternative is a full-scope audit. The reporting model for these engagements was reshaped by SAS 136 (AU-C 703), effective for plan financial statements for periods ending on or after December 15, 2021, which changed the form of the auditor’s report and added specific procedures and management responsibilities. For more background on plan reporting and accounting topics, our learn hub collects related explainers.

Frequently asked questions

Does every 401(k) plan need an audit?

No. Only “large plans,” generally those with 100 or more participants at the beginning of the plan year, require an independent audit under ERISA Section 103(a)(3)(A). Small plans under 100 participants are generally exempt under 29 CFR 2520.104-46.

When is a plan counted for the 100-participant test?

The count is taken at the beginning of the plan year, which is January 1 for a calendar-year plan. Year-end headcount does not drive the audit determination; the first-day figure does.

What is the 80-120 participant rule?

Under the Form 5500 instructions, if beginning-of-year participants number between 80 and 120 and the plan filed Form 5500 the prior year, the administrator may keep filing in the same category as last year. A growing plan can stay a small plan, with no audit, until it exceeds 120 participants.

How did the 2023 participant-counting change affect audits?

For plan years beginning on or after January 1, 2023, defined contribution plans count only participants with account balances, not all eligible employees (DOL final rule, Federal Register, Feb. 24, 2023). Plans with many eligible but non-participating employees may now fall under the threshold and avoid an audit.

What is the difference between a limited scope and full scope audit?

A limited scope audit, now called an ERISA Section 103(a)(3)(C) audit, relies on a qualified institution’s certification of investment information, so the auditor does not re-test those certified investments. A full-scope audit covers everything, including the investments.

What happens if a large plan files Form 5500 without the audit?

The DOL can reject the filing as deficient and treat it as not filed, then assess penalties under ERISA Section 502(c)(2). The 2025 maximum is $2,670 per day (29 CFR 2575.502c-2), so exposure builds fast.

Can we reduce penalties if we missed an audit?

Yes. The Delinquent Filer Voluntary Compliance Program lets administrators who correct before being caught pay capped, reduced penalties rather than full daily amounts. It is the standard fix for a late or incomplete filing.

When is the Form 5500 due?

It is due seven months after the plan year ends, July 31 for a calendar-year plan. Filing Form 5558 extends the deadline two and a half months, to October 15.

Does the 2023 counting change apply to defined benefit plans?

No. The account-balance counting method applies to defined contribution plans such as 401(k)s. Defined benefit plans continue under the prior participant-counting approach (DOL final rule, Federal Register, Feb. 24, 2023).