Audits of Outsourced Retirement Plans

Relying on CPAs to turn up potential issues now is a better alternative than for plan participants or the IRS to discover shortcomings.

by Larry Heller, Neil Della Torre

There’s a secret weapon out there for the smooth operation of your retirement plan—maybe not the antidote to design imperfection or administrative breakdown but surely one of the first in any position to identify any of that. Just like your doctor and that annual physical you enjoy so much, your plan has its auditor, and he or she can easily be your plan’s best friend.

Which auditor? There are compliance audits, ERISA audits, operational reviews, and any number of other investigations of accurate recordkeeping, timely trust activity, proper IRS/DOL reporting, and all things administrative. While good ideas, all of them are optional, until the IRS says otherwise. But, very quietly, the annually required, DOL-driven accounting audit of your plan by an independent certified public accountant is well positioned to do a lot more than just get its financial statements and IRS Forms 5500 prepared.

To prepare those statements and forms, the CPA draws on one of his profession’s most innate instincts—risk reduction on behalf of the plan sponsor, and the documentation and verification of internal controls resident within all of the processes supporting the plan sponsor.

Internal Controls
What are sound “internal controls” for 401(k) plans, and what can the accounting audit do to ensure their effectiveness? For starters, they help to estimate the potential risk associated with each of a long list of control attributes and possible weaknesses, and alert the plan sponsor to the existence of any significant risk or actual and material errors. What constitutes a “material error”? Generally, it coincides with financial exposure to the plan. More specifically, recent pronouncements by the American Institute of Certified Public Accountants’ (AICPA) Auditing Standards Board, as well as Sarbanes-Oxley (keep in mind its full name, the Public Company Accounting Reform and Investor Protection Act of 2002) have reinforced the baseline by which CPA auditors are trained and under which they test plans’ internal controls.

If we sought the top 10 ways to reduce risk in 401(k) plan administration (meaning the most classic sources of operational breakdown and financial risk to the plan sponsor), the scrutiny inherent in the thorough 401(k) plan audit would get us answers to all of the following (and a lot more):
n Are contributions calculated from the plan’s intended definition of compensation? For example, contributions should only include a percentage of incentive compensation if the plan says so.

• Are company contributions being credited to the intended population of active and terminated participants? Retirement, disability, voluntary, and involuntary terminations are not always intended by the plan to be treated the same.
• Are proper amounts of investment income being allocated to participants’ accounts, net of appropriately calculated and disclosed plan expenses, and are they being credited to those accounts in a timely manner, as dictated by the plan document? Plan asset statements often show a variety of investment gains within a specific fund (e.g., interest, dividends, realized and unrealized gains, etc.); all must be recognized by the recordkeeping process.
• Is the plan sponsor properly taking credit for participants’ forfeitures of nonvested accounts? Plan assets could be accumulating outside participants’ accounts and/or the company could be depositing more matching or profit sharing contributions than it needs to.
• Are plan loans being amortized and repaid in accordance with the terms of the plan document and promissory note? If loans are exceeding five years in duration, does the plan allow this? Is ongoing payroll and repayment frequency consistent with how the periodic repayment amount was calculated?
• Is documentation maintained to provide specific administrative procedures in the event of loan defaults? Taxable consequences need to be calculated and reported; recordkeeping systems need to track the result to avoid double taxation (or an excessive tax reduction) on the defaulted amount.
• Are new hires and rehires being offered plan participation at the proper time? Contribution start-up dates for new participants should be consistent with plan eligibility rules.
• Are minimum required distributions being paid timely and accurately to participants over age 701/2? Underpayments yield significant IRS penalties.
• Are hardship withdrawal restrictions being applied in accordance with the terms of the plan? Overly free and easy access to supposedly restricted money would not be viewed kindly upon IRS audit.
• Does the plan’s investment committee meet regularly, evaluating investment policy, the plan’s adherence to it, plan asset performance, asset utilization, etc., and documenting its findings? If investments are veering off course, in performance or in adherence to intended strategy (e.g., small cap versus large cap stocks), participants are counting on the plan’s management to be watching.

After all, who would you rather have finding a disappointing answer to any of these questions: your plan participants, the IRS, or your experienced CPA?

How to Expedite Your Plan’s Audit
There are distinct skills, processes, and packaging that lead to a painless and efficient audit of a retirement plan, an audit with far-reaching value waiting to be added.

First and foremost, a retirement plan’s annual accounting audit, separate from its periodic, somewhat optional regulatory compliance audit, attests to the validity of plans’ operational procedures versus each plan’s terms, and summarizes the plan’s assets and demographics. While independence rules require a clear separation between consulting services and auditing services for a specific plan, the audit’s annually required reporting and its preparation need not be excessively narrow or blind. The wide-eyed, savvy CPA is in the best
position of anyone to independently acknowledge—on behalf of the CEO, CFO, controller, and HR management—if a plan is running properly when viewing its asset reports, recordkeeping documentation, and formal and informal plan documentation; hence, the significance of the plan sponsor’s selection of the auditor engaged for these purposes.

What is an auditor’s chance to positively influence the future course of plan operations? The CPA can open the door for administrative and systems consultants to significantly add efficiencies and cost-effectiveness to a plan’s day-to-day operations. You can see this in the review of internal controls inherent in any annual audit of a defined contribution or defined benefit plan. That review is ripe with opportunity for the CPA to acknowledge (as opposed to consult upon) any operational inconsistencies and recordkeeping inaccuracies encountered during their strategic spot-checking of plan activity during the year.

This could just as easily be called “Ten Steps to a Better Audit” (or maybe just “The Potential Benefits of a Necessary Evil”), where the 10 steps are the auditor’s presentation of:

• An executive summary of plan activity for the year—discussion and analysis of financial activity, plan and regulatory changes, and any other issues relevant to senior management;
• Draft financial statements—in accordance with Generally Accepted Accounting Principles (GAAP) and Department of Labor requirements, including all required footnotes and schedules;
• A summary of activity—a summary trial balance documenting the flow of plan activity during the audit period, supporting the financial statements and reconciled to the plan trustee’s certified report for the plan year;
• Supporting schedules and reconciliations—the detail underlying the most significant information presented on the summary of activity, as reported by the plan’s trustee and recordkeeper, such as contributions, distributions, loans, rollovers, and the impact of corporate events such as mergers, acquisitions, and divestitures;
• GAAP and DOL disclosures based on responses compiled from a comprehensive questionnaire, a summary of all plan year issues to be considered for disclosure based on GAAP and DOL requirements for the reporting of plan assets;
• An internal control review based on a comprehensive questionnaire designed to identify company policies and procedures and related risk, highlighting key controls and recommendations; ultimately, this review is designed to improve the accuracy of the plan’s financial statements and promote the overall efficiency of plan operations;
• A prohibited transaction checklist—verification of plan year activity against a checklist of potentially prohibited transactions;
• Key test reports—results of the plan’s top heavy, ADP, and ACP testing performed by the plan’s recordkeeper and/or other third-party administrators;
• Legal activity (if any)—summary of plan issues under review by in-house or outside counsel; and
• Other reports as deemed helpful for corporate, human resource, financial, or independent accountant clarity.

Who Benefits?
All along, 401(k), profit sharing, money purchase, and defined benefit plans with 120 or more participants (and, in some cases, as few as 100 participants) have been subject to CPA audit requirements by the DOL. But the Pension Protection Act of 2006 had far-reaching influence on their cousin, the 403(b) plan, not the least of which is the extension of 401(k) plans’ current auditing requirements to 403(b) plans beginning with their 2009 plan years. 403(b) plans with 120 or more participants are thus saddled with the same annual auditing, Form 5500 filing, and reporting burden as 401(k) plans (again, in some cases applicable for plans with as few as 100 participants).

These plans in the nonprofit and public sectors need to ramp up from a no-audit process to a formal annual one, and the start-up of this process should begin this year (e.g., to establish proper end-of-year asset balances for future reporting, financial statements, etc.) and not wait for 2009.

The start-up of that audit process, never mind the audit itself, and the formalizing of the required data collection, documentation, and reporting processes will reduce operational and financial risk for these plans to a level not necessarily seen before, certainly not previously required. The process however, is not necessarily costly as evidenced by small, specialized accounting firms.

In other words, just like for all other qualified retirement plans, big brother (the DOL) will soon be watching. And the plan’s best friend, its CPA and all those behind the scenes providing accounting and audit support, will see to it that a tidy, well-organized set of reports is at the other end of the microscope.