10 Common 401(k) Audit Red Flags (and How to Fix Them)

Retirement plan audit findings rarely result from fraud or intentional misconduct. More often, auditors uncover breakdowns in routine processes, oversight, and documentation. Here are 10 common red flags auditors look for, and the steps plan sponsors can take to address them.

1. Late Employee Contribution Deposits

Red Flag: Employee deferrals are not deposited into the plan as soon as administratively feasible after each payroll.

Why Auditors Care: Late deposits are considered prohibited transactions and are among the most common audit findings.

How to Rectify It:

• Establish a documented contribution remittance process.
• Ensure payroll and recordkeeping systems are aligned.
• Monitor deposit timing each pay period.
• Conduct periodic deposit audits to identify delays.

2. Eligible Employees Were Never Enrolled

Red Flag: Employees who satisfy the plan’s eligibility requirements are missed or enrolled late.

Why Auditors Care: Excluding eligible employees can create qualification failures and require corrective contributions.

How to Rectify It:

• Automate eligibility tracking where possible.
• Validate employee entry dates after every payroll cycle.
• Conduct periodic eligibility audits.
• Reconcile HR and payroll records regularly.

3. Employer Contributions Are Calculated Incorrectly

Red Flag: Matching or profit-sharing contributions do not align with plan provisions.

Why Auditors Care: Incorrect contribution calculations can result in participant inequities, missed earnings, and operational failures.

How to Rectify It:

• Document contribution formulas clearly.
• Verify compensation definitions are applied correctly.
• Review calculations before funding.
• Have your TPA or advisor perform an independent review.

4. Nondiscrimination Testing Creates Last-Minute Surprises

Red Flag: ADP/ACP or top-heavy testing failures are discovered late in the year.

Why Auditors Care: Testing failures that are not corrected in a timely manner can create compliance issues and additional costs.

How to Rectify It:

• Complete annual testing promptly.
• Run mid-year projections to identify risks early.
• Process corrective contributions or refunds on time.
• Evaluate whether a safe harbor plan design is appropriate.

5. Plan Operations Don’t Match the Plan Document

Red Flag: The plan is administered differently than the written document requires.

Why Auditors Care: Auditors often compare actual operations against plan provisions. Discrepancies can trigger operational failures.

How to Rectify It:

• Ensure amendments and restatements are completed in a timely manner.
• Train internal staff on key plan provisions.
• Review administrative procedures annually.
• Confirm service providers are operating under current plan terms.

6. Form 5500 Responsibilities Are Unclear

Red Flag: No one has clear ownership of Form 5500 preparation, review, and filing.

Why Auditors Care: Missing deadlines, inaccurate data, or incomplete schedules can result in penalties and increased scrutiny.

How to Rectify It:

• Clearly assign filing responsibilities.
• Maintain a filing calendar with key deadlines.
• Review data accuracy before submission.
• Confirm all required schedules and attachments are included.

7. Plan Fees Haven’t Been Reviewed Recently

Red Flag: Fee reviews and benchmarking are infrequent or undocumented.

Why Auditors Care: Fiduciaries must demonstrate that plan fees are reasonable relative to services provided.

How to Rectify It:

• Review provider fees at least every one to three years.
• Benchmark fees against comparable plans.
• Retain documentation of reviews and decisions.
• Review required fee disclosures annually.

8. Investment Oversight Is Informal or Undocumented

Red Flag: Investments are reviewed inconsistently, or decisions are not documented.

Why Auditors Care: Fiduciaries need evidence that investment decisions are prudent and monitored regularly.

How to Rectify It:

• Maintain an Investment Policy Statement (IPS).
• Conduct quarterly investment reviews.
• Document discussions regarding underperforming funds.
• Retain meeting minutes and supporting reports.

9. Loans and Distributions Don’t Follow Plan Rules

Red Flag: Loans, hardships, or distributions are processed inconsistently or without supporting documentation.

Why Auditors Care: Operational errors involving participant transactions are highly visible during audits.

How to Rectify It:

• Verify hardship documentation requirements are met.
• Monitor loan repayment activity.
• Review distribution procedures annually.
• Conduct periodic transaction audits.

10. Fiduciary Decisions Are Poorly Documented

Red Flag: Committee meetings, decisions, and oversight activities are not properly recorded.

Why Auditors Care: If there is no documentation, auditors and regulators often assume the oversight did not occur.

How to Rectify It:

• Establish a fiduciary committee with defined responsibilities.
• Hold regular governance meetings.
• Maintain meeting minutes and supporting materials.
• Create a fiduciary audit file for easy retrieval.
• Conduct ongoing fiduciary training.

Is Your Plan Ready for an Audit? Get an Audit Readiness Checklist

Most audit findings start as small process gaps that go unnoticed. By regularly reviewing these 10 areas, plan sponsors can identify warning signs early, correct issues before an auditor uncovers them, and reduce the risk of costly findings, corrective actions, and fiduciary exposure.

To make this easy, we’ve created a 401(k) Audit Readiness Checklist that helps you quickly evaluate your plan against these red flags and identify any gaps. Click here to get your checklist.