401(k) Audit Requirements: 100 Participants and the 80-120 Rule

It depends on one count taken on the first day of the plan year: participants who have account balances. The 2025 Form 5500 instructions say a return for a plan that covered fewer than 100 participants at the beginning of the plan year is completed as a small plan, and one for a plan that covered 100 or more is completed as a large plan. A defined contribution plan uses the number entered on line 6g(1).

A large plan files Schedule H. The instructions say plans filing Schedule H are generally required to engage an independent qualified public accountant and attach that accountant's report under ERISA section 103(a)(3)(A). A small plan files Schedule I, or the shorter Form 5500-SF where it qualifies, and can be exempt from the audit if it meets the waiver in 29 CFR 2520.104-46.

The tree below shows how the count routes a plan. It starts with participants who have balances on day one of the year. Under 80 leads to the small-plan path. Over 120 leads to the large-plan path. In between, the plan asks whether it filed a Form 5500 last year, and if so may keep last year's category.

Only participants who have an account balance at the start of the plan year count toward the 100. Line 6g(1) says to enter the total number of participants included on line 5 (total participants at the beginning of the plan year) who have account balances at the beginning of the plan year. Line 5 itself is wider: for a 401(k) plan it includes individuals who are eligible to elect to have the employer make payments under the cash or deferred arrangement.

That gap answers a common question. A company with 100 eligible employees where 70 have balances counts 70, not 100, for the audit test. For pension plans, alternate payees under a qualified domestic relations order are not counted as participants on these lines.

Illustrative example, which foots:

This plan counts 89. That is under 100 but inside the 80 to 120 zone, so last year's filing category matters, as the next section explains.

Two timing points. A plan that checks the "first return/report" box on Part I, line B uses the end-of-year number on line 6g(2) instead. And the count is a snapshot of the first day, so a hire in the middle of the year shows up in next year's count, not this year's (instructions for lines 5 and 6g, checked 2026-10-19).

The 80-120 rule lets a plan with between 80 and 120 participants file in the same category it filed last year. The instructions put it this way: if the number of participants is between 80 and 120, and a Form 5500 was filed for the prior plan year, you may elect to complete the return in the same category, "large plan" or "small plan," as was filed for the prior return. The same election appears in 29 CFR 2520.103-1(d), which refers to 80 to 120 participants inclusive.

The instructions give an example. A plan filed its 2024 return as a small plan, and its 2025 participant count is 120 or less. It may complete the 2025 return as a small plan, including filing Form 5500-SF where eligible.

Illustrative: a plan filed small for 2025 and has 118 participants with balances on January 1, 2026. It may file small for 2026. If it has 123 on January 1, 2027, it must file large for 2027, and 2027 is its first audited year.

Choosing large has a cost. Under 29 CFR 2520.104-46(d)(4), a plan that elects to file as a large plan may not claim the audit waiver. A plan that qualifies to stay small but chooses large has chosen the audit.

The instructions also carry a short-plan-year rule. Where a plan year is seven months or less, an election can defer the accountant's report under 29 CFR 2520.104-50, covered in the due-date section below.

A small plan skips the audit only if it meets the conditions in 29 CFR 2520.104-46; being under 100 is necessary but not sufficient. The waiver relieves the administrator of engaging an independent qualified public accountant and of attaching a report (paragraph (c)). It does not relieve the plan of filing the Form 5500 (paragraph (d)(1)).

For a pension plan the main condition is about the assets. Either at least 95 percent of plan assets are "qualifying plan assets," or anyone who handles the non-qualifying assets is bonded under ERISA section 412 for at least their value. The regulation's own example is a plan with a $20,000 real estate partnership interest out of $600,000 in total assets: under 5 percent, so no extra bond. A second plan with $42,000 of non-qualifying assets out of $600,000 is 7 percent and needs a bond for the $42,000.

The summary annual report must also name each institution holding qualifying assets, state that participants may ask for the statements and any bond, and say where to go at the Department of Labor if they cannot get them. Form 5500-SF adds its own gate: the plan must be exempt from the audit requirement, and not by reason of enhanced bonding (2025 instructions, Form 5500-SF eligibility note).

So a 70-participant plan with a private fund or a real estate interest above that 5 percent line, and no bond, can owe an audit it assumed it did not.

A limited-scope audit narrows what the auditor tests; it does not remove the auditor or the report. The Form 5500 instructions now call it an ERISA section 103(a)(3)(C) audit. They say neither of the regulations behind it exempts the administrator from engaging an independent qualified public accountant or from attaching the report.

A second narrowing exists for pooled funds. Under 29 CFR 2520.103-12, the audit need not extend to investments in a pooled fund that files its own audited Form 5500 as a 103-12 investment entity.

The form of the opinion changed with the auditing standard. The instructions for Schedule H line 3a(1) say an unmodified opinion under SAS 136 includes the form that SAS 136 permits an accountant to issue when it performed an ERISA 103(a)(3)(C) audit with no modifications. The auditor still signs a report, and it is still attached.

A plan whose assets are all held and certified by a qualifying bank or insurance carrier is the natural candidate. Assets at a securities brokerage firm do not qualify, per the instructions.

The filing is subject to rejection as incomplete, and penalties may be assessed. The Schedule H instructions say so directly: if the required auditor's report is not attached to the Form 5500, the filing is subject to rejection as incomplete and penalties may be assessed. The report is expected unless the plan checks line 3d(1) or 3d(2) to show an exemption.

The instructions list three administrative penalties; the two that reach a 401(k) filing are below, quoted as printed in the 2025 instructions, checked 2026-10-19.

The instructions add that the DOL amount is adjusted for inflation each year after the instructions are published, so check the Department of Labor's site for a newer maximum. The instructions say these may be assessed unless the failure to file properly is for reasonable cause.

The Delinquent Filer Voluntary Compliance (DFVC) Program lets an administrator who is late with a Title I annual report pay reduced civil penalties by filing voluntarily. A filing under the program checks the box on Part I, line D.

Prevention is cheaper. The Form 5500 is due the last day of the seventh month after the plan year ends, July 31 for a calendar-year plan (instructions, checked 2026-10-19). A one-time extension of up to 2½ months comes from IRS Form 5558 filed on or before that due date, which moves a calendar-year plan to October 15.

The auditor must be an independent qualified public accountant, which is a CPA certified, or a public accountant licensed, by a state regulatory authority; the statute adds a third category for states with no licensing. The statute is 29 U.S.C. 1023(a)(3). Independence is the harder test.

The Department of Labor's interpretive bulletin, 29 CFR 2509.2022-01, says the Department will not recognize as independent an accountant who is not in fact independent of the plan, and it looks at all relationships with the plan sponsor and its affiliates. Its list of examples includes one that matters for outsourced bookkeeping: the Department will not consider an accountant independent if the accountant or a member of the firm maintains financial records for the plan.

Paragraph (c)(2) adds a softer warning. Providing multiple services to a plan may suggest a lack of independence when the services are subject to audit procedures in the plan's audit.

For a sponsor, this has two consequences. If a firm keeps the plan's financial records, it should not be the firm that audits them. And the sponsor's own bookkeeping provider should be checked against the same test before anyone proposes it as the plan's auditor.

If Finbryn keeps your books, we refer your audit to an independent CPA practice that is independent of Finbryn. Independent of Finbryn means a CPA practice that has no name, brand, owner or partner in common with Finbryn, isn't controlled by Finbryn or by anyone who owns Finbryn, shares no staff, profits or costs with Finbryn, and pays Finbryn no fee and receives none from it. The plan's auditor is never Finbryn. On request we introduce independent licensed CPA practices; you engage the one you choose directly, under its own engagement letter.

The auditor needs records that tie contributions from payroll to the plan, and participant data that supports eligibility and balances. Each auditor sends its own request list, and that list governs; these are the typical items.

Deposit timing deserves care. A plan with fewer than 100 participants at the beginning of the plan year has a safe harbor in 29 CFR 2510.3-102(a)(2): amounts deposited by the 7th business day after they are withheld are deemed timely. Larger plans use the earliest date the money can reasonably be separated from the employer's general assets. The date on a recordkeeper's summary can be the investment date, not the date the money left the employer's account, so keep bank evidence.

ERISA section 107 also requires records supporting the report to be kept available for examination for at least six years after the filing date.

Trial balance and PBC support for your plan's independent auditor. Our plan audit preparation support page describes the data tie-outs and timeliness workpapers we prepare for TPAs and accounting firms. For plan limits that feed eligibility and testing, see retirement plan limits and actuarial rates for 2026.

The independent CPA practice sets the fee, and the report is due with the Form 5500. We publish no price for the audit, and the instructions give none; the practice you engage quotes it under its own engagement letter. Finbryn receives no fee or commission tied to any audit.

Asset size, the number of investment types and whether the audit is limited-scope are the usual levers, and the quote is the only number that counts.

The report rides on the filing calendar. For a calendar-year plan the timeline below shows the order. The July 31 date is the rule in the instructions; the October 15 date applies only if Form 5558 was filed on time.

Short plan years get special treatment. Under 29 CFR 2520.104-50, where one of two consecutive plan years is seven months or less, the administrator need not include the accountant's report for the first of the two years. The first year's report must instead carry the financial statements, an explanation of the short year, and a statement that the next report will include the accountant's report covering both years. The second year's report then covers both years and notes any material differences from the unaudited figures. The 2025 instructions add that if the deferral was used for the prior plan year, the next return must follow the large-plan rules, with Schedule H and the accountant's reports, whatever the participant count.

For nonprofit sponsors, a different set of audit rules also applies to the organization itself: see nonprofit audit requirements by state.