Form 5500 audit requirement: IQPA opinion and 80–120 rule

ERISA §103(a)(3)(A) and 29 CFR 2520.103-1(b) require the annual report of a plan covering 100 or more participants at the beginning of the plan year to include the report of an independent qualified public accountant on the plan's financial statements and schedules. That is the whole rule. Every exception is a regulation carving plans out of it, and three matter.

Small plans are waived. Under 29 CFR 2520.104-46, a pension plan with fewer than 100 participants skips the audit if at least 95 percent of its assets are “qualifying plan assets” held by a regulated institution (or anyone handling the rest is bonded for their full value) and the summary annual report names the institutions. A welfare plan under 100 is waived with no conditions at all (§2520.104-46(b)(2)).

Unfunded and insured welfare plans are exempt at any size. 29 CFR 2520.104-44 exempts a welfare plan from engaging an IQPA and from the financial items of the form when benefits are paid solely from the employer's general assets, exclusively through insurance contracts or an HMO with premiums paid from general assets (or general assets plus employee contributions forwarded within three months), or a combination. The regulation's own example is an insured welfare plan with 100 or more participants: it files Form 5500 with Schedule A and “is not required to engage an independent qualified public accountant.” This is why nearly every employer health plan in the BenefitsLedger record is audit-exempt. A fully insured medical plan is paid through insurance; a self-funded plan pays claims from the general account; and employee premium shares collected through a §125 cafeteria plan are not held in trust, because DOL Technical Release 92-01 announced it would not enforce the trust requirement against them and the Form 5500 instructions treat such a plan as unfunded. The audit reaches a welfare plan only when it holds assets — a VEBA or other trust, a separately maintained fund, or employee contributions that are segregated and invested rather than used to pay premiums.

The count itself changed in 2023. For plan years beginning on or after January 1, 2023, a defined contribution pension plan (401(k), 403(b), profit-sharing) measures large or small status by the number on Form 5500 line 6g(1): participants who have an account balance at the beginning of the plan year. Eligible employees who never deferred and have no employer money no longer count. A first-year plan uses the end-of-year figure on line 6g(2). The DOL's stated purpose was to take the audit off small employers whose 401(k) had many eligible but few enrolled. Defined benefit plans and welfare plans still count every participant under the line 5 definition; the Form 5500-SF eligibility guide covers how a welfare plan counts employees, COBRA beneficiaries and retirees.

29 CFR 2520.103-1(d) lets a plan with between 80 and 120 participants (inclusive) at the beginning of the plan year file the same category of annual report — large or small — that it filed for the previous plan year. The instructions add the condition people miss: a Form 5500 or 5500-SF must actually have been filed for the prior year. A funded plan that filed small at 95 and opens the next year at 118 may stay small and keep the audit waiver; it loses that option only when the count exceeds 120. The rule is an election, not a mandate, and it runs both ways: a plan that filed large at 110 and drops to 96 may keep filing large and keep its auditor for consistent statements. The edge cases and a calculator are in the audit-opinion trigger guide; this page assumes you have landed on the large-plan side.

Count is measured at the beginning of the plan year; “with balances” means participants with account balances. The 80–120 election can override the participant column for a plan that filed last year.

The IQPA audits the plan's financial statements — net assets available for benefits at the beginning and end of the year, changes in net assets, and notes — plus the DOL's supplemental schedules (assets held at end of year, reportable transactions, delinquent participant contributions). The signed, dated report is attached to Form 5500 and summarized on Schedule H line 3, where the administrator checks the opinion type: unmodified, qualified, disclaimer, or adverse. The instructions are blunt about the alternative: “If the required IQPA's report is not attached to the Form 5500, the filing is subject to rejection as incomplete and penalties may be assessed.” Schedule H is open to public inspection, so the opinion type is part of the plan's permanent record.

Most plans elect what used to be called a “limited scope” audit. Under 29 CFR 2520.103-8 the audit need not extend to investment information prepared and certified as complete and accurate by a bank, similar institution, or insurance carrier that is regulated, supervised, and subject to periodic examination by a state or federal agency. A securities broker is not a “similar institution” (DOL Advisory Opinion 93-21A), so a plan whose assets sit at a brokerage cannot use the election. SAS No. 136, codified at AU-C section 703 and effective for periods ending on or after December 15, 2021, renamed this the ERISA section 103(a)(3)(C) audit and requires management to acknowledge that the election is permissible, the certifying institution qualified, and the certification compliant. The election is recorded on Schedule H line 3b. It does not change the administrator's duty to report those assets correctly on the form, and the regulation does not exempt the plan from engaging an auditor.

The DOL's Office of the Chief Accountant reviewed 307 randomly selected audits from the 2020 filing year and published the results in November 2023. Thirty percent had major deficiencies under generally accepted auditing standards — down from 39 percent in the 2015 study, but still putting $927.6 billion in plan assets and 11.7 million participants at risk. The driver was volume: firms auditing one or two plans a year had a 70 percent deficiency rate against 17 percent for firms auditing 100 or more. Peer review did not catch it — 295 of the 307 audits came from firms with a “Pass” peer review — while members of the AICPA Employee Benefit Plan Audit Quality Center had a significantly lower deficiency rate than non-members.

A deficient audit lands on the plan administrator, not the auditor. EBSA has no authority to penalize auditors directly — the study repeats the Inspector General's long-standing request for it — so its tool is the filing. Under the Deficient Filer Enforcement program the analyst issues a Notice of Rejection listing every deficiency; ERISA §104(a)(5) gives the administrator 45 days to respond with a satisfactory revised filing, after which a Notice of Intent to Assess a Penalty follows. The manual's schedule for a missing or deficient IQPA report is $150 a day capped at $50,000, with a note that rates may be higher on the facts; the statutory ceiling under §502(c)(2) is $2,739 a day with no cap. The DOL's own guidance to sponsors says it plainly: “you might be assessed a civil penalty for an incomplete, inadequate, or untimely audit report.” The practical cost is a second engagement, often with a different firm, under a 45-day clock.

The worked example is a calendar-year plan for the 2026 plan year. Form 5500 is due July 31, 2027; a Form 5558 filed by that date extends it to October 15, 2027. Auditors are at capacity from August through early October, so a plan that starts in July is competing for the same staff as everyone else.

1. January 2027 — count. Pull the participant count as of January 1, 2027 (line 6g(1) for a DC plan, line 5 for everything else) and decide large or small, applying the 80–120 election if it is available.
2. February–March 2027 — engage. Issue an RFP if the firm is new, sign the engagement letter, and decide the 103(a)(3)(C) election after reading the custodian's certification language.
3. April 2027 — hand over records (list below) so planning and control testing can start.
4. May–June 2027 — fieldwork. Participant-level testing of eligibility, deferrals, matches, distributions and loans; open items here are the usual reason a report slips.
5. By July 31, 2027 — extend. File Form 5558 on or before the original due date if the report will not be final; see the Form 5558 guide.
6. August–September 2027 — draft Form 5500. SAS 136 requires the auditor to obtain and read a substantially complete draft of the Form 5500 before issuing the report, so the TPA's draft has to exist before the opinion does.
7. By October 1, 2027 — report dated and signed. Two weeks of margin for the administrator's review, Schedule H line 3 answers, and the attachment upload.
8. October 15, 2027 — file on EFAST2. The Form 5500 due-date guide covers non-calendar and short plan years.

The DOL's Selecting an Auditor for Your Employee Benefit Plan treats the hire as a fiduciary act, and its data explains why. Work through these in order.

1. Ask how many plan audits the firm signs each year. The 2023 study's deficiency rates by volume — 70 percent at 1–2 plans, 17 percent at 100 or more — are the single most predictive fact available. A general-practice CPA who also does the corporate return is the profile the DOL flags.
2. Check EBPAQC membership. Member firms must designate an audit partner responsible for the ERISA practice, give every partner who signs a plan opinion at least 8 hours of plan-specific CPE every three years, run an annual internal inspection, have their plan audits peer-reviewed by someone from another member firm, and publish their peer-review results. The AICPA keeps a searchable member directory.
3. Verify the license and read the peer review. Confirm with the state board that the license is current, and ask for the last peer-review report; plan audits are “must-select” engagements, so a firm with none reviewed has an explanation to give.
4. Confirm independence and call references on plans of the same size, recordkeeper and type, and ask whether the report arrived before the extended deadline.
5. Read the engagement letter. It should name the scope (full or 103(a)(3)(C)), the timing, the fee, and the split of responsibilities; the AICPA's RFP and auditor-evaluation tool gives a scoring template.
6. At the end, ask the DOL's eight questions. Were plan assets fairly reported; obligations properly stated; contributions correctly calculated and timely remitted; benefits paid per the plan terms; employees properly included or excluded; participant accounts fairly stated; tax-status issues identified; prohibited transactions reported. An auditor who cannot answer each one did not test it.

• Trust and custodial statements for the full year, plus the custodian's certification letter if the 103(a)(3)(C) election is planned — from a bank, trust company or insurer, not a broker-dealer.
• Census and payroll: hire, termination, birth and eligibility dates, plan-defined compensation, and deferral elections, reconciled to the recordkeeper's contribution file by pay date.
• SOC 1 Type 2 reports from the recordkeeper, trustee and payroll provider, with the complementary user controls the sponsor performs marked.
• Plan documents: the current restated document and amendments, the IRS determination or opinion letter, the SPD, and the trust agreement. SAS 136 makes management responsible for keeping the plan document current.
• Fiduciary and transaction records: committee minutes, the fidelity bond, 408(b)(2) fee disclosures, the prior-year Form 5500, distribution and loan files with signed elections, and a remittance log with the deposit date for every payroll — late deposits go on the delinquent contributions schedule.
• The draft Form 5500, substantially complete, before the report date.

No. It is a large plan and must file Form 5500 with a Schedule A for each contract, but 29 CFR 2520.104-44(c) exempts a plan described in paragraph (b)(1)(ii) from engaging an IQPA and from the financial schedules as long as premiums come from general assets or from general assets plus employee contributions forwarded to the insurer within three months. The same answer applies to a self-funded medical plan paid from the general account and to a health FSA run through a §125 plan. Put the plan into a VEBA, or let employee contributions accumulate in a separate account rather than pay premiums, and the exemption is gone.

For plan years beginning on or after January 1, 2023, yes. Line 6g(1) counts the 85 with balances, the plan is a small plan, and the audit is waived if the §2520.104-46 asset and disclosure conditions are met. If the plan filed large with an audit for the prior year, it may still elect large under the 80–120 rule for continuity, but nothing requires it. Confirm the recordkeeper's count excludes zero-balance accounts of terminated employees paid out before the first day of the year.

File anyway, and amend with the report the day it is signed. A Form 5500 filed without the IQPA report is treated as incomplete and will draw a Notice of Rejection, but the §502(c)(2) penalty runs per day for each day the administrator “fails or refuses to file a complete and accurate report,” so a filing with the report attached late stops the clock sooner than no filing. If the plan year was seven months or less — a new plan or a changed plan year — 29 CFR 2520.104-50 lets the administrator defer the audit to the following year and cover both periods then. For a plan that has gone a full year without filing at all, the Late-Filing Penalty Check sizes the exposure and the DFVCP route.

• Confirm which row of the decision table each of your plans sits in. Most sponsors have one audited plan (the 401(k)) and one exempt plan (the health plan); make sure the wrap plan holds no trust assets that would change that.
• Pull the beginning-of-year count now, on the correct line, and file it with the plan's permanent records along with the 80–120 analysis if it was used.
• If the audit is required, have the engagement letter signed in the first quarter and the record list above delivered by April.
• Look up your own filings on the employer index to see which years carried a Schedule H and what opinion type was reported, and run the Late-Filing Penalty Check for any year that is missing.