Is Your 403(b) Plan Audit Ready? What We Want You to Know

We had the opportunity to present at Brown Edwards’ Higher Education Summit, and we are grateful for the engaged group who joined us. Brittany spends the majority of her professional time in the employee benefit plan audit space — and assists with leading the firm’s EBP practice out of our Roanoke, Virginia office, and Emily works alongside Brittany in the EBP space and focuses the majority of her time in the higher education practice from our Charleston, West Virginia office.

Our goal for the session was straightforward: give you a few practical takeaways you can bring back to your campus right now to strengthen your compliance, improve your processes, and make sure your 403(b) plan audit is as smooth as possible. Here is a summary of what we covered.

Why Audit Readiness Matters More Than You Might Think

We know the 403(b) audit can feel like one of those things that sits on the side — you know it’s coming, but it doesn’t always get the same attention as the financial statement audit or the uniform guidance audit. What we want to share is that a little intentional preparation goes a long way. When a plan is truly audit ready, everything runs more smoothly for your team and ours. Delays shrink, back-and-forth is minimized, and we can stay focused on what actually matters rather than tracking down documentation.

In our experience, the organizations that handle these audits most efficiently are not necessarily the ones with the most sophisticated systems — they are the ones that have built consistent, repeatable processes around two things: communication and organization. That’s what we want to walk you through.

Communication: The Earlier, the Better

Strong communication with your audit team should start before we even begin pre-audit planning. The single most helpful thing you can do is let us know about changes early. We mean any changes: plan provisions, your payroll provider or TPA, staffing at your office, contacts at service organizations, or significant shifts in your internal processes.

Here is why this matters so much: even small changes can affect our audit approach, our timeline, and the scope of our testing. When we know upfront, we can plan accordingly. When we find out during fieldwork, we are reacting — and that is where delays and disruptions start.

We also want to make sure expectations around timing are clear from the start. For calendar year plans the Form 5500 regulatory deadline is July 31, with an extension to October 15. Let us know early whether you have a preference or an internal deadline outside of those. We all know summer is a busy time for vacations, and higher-ed campuses sometimes have unique schedules — office closures, half-day Fridays, institution-wide time off. Please communicate those things to us. It sounds simple, but it makes a real difference in keeping the audit on track.

We use a document management platform called SuraLink, and a lot of our communication and documentation exchange happens there. We are happy to work through emails, phone calls, or Teams chats as well — just let us know what works best for you. If a long email chain is getting unwieldy, do not hesitate to suggest a quick call. We appreciate that kind of direct communication.

One other area we want to flag: benefit plan audits involve sensitive payroll data. If there are people on your team who are involved in the audit process but should not have access to all of that information, please let us know upfront so we can be mindful of who receives access.

During fieldwork, we encourage you to track open items actively. SuraLink sends email notifications when changes are made to requests — please stay on top of those so nothing sits unresolved. We are also happy to set up regular check-in meetings if that is helpful for your team.

Organization: Set Yourself Up for Success Year After Year

Certain documents are requested every single year, which means you can plan for them well in advance. Having these ready and organized before we arrive makes a significant difference. The core annual items include:

• Internal control narrative
• Census data, reconciled to payroll (this is the population we draw our samples from, so timing and completeness matters)
• Year-to-date payroll registers or W-3s
• The audit package from your TPA, which includes participant-level reports, compliance testing results, and the draft Form 5500 — we prefer to have this at least two weeks before scheduled fieldwork
• Plan document amendments or agreements
• Contribution timeliness schedule
• Regulatory communications and meeting minutes

Having the documents is only part of it. How they are organized and named matters a great deal. We have seen instances where someone uploads multiple scanned documents with scanner-generated file names — numbers and initials that mean nothing to us — and we may not realize for some time that a document we needed was actually already there. Naming files clearly and uploading them to the correct line item in SuraLink eliminates that kind of inefficiency.

We also want to make a point about organizational continuity. We have worked through situations recently where significant staff turnover meant no one on the current team could explain how prior-year audit documentation was organized or where it was saved. If your prior-year files are not named and structured in a way that someone unfamiliar with your processes could follow, that creates real risk — both for the audit and for your own institutional knowledge. Please think about how your audit documentation is maintained on your server and whether it would hold up if your team changed.

Audit readiness is not just about this year. The organizations we see handle these audits most efficiently have built systems that carry forward. They are not starting from scratch every cycle. That is the goal we want to help you reach.

SECURE 2.0: What It Means for Your 403(b) Plan

Brittany walked attendees through key SECURE 2.0 provisions, with a focus on what they mean practically for higher education 403(b) plan sponsors. SECURE 2.0 is not just a legislative update, it represents a shift toward expanding access and strengthening retirement readiness for your employees. While many final regulations are not yet effective and plan amendments are generally not due until December 31, 2026, it is important to note that operational compliance is required now.

Across all of these provisions, a recurring challenge is software coordination. Tracking hours over multiple years, prior-year wage data, age thresholds, and contribution types requires systems that are capable and accurate. Misclassification of employees and manual tracking are among the most common operational risks we anticipate seeing.

Long-Term Part-Time Employee Eligibility

Undoubtedly the single most talked about provision, LTPT eligibility. With SECURE 1.0, 403(b) plans were not subject to long-term part-time employee eligibility rules. SECURE 2.0 extended those rules to 403(b) plans beginning in 2025. Employees who have worked 500 hours of service within two consecutive 12-month periods must be given the opportunity to make elective deferrals.

We want to flag why this is especially relevant for higher education: you have adjunct faculty, part-time instructors, and student and seasonal employees. This provision was made for your workforce. It is important to point out that you are not required to make employer match contributions for these employees, but you must give them the opportunity to enroll and defer.

This is the first year we will be auditing this provision. You have been operating it for about a year and a half, but this is the first audit cycle where it will be tested. Expect increased questions from us about your controls around tracking part-time service hours, requests for supporting documentation, and samples to verify proper eligibility inclusion and timely deferral commencement. On the plans we have started auditing, we are frequently seeing a manual tracking process. We strongly encourage institutions to work toward a system-driven solution, if possible.

Roth Catch-Up Contributions (Effective 2026)

For individuals over age 50 with wages exceeding $150,000 (indexed, previously $145,000), catch-up contributions must now be made on a Roth basis. This provision is now effective January 1, 2026, with the wage trigger based on 2025 wages. In 2024, the IRS extended the original implementation deadline by two years due to the operational complexity involved.

To comply, you need to ensure your plan allows Roth contributions, that payroll can identify eligible employees based on prior-year wages, and that your record keeper is set up to accept these contributions. We will not be auditing this provision until next year, but the operational work needs to happen now.

Enhanced Catch-Up Contributions for Ages 60–63 (Voluntary)

This is a voluntary provision that we are seeing a lot of plans adopt. It increases the catch-up contribution limit for participants between ages 60 and 63 to the greater of $11,250 or 150% of the regular catch-up limit. The standard limit resumes at age 64. If your plan has adopted this provision, we will ask about your monitoring controls, verify that your system limits are set correctly for the eligible age range, and include testing of catch-up contributions for these participants in our sample.

Required Minimum Distribution Age Increase

The RMD age was previously 70½ and was increased to 72 under the original SECURE Act. SECURE 2.0 further increased the RMD age to 73 beginning in 2023, with a scheduled increase to 75 in 2033. Individuals who had not yet reached age 72 by December 31, 2022 are subject to the new age 73 requirement, meaning their first RMD is not required until they reach age 73. Most plans rely on the record keepers to process distributions, so this is primarily a matter of coordinating with your TPA to confirm alignment with the updated rule.

Roth 403(b) Accounts and Lifetime RMDs

As of 2024, Roth 403(b) accounts are no longer subject to lifetime required minimum distributions. Please ensure that your plan is not distributing RMDs from the Roth portion of participant accounts unless the distribution is based on a participant election or other permissible plan distribution event.

Hardship Withdrawal Rules

For plans that allow hardship distributions, the 403(b) rules have been updated to more closely align with 401(k) plan rules by expanding the types of contributions that may be made available for hardship distributions. However, plans are not required to make all such amounts available. This provision applies only if the plan permits hardship distributions and is intended to simplify administration and provide greater flexibility for plan sponsors.

Common Audit Findings: The Issues We See Occur Frequently Across Plans

We want to end our session by highlighting the most common issues we encounter in our audit procedures. These are recurring findings we see across many institutions and are typically the result of process gaps rather than complex technical issues. None of these are new, and in most cases, they are entirely preventable with stronger controls and more consistent procedures.

1. Late Remittances

Employee deferrals and loan repayments must be remitted as soon as administratively feasible. The Department of Labor provides up to the 15th business day of the following month as an outer limit — but this is not a safe harbor. In our experience, most plans have the ability to remit well within that window. If your plan typically remits in one to three days, or five to seven days, anything beyond that could be considered late.

The most common explanation we receive for late remittances is that the payroll coordinator was on vacation or was sick. We want to be direct: that is not an acceptable reason for a late deposit. Plans should have adequate backup and cross-training so that remittances continue on schedule regardless of who is in the office.

When late remittances occur, formal correction is required. The most common paths are the Voluntary Fiduciary Correction Program, the Audit Closing Program, and the Self-Correction Program. The IRS 401(k) Plan Fix-It Guide is a helpful resource. A corrected late remittance will still appear on a supplemental schedule in your financial statements. It is reported the year it is corrected and drops off the year after that.

Late remittances can impact the audit beyond the correction itself. These issues increase audit risk, may require expanded testing procedures, necessitate additional supporting documentation, and result in the inclusion of a delinquent participant contribution schedule as a supplement to the financial statements. Even small late remittances can affect the overall audit.

2. Eligibility and Enrollment Errors

We want to be clear: these errors are almost never intentional. They are process issues. They happen because of misunderstandings of the plan document, manual tracking, or breakdowns in communication between HR, payroll, and the service provider. Common examples include delayed entry into the plan, missing the auto-enrollment trigger, failing to apply auto-escalation on schedule, missed deferrals because a paper form never made it from HR to payroll, and — on the other side — employees being allowed to participate prior to satisfying eligibility requirements.

Changes in vendors is a common triggering event for these types of errors. A new TPA may misinterpret the provisions of your prior plan document, producing a written document that does not reflect how your plan has actually been operating — even when you explicitly communicated that you wanted no changes. The result is a plan that is inadvertently out of compliance with its own document. Also, payroll system changes are another common trigger, where pay codes identifying plan compensation exclusions are not set up properly in the new system. We see this quite often.

Corrections for missed deferrals typically involve a QNEC equal to 50% of the missed employee deferral, the full employer match (if applicable), and lost earnings. These corrections are employer-funded. Beyond the cost, the administrative burden of identifying the full extent of the error — because what looks like one person’s issue often impacts multiple participants — is significant.

3. Incorrect Compensation

Errors in how compensation is defined and applied are among the most common findings we encounter in our audits. These issues most frequently arise in the treatment of bonuses and fringe benefits. We also often identify inconsistencies between the summary plan description and the formal plan document—it's important to remember that the plan document is the governing authority in all cases.

A key nuance to keep in mind is that compensation definitions may differ between employee deferrals and employer contributions, such as match or profit sharing. When these definitions are not aligned, it is critical that all parties involved—HR, payroll, and the plan administrator—clearly understand and consistently apply the appropriate definitions. Failure to do so can result in missed deferrals, incorrect employer contributions, over- or under-funded accounts, and potentially costly corrections. Transitions such as changes in TPAs or payroll systems are common points where these issues can arise.

4. Use of Forfeitures

This is an area that has seen increased legal attention recently. There have been lawsuits alleging that using forfeitures to reduce employer contributions benefits the plan sponsor rather than plan participants, potentially breaching ERISA’s duties of loyalty and prudence. The IRS permits this practice if the plan document allows it, but the legal landscape is shifting.

Your plan document governs the timing and order in which forfeitures can be used. If forfeiture balances are accumulating beyond IRS deadlines — generally, forfeitures should be utilized by the end of the plan year following the year of forfeiture — that is a compliance risk. Review your plan document carefully and make sure the Plan is in compliance with the specific forfeiture provisions, as defined in the document.

Our Key Takeaways for You

We covered a lot of ground in our session. Here is what we hope you carry back to your campus:

• Ensure plan provisions are clearly documented and that everyone involved in plan operations — HR, payroll, your TPA — has a clear understanding to ensure the Plan is operating as intended.
• Automate wherever possible to reduce the risk of human error.
• Perform regular reconciliations and reviews — do not wait for the audit to discover problems.
• Communicate changes early with your audit team.
• Build documentation practices that can survive staff transitions.

We genuinely enjoy working with higher education institutions and are proud of the relationships we have built in this space. If you have questions about anything we covered — whether it is a SECURE 2.0 provision, a specific audit finding, or how to get started building a better audit readiness process — please reach out. We would be glad to talk it through with you.