Summary: Filing Form 5500 does not close out your plan audit. Findings left unattended (e.g., late remittances, missed deferrals, vesting errors, loan problems) come back as repeat findings and costlier corrections next year. Here are the follow-up steps plan sponsors should take before year-end, while the audit is still fresh.
You’ve filed your Form 5500 with the auditors’ report attached, and you’ve finally exhaled. The next priority lands on your desk and last year’s plan audit fades from view. Not so fast. A handful of loose ends, left unattended now, can turn into costly corrections later, so take a few minutes to close them out before they slip your mind.
The weeks right after an employee benefit plan audit are the best time to do this work. The findings are documented, your records are still organized, and you have months of runway before year-end. Wait until spring, and the same items come back as repeat findings, this time carrying lost earnings, excise taxes, and a harder conversation with your auditor.
What should you do with your employee benefit plan audit findings?
Start with the findings themselves.
Most fall into a handful of familiar categories and have a defined correction path through the IRS Employee Plans Compliance Resolution System (EPCRS) or the Department of Labor (DOL) Voluntary Fiduciary Correction Program (VFCP). Work through each one now so it can be reported as corrected in your next filing, and so your audit and assurance team is not revisiting the same items a year from now.
Late remittances
If your audit uncovered late remittances and these were reported on the supplemental schedules included with your filing, act before year-end to correct them so they can be reported as corrected in your next filing. If you have not already deposited the late funds, do so promptly:
- Calculate lost earnings using the DOL online calculator and deposit these into the affected participants’ accounts;
- You may also need to file Form 5330 and pay any applicable excise taxes;
- Finally, evaluate why these late remittances occurred, and put controls in place to reduce the chances of them happening again.
Since March 17, 2025, the DOL’s amended VFCP has included a self-correction component for delinquent participant contributions and loan repayments. Where lost earnings total $1,000 or less, the amounts reach the trust within 180 days of withholding, and the plan is not under investigation, you can file a notice of correction through the Employee Benefits Security Administration (EBSA) web tool instead of a full VFCP application.
Missed deferrals
A common audit finding is that a participant or participants were not provided with the opportunity to contribute when they should have been under the plan provisions. This can arise from:
- Excluded employee classes: excluding a certain class of employees (such as part-time or seasonal)
- Compensation definition errors: failing to follow the plan’s definition of compensation (such as not withholding on bonuses, off-cycle paychecks, or final paychecks when no such exclusion exists in the plan document)
- Auto-enrollment failures: not setting someone up for auto-enrollment properly or on time
If these errors were noted, be sure to thoroughly document the participants affected and the amount of the missed deferral and any missed match and calculate the proper correction using methods approved by the IRS. Remember that any correction must include lost earnings.
The cost of that correction depends heavily on timing, which is another reason to move now. The standard EPCRS method calls for a qualified nonelective contribution (QNEC) equal to 50% of the missed deferral. That figure drops to 25%, and to zero for certain automatic enrollment and short-term failures, when the sponsor corrects quickly and notifies affected participants within 45 days of the date correct deferrals begin. SECURE 2.0 made the automatic enrollment safe harbor permanent, so this relief is available going forward rather than year by year.
Vesting errors
Vesting errors are easy to make because they often surface only when someone leaves. Your vesting schedule turns on years of service, so incomplete service records, or inconsistent tracking of rehires, leaves of absence, and acquired employee groups, can leave a participant paid too much or too little on the way out. The IRS treats the failure to follow the plan’s vesting rules as an operational failure that can put the plan’s qualified status at risk.
Pull the terminated participant population your auditor tested and recalculate vesting for anyone whose service history is not clean.
- Underpayments are corrected with makeup contributions plus lost earnings;
- The rules for overpayments have been greatly relaxed. Under certain circumstances, overpayment repayments may not need to be sought. However, overpayments may mean a repayment request and, if that does not succeed, a corrective contribution.
Confirm that the service data at your recordkeeper matches your Human Resources Information System (HRIS) because a mismatch there is usually what produced the error.
Participant loan errors
Participant loans generate findings out of proportion to their size, and the process breakdowns are predictable: repayments never set up in payroll after a loan is issued, deductions dropped during a leave of absence or a payroll conversion, loans issued above the legal limit, or amortization periods longer than the plan document and the Internal Revenue Code allow.
Missed repayments that run past the plan’s cure period become a deemed distribution, which is a taxable event for the participant and an uncomfortable conversation for you. EPCRS allows correction through a lump sum payment, reamortization of the remaining balance, or a combination of the two. Where the failure was the employer’s fault, the employer contributes the interest that accrued because of the error. DOL’s self-correction component also reaches certain inadvertent loan failures corrected under EPCRS, and these corrections need the participant’s consent, so start those conversations early.
Have you used your forfeiture balance in time?
IRS regulations issued in February 2023, which plan sponsors may rely on now, call for forfeitures in a defined contribution plan to be used no later than 12 months after the close of the plan year in which they were incurred. For a calendar year plan, forfeitures incurred in 2025 need to be used by the end of 2026. Check to see if the balance at the beginning of the year has been used this year yet. If not, make sure you have a plan to use at least the remaining balance before year-end.
Your plan document will dictate how you can use the balance. Most plans will permit the reduction of an employer’s contribution or payment of reasonable plan expenses. Any unused balance will likely need to be allocated to participants. If this does occur, be sure the allocation is also made in accordance with the plan document provisions.
Are any compliance failures still open?
If the results of your Actual Deferral Percentage/Actual Contribution Percentage (ADP/ACP) testing for the prior year required corrections, were they made on time? Be sure they are corrected before year-end to help avoid costly additional contributions.
Do you have your own copies of third-party provider records?
As you close out your audits, be sure you have downloaded documents from your third-party providers for your own records. This includes, among other documents:
- The annual trust report from your custodian;
- The summary of participant account activity from your recordkeepers; and
- Payroll details from your payroll provider.
Do not rely on them for storage or retention, especially given that changes in such providers may happen in the future. Store files where your team can find them, under a naming convention that survives turnover. When a provider relationship ends, the window to request historical records is short and rarely convenient.
Who has access to your plan systems?
Your processes should include regular review of who in the organization has access to key systems and who has the ability to grant and terminate that access. For plans, this is particularly important for system access to third-party recordkeepers, payroll providers, and the HRIS. The end of an audit is a good time to conduct such a review to help ensure any unnecessary access is revoked.
Final thoughts
These are just a few reminders to build into your final audit closeout process. The end of the audit is the ideal time to close any gaps before they resurface as next year’s findings, so nothing about your plan catches you off guard down the road.
Put the closeout in writing. A short memo listing each finding, the correction taken, the date it was completed, and the control change that follows from it does two jobs. It gives your auditor a clear trail next year, and it builds the documented practices and procedures that IRS self-correction relief depends on.
