Summary: A retirement plan is one of your most valuable benefits and one of your largest areas of fiduciary exposure. ERISA keeps responsibility with the plan sponsor even when the work is outsourced. Four practices help reduce that risk: share oversight with advisors, monitor your service providers, assign clear internal ownership, and correct errors quickly, before your next plan audit turns them into findings.
What are a plan fiduciary’s responsibilities under ERISA?
Under the Employee Retirement Income Security Act (ERISA), a fiduciary is anyone with discretionary control or authority over the management of a plan or its assets, with discretionary authority or responsibility for the administration of a plan, or who gives investment advice about the plan for a fee. Fiduciaries are required to:
- Act solely in the interest of participants and beneficiaries
- Follow the plan document
- Pay only reasonable plan expenses
- Diversify plan investments
- Monitor the service providers and other fiduciaries they appoint
That list looks manageable on paper. In practice, plan oversight involves more moving parts than many organizations expect, from monitoring investments and fees to following notice, filing, and funding requirements on a fixed calendar. Failing to meet those obligations can lead to costly penalties.
As plans grow, so does the list of obligations. Plans generally need an annual audit once they pass 100 participants at the beginning of the plan year.
Why going it alone can create risk
Managing a retirement plan without experienced support creates unnecessary exposure, especially when plan administration is a small part of someone’s day-to-day responsibilities. The plan does not become less technical because it sits at the bottom of a long list.
Retirement plan consultants and ERISA attorneys help organizations get ahead of compliance issues before they turn into findings or corrections. They also bring a perspective from working across a range of plans, helping sponsors recognize when an arrangement they considered standard is uncommon.
What does a retirement plan committee do?
Sponsors of well-run plans tend to follow three core practices:
- They work with trusted advisors
- Establish an investment or retirement committee
- Meet on a regular schedule to review issues, make decisions, and document those discussions
The documentation carries as much weight as the meeting itself. Concise minutes that capture what the committee reviewed, the decisions it made, and the reasoning behind them can provide clear evidence that a fiduciary followed a prudent process.
Plan sponsors should also make a deliberate decision about how much investment responsibility to retain. A 3(21) fiduciary provides investment advice while the sponsor maintains decision-making authority. A 3(38) fiduciary assumes responsibility for selecting and managing the plan’s investments.
Can your third-party administrator take on your fiduciary responsibility?
Simply put, no. Outsourcing recordkeeping and administration can be a practical necessity, but a third-party administrator (TPA) or recordkeeper performs services on the plan’s behalf. It does not remove the plan sponsor’s fiduciary responsibility. It’s important to be cautious of providers who suggest they can manage every aspect of the plan with minimal sponsor involvement.
Outside support can be highly valuable, but responsibility for overseeing that support remains with the plan sponsor. Effective oversight comes down to three habits: monitor service providers, review their reports for unusual activity, and confirm that the information provided to them is complete and accurate.
| Who does the work | Typically performed by | Who stays responsible |
|---|---|---|
| Depositing participant contributions and loan repayments | Payroll provider and recordkeeper | Plan sponsor, as fiduciary |
| Participant data, eligibility, and vesting tracking | Payroll system and Human Resources Information System (HRIS) | Plan sponsor |
| Investment selection and monitoring | Investment advisor, as a 3(21) or 3(38) fiduciary | Plan sponsor, including monitoring the advisor |
| Compliance testing and Form 5500 preparation | TPA or recordkeeper | Plan sponsor, which signs the filing |
| Operating the plan in line with its document | Several parties at once | Plan sponsor |
| Retaining plan records | Each provider keeps its own | Plan sponsor keeps its own copies |
What should you look for in a provider’s SOC report?
Choose reputable recordkeepers that obtain an annual System and Organization Controls (SOC) report covering their recordkeeping services, then review the report carefully when you receive it. It should be treated as an important oversight tool, not a formality.
Pay close attention to any exceptions identified by the service auditor and to the complementary user entity controls, which are the safeguards the report assumes your organization performs. If those controls are not in place inside your organization, the provider’s clean report may not fully address your plan’s risk.
It is also important to confirm that your service providers maintain strong cybersecurity practices aligned with Department of Labor (DOL) guidance for plan sponsors, fiduciaries, recordkeepers, and participants.
Who keeps your plan records?
Download and retain copies of key plan records within your organization rather than relying solely on an outside provider for storage. These records should include the custodian’s annual trust report, the recordkeeper’s summary of participant account activity, and detailed payroll information.
Managing direct access to these records can help you prevent disruption and documentation gaps if you change providers. Once a service relationship ends, the opportunity to obtain historical records may be limited, making it important to secure complete files before the transition.
Who should own day-to-day retirement plan administration?
Plan administration should sit with a designated person who understands the plan document, has sufficient time to manage the work, and is supported by a trained backup. Audits can become especially challenging when responsibility falls to inexperienced or overextended team members with limited oversight.
One of the core fiduciary responsibilities is operating the plan in accordance with its governing document, which requires knowledgeable internal ownership. Outside providers can offer valuable support, but your organization must understand the plan’s terms and oversee how they are applied.
In practice, employees in Human Resources, Payroll, and other areas involved in day-to-day administration tasks should understand the plan’s provisions relevant to their work. Internal systems must also be configured to reflect those terms. Eligibility rules, compensation definitions, automatic enrollment timing, and matching formulas are often built into payroll and HRIS settings; when those settings do not align with the plan document, errors for can continue until the discrepancy is identified.
This matters most during employee turnover, when gaps in knowledge can quickly lead to operational mistakes. Written procedures, a well-maintained annual plan calendar, and cross-training can help preserve critical knowledge and keep routine responsibilities on track.
Leadership also plays an important role in reinforcing accountability and consistency. When plan responsibilities are treated as a priority rather than an afterthought, teams are more likely to give administration the attention and oversight it requires.
What should you do when a plan error is discovered?
The first thing to do is act quickly. Operational errors are more common than many plan sponsors realize, and correction often becomes more costly and complex the longer an issue remains unresolved.
Common errors include:
- Failing to enroll an eligible employee on time
- Missing or incorrectly implementing a participant’s deferral election
- Remitting participant contributions or loan repayments late
- Applying the wrong definition of compensation
- Calculating a distribution incorrectly
The good news is that published correction programs and resources exist for most of these issues. The Internal Revenue Service (IRS) Employee Plans Compliance Resolution System (EPCRS) addresses qualification and operational failures, and the DOL Voluntary Fiduciary Correction Program (VFCP) covers fiduciary breaches such as delinquent participant contributions.
Timing can significantly affect the correction required. For example, a missed deferral opportunity may require a qualified nonelective contribution (QNEC) equal to 50% of the missed amount, though reduced or zero-contribution correction methods may be available in certain circumstances when the failure is corrected promptly, and applicable notice requirements are met.
The DOL’s amended VFCP also includes a self-correction component for delinquent participant contributions and loan repayments that meet the program’s conditions, offering a more streamlined alternative to a full application.
Regardless of the correction path, it’s important to document the process. Generate and retain a short memo identifying the error, the participants affected, the correction taken, the date it was completed, and any control changes implemented to prevent recurrence. This creates a clear audit trail and supports the documented procedures required for certain self-correction options.
Final thoughts: retirement plan oversight is a practice, not a project
A well-run retirement plan depends on proactive oversight, clear accountability, and support from experienced advisors. By staying engaged, monitoring service providers, and addressing issues promptly, fiduciaries help reduce risk and keep the plan operating in the best interests of participants.
But there are a few important tasks to complete before the plan year closes: schedule a committee meeting and document detailed minutes, request and review your service providers’ most recent SOC reports and list every open action item from the last audit with an owner and target completion date for each.
Taking these steps can strengthen compliance, reinforce accountability, and build confidence in a benefit plan that supports participants’ long-term financial well-being.
