
Key insights
- Plan sponsors remain responsible for benefit plan compliance, even when payroll, recordkeeping, testing, and other administrative tasks are handled by third-party providers.
- Regular reconciliations of payroll, bank, trust, and participant records can reveal missed contributions, incorrect allocations, and other errors before they grow.
- Documented review procedures, assigned responsibilities, and timely follow-up create stronger controls and provide evidence that oversight activities are being performed.
- Cybersecurity and system access belong in provider oversight whenever outside organizations store, transfer, or process participant data and plan information.
Get guidance on plan sponsor responsibility beyond third parties.
As management, are you providing adequate oversight and maintenance of your company’s employee benefit plan? It’s a question that should be on your mind.
Gaining a deeper understanding of your duties and establishing effective policies and procedures may help you oversee plan operations successfully while complying with rules and regulations.
The cost of providing employee benefit plans
Benefit plans such as 401(k)s, 403(b)s, and employee stock ownership plans can support recruitment, retention, and employee satisfaction. The cost of offering them, however, extends beyond provider fees.
Plan sponsorship also requires staff time to administer the plan, review provider activity, maintain controls, correct errors, and meet fiduciary duties. Outsourcing may shift day-to-day tasks, but the employer still bears the cost and responsibility of monitoring how those tasks are performed.
Key responsibilities of plan sponsors
Employee benefit plans are separate legal entities with their own tax and compliance requirements. Plan assets belong to participants, which makes timely administration and accurate records essential.
Monitoring service providers
Plan sponsors often rely on third-party providers for annual filings, compliance testing, employee communications, recordkeeping, and other administrative work. Selecting capable providers is important, but it’s only one part of effective oversight.
The employer, as plan sponsor, remains responsible for the plan’s compliance with applicable rules and regulations. Providers can perform assigned tasks, but the plan sponsor must oversee, review, and reconcile their work.
The Department of Labor (DOL) places additional requirements on employee benefit plans as they grow, such as the audit requirement for certain plans with over 100 participant balances.
However, most other requirements and expectations related to the successful operation of employee benefit plans apply regardless of your plan size. Just because your plan doesn’t require an audit doesn’t mean you have less responsibility over the daily operations.
Whether or not an audit is required, plan sponsors should be ready to answer questions such as:
- How do you review fees for reasonableness and investment performance?
- How often do you reconcile payroll records to your plan’s trust reports?
- When was the last time you reviewed the specific plan provisions in your plan document to confirm you are calculating eligible compensation appropriately?
Fitting cybersecurity into provider oversight
Plan sponsors should treat cybersecurity as an ongoing oversight responsibility, particularly when recordkeepers, payroll providers, and other third parties store or transfer plan information.
| Oversight area | Questions for plan sponsors |
|---|---|
| Provider review | Does the provider follow recognized security standards and obtain an independent audit of its controls? How are identified issues addressed? |
| Data access | Who can access participant data and plan assets? Are access rights reviewed regularly and removed promptly when roles change? |
| Contracts | Do agreements address security requirements, incident notification, data use and retention, insurance coverage, and responsibility for losses? |
| Incident response | Is there a documented process for reporting, investigating, and responding to a breach or unauthorized transaction? |
| Ongoing monitoring | Does management review security reports, incidents, control changes, and corrective actions at defined intervals? |
Keep IT controls strong
Audit standards place a much more thorough emphasis on understanding the IT control environment related to benefit plan reporting and operating — from security and backup processes to automatic interfacing.
Because overreliance on third parties or technology can create control deficiencies, management should understand how plan data moves between systems and periodically review controls surrounding security, backup processes, data transfers, and system changes.
How can plan sponsors prevent common benefit plan errors?
Regular review processes can help plan sponsors catch administrative errors promptly, even when payroll and recordkeeping activities are automated. Employee deferral remittances are one area where routine checks matter.
Review automated employee contribution remittances
Plan sponsors must prioritize compliance and protection
- Monitor service providers and review their work
- Reconcile plan records and investigate differences
- Maintain documented controls and corrective-action procedures
- Protect participant assets and data
- Correct errors promptly and complete required disclosures
As required by the DOL, remittances must be made as soon as administratively feasible after the pay date. You may currently have a setup where your payroll provider communicates directly with the plan’s recordkeeper and an automatic electronic fund transfer is taken.
So, until you’re reconciling your bank accounts at month-end, you may not know for what amount or when the remittance was made.
For automated transfers between a payroll provider and recordkeeper:
- Would you ever look at plan trust reporting to verify the amount from your bank account matched the amount received into participants’ accounts?
- What about that retro-adjustment you made a couple days after the paycheck date or the out-of-cycle payroll you ran for bonuses the week prior? Would those have been captured already?
Check manual payroll files before submission
Manual processes also need review. Before downloading a payroll report, uploading it to the recordkeeper portal, and initiating a cash transfer, ask:
- Have all employees been appropriately included on the report you uploaded?
- Did you upload the right payroll date or accidentally the prior payroll date?
- Are there employees coded as a different division who were accidentally excluded from the report?
- Did you copy and paste from one report into a different template and leave off a few lines or did data shift into the incorrect columns?
Set a reconciliation schedule
Even with automated payroll and recordkeeper systems, you must review the process promptly. DOL guidelines advise a review based on payroll dates, along with performing monthly, quarterly, or annual reconciliations to catch irregularities like retro-adjustments or out-of-cycle payroll runs.
While this may seem like a lot of work, preventative checks and reviews can help identify plan errors, missed contributions, and potential noncompliance. Earlier.
Document controls for prevention and correction
A documented policy or procedure can help prevent payroll and contribution errors. A review process should also identify mistakes quickly, assign corrective action, and retain evidence the review occurred.
These controls can help plan sponsors address DOL requirements and their responsibility to participants.
- Reconcile the total upload file to company-wide payroll records before submitting the file for funding
- Compare the bank withdrawal with recordkeeper records promptly after the transaction
- Investigate differences, retroactive adjustments, and out-of-cycle payrolls before the next scheduled review
What happens when benefit plan payroll errors go uncorrected?
Example: A contribution is credited to the wrong participant
A simple error such as accidentally uploading the wrong payroll-date information can drastically affect a plan’s successful operation. While the total amount may not have been significant enough to raise concerns during your month-end bank reconciliation, compliance requires a much deeper dive.
Say an employee who terminated last month is now receiving someone else’s funds into their 401(k) account, and a new employee who contributed $150 this paycheck never received their money.
If the error is found and corrected timely enough, it may just be a matter of re-allocating the funds to the correct participant accounts.
However, if delayed, the terminated employee may have withdrawn all funds. Now the plan sponsor is left with the debt and the obligation to make certain the new employee not only receives the missing $150 contribution but also appropriate consideration for lost earnings in the marketplace.
Correction may require funding and disclosure
The error here is called a delinquent participant contribution and, when it occurs, requires correction and special disclosure on the plan’s Form 5500 tax form.
This requirement stems from the degree and level of importance the DOL and the Employee Retirement Income Security Act of 1974 (ERISA) place on protecting participant assets.
How CLA can help with benefit plan administration
Establishing strong policies and actively engaging in plan management support responsible administration of employee assets and benefit plan operations.
CLA’s benefit plan team offers insights to help management improve oversight practices, strengthen control procedures, address operational questions, and fulfill plan sponsor responsibilities.
Contact us
Get guidance on plan sponsor responsibility beyond third parties. Complete the form below to connect with CLA.