If you’ve ever heard:
“You have a limited‑scope audit this year, so it should be easy for HR.”
and felt a wave of relief, you’re not alone. The phrase sounds like the auditor is doing less work, so your team will have less to do too.
Then the audit request list arrives: payroll files, census data, eligibility support, distribution files, plan documents, reconciliations… and it doesn’t feel “limited” at all.
The truth is simple: what used to be called a “limited‑scope” audit (now more formally an ERISA Section 103(a)(3)(C) audit) does not mean less work for HR or payroll. It only changes how the auditor tests certain investment information. The parts of the 401(k) plan audit that live in HR and payroll stay very much in scope.
Let’s break that down in plain English and talk about what you can do to prepare.
What 103(a)(3)(C) Really Means
ERISA Section 103(a)(3)(C) is the rule behind what many people still call a “limited‑scope audit.”
In human terms, it says:
Your plan’s investments are held by a qualified institution (like a bank, trust company, insurance company, or registered broker‑dealer).
That institution provides a proper certification that the investment information is complete and accurate.
Because of that certification, the auditor is allowed to rely on it and skip certain audit procedures over that certified investment information.
That’s it. The “limited” part is very narrow:
It is only about how the auditor tests investment balances and activity that have been properly certified.
It is not a statement that the rest of the plan will be reviewed lightly or skipped.
So when you see “ERISA Section 103(a)(3)(C) audit” in your engagement letter or audit report, read it as a technical description of how investments are tested, not as a signal that HR or payroll will barely be involved.
For HR and finance leaders trying to understand 401(k) audit requirements, this distinction matters. The label affects how investment testing is performed, not whether your internal processes are tested.
What Changes in a 103(a)(3)(C) Audit
There are real changes on the auditor’s side when a 103(a)(3)(C) election is made:
The auditor does less re‑testing of investment values and activity that are covered by a proper certification.
They may perform fewer direct confirmations or detailed procedures with custodians over those certified investments.
The audit report itself is issued as a 103(a)(3)(C) opinion, with clear language about which information is based on the institution’s certification.
These are scoping decisions about how the auditor gains comfort over investment information.
What they are not:
A reduction in plan management’s responsibilities.
A pass on operational testing.
A promise that HR and payroll will have very little to do.
Plan management is still fully responsible for the plan’s financial statements, disclosures, and compliance. The auditor still needs to test the areas where most real‑world errors start: eligibility, contributions, distributions, and the data that flows through your HR and payroll systems. Any reputable 401(k) audit services provider will tell you that this operational testing is at the core of an ERISA audit.
What It Does Not Change
A 103(a)(3)(C) audit does not change management’s responsibilities:
You are still responsible for the fair presentation of the plan’s financial statements.
You are still responsible for complying with the plan document and ERISA.
You are still responsible for maintaining current plan documents and amendments and making sure operations follow them.
You are still responsible for determining that the bank or insurance company’s certification is appropriate to rely on.
And it does not remove the auditor’s focus from HR and payroll‑driven areas. The auditor will still perform work over:
Participant data and eligibility
Who is in the plan and when they entered.
Whether eligibility and entry dates match the rules in the plan document.
How part‑time, seasonal, and rehired employees are handled.
Whether automatic enrollment and automatic escalation (if applicable) are applied correctly.
Contributions and loan repayments
Whether employee deferral elections agree to what payroll withheld.
Whether employer match and other employer contributions are calculated correctly.
Whether employee contributions and loan repayments are remitted to the plan as soon as reasonably possible after payroll.
Benefit payments and distributions
Support for distributions, rollovers, and hardship withdrawals.
Whether payments are calculated correctly.
Whether required minimum distributions are identified and processed on time.
Data flow across HRIS, payroll, and the recordkeeper
Consistency of census data between HR, payroll, and the recordkeeper.
How changes in status, pay, or elections are communicated and applied.
Reconciliations between payroll totals and what the recordkeeper shows.
Whether plan operations match plan documents
Is the plan’s definition of compensation how you treat pay codes in payroll?
Are match formulas, vesting schedules, and loan provisions operated as written?
Are plan amendments reflected in your day‑to‑day processes?
From HR’s perspective, this is the key point:
Your involvement and responsibilities look very similar under a 103(a)(3)(C) audit and a full‑scope audit.
The label on the audit changes how investment testing is performed—not whether HR and payroll are under the microscope.
Why HR and Payroll Should Care
If your team assumes “limited‑scope = low involvement,” a few things tend to happen:
Data doesn’t get cleaned up before it goes to the auditor. Termination dates, status codes, and other details are left “as is.”
Documents are scattered—plan amendments live in email, the SPD is on a shared drive, and no one is quite sure which version is current.
There’s no quick pre‑audit check of contribution timing, eligibility practices, or major changes during the year.
The result:
The audit takes longer and feels more disruptive.
There’s more back‑and‑forth as the auditor uncovers issues that could have been addressed upfront.
You face findings and correction work that might have been reduced with a few simple checks.
Misreading “limited‑scope” as “easy” often creates more work and more stress, not less.
The smoother audits I see are usually not the ones with a particular audit type. They’re the ones where HR and payroll assumed they would be involved and took a few practical steps to get ahead of the questions and meet their 401(k) audit requirements with confidence.
What HR Can Do to Prepare—Regardless of Audit Type
You don’t need a massive project plan to prepare. A few targeted actions can make a big difference, whether your ERISA audit is 103(a)(3)(C) or full‑scope.
1. Organize plan documents and amendments
Create a single folder, on your network or in a secure shared drive, that includes:
The current plan document.
All amendments and restatements.
The Summary Plan Description and any updates.
Adoption agreements, if you use a pre‑approved plan.
This gives you and your auditor one clear place to confirm what the plan says.
2. Clean up participant and census data
Before you send data to your auditor:
Confirm hire dates, rehire dates, and termination dates are accurate.
Make sure dates of birth and status codes (active, terminated, on leave) are complete.
Reconcile total plan compensation and contributions between payroll and the recordkeeper.
Clean data at the start reduces follow‑up questions and helps surface any issues early.
3. Test contribution and loan repayment timing
Pick a handful of pay periods from the year and compare:
Payroll dates.
Dates employee deferrals and loan repayments left your bank account.
Dates those amounts posted at the recordkeeper.
If you see consistent delays, work with payroll, treasury, and your recordkeeper to tighten the timeline. This protects employees and reduces the risk of late‑deposit findings.
4. Map compensation and pay codes to the plan definition
Sit down with payroll (and, if needed, your recordkeeper) and:
List your major pay codes: base wage, bonus, overtime, commissions, shift differential, and so on.
Mark each as included or excluded under the plan’s definition of compensation.
Confirm your systems are using that map.
This one step helps prevent some of the most common and costly plan errors.
5. Coordinate with vendors and run a “What changed?” review
Before the audit starts, ask:
Did we change recordkeepers, payroll systems, or HRIS during the year?
Did we adopt any plan amendments that affected eligibility, match formulas, or loans?
Did we adjust internal processes around onboarding, terminations, or contributions?
Make a short list of these changes and share it with your auditor. It sets clear expectations and helps focus their work where changes happened.
Whether your 401(k) plan audit is labeled 103(a)(3)(C) or not, these practices are what make it go smoothly.
Treat the Audit as a Way to Reduce Surprises
It’s understandable to hope that “limited‑scope” means less work for HR and payroll. The reality is that your role stays central because the most important questions—who’s eligible, how much they contribute, when money hits the plan—are all answered from your data and processes.
The upside is that when you treat the audit as a chance to tidy those areas, you:
Reduce surprises for leadership and employees.
Catch issues while they’re still small and fixable.
Build confidence that your plan can stand up to outside scrutiny.
If you’re unsure which audit type your plan has or what it really means for HR, a short conversation with a specialist employee benefit plan auditor, like myself, can clarify expectations and help you get ahead of potential issues. That way, when audit season arrives, it feels like a structured check‑up—not an unexpected fire drill.
How to Stay Compliant: Employee Benefit Plan Audit Requirements for 2026
In Southern California, a well-executed employee benefit plan audit has become essential insurance for your company’s future. 2026 brings new rules that every thoughtful business leader should have on their radar. New DOL and IRS rules, stricter audit thresholds, and increased enforcement have made audit compliance a must-have for the health of your plan and your business's reputation. Ready my recent blog about How to Stay Compliant: Employee Benefit Plan Audit Requirements for 2026.