Print Print

EBP Compliance: Preventing Audit Deficiencies


By Theresa McDowell

Administrators of employee benefit plans (EBPs) have a responsibility to maintain the integrity of plan funds for the benefit of both the companies they represent and employee participants. EBP audits are designed to catch problems that administrators might not be aware of, yet audits themselves can lead to penalties, disqualifications, or impacts on participants’ tax returns if they don’t adequately identify issues that should be addressed. Unfortunately, such lapses occur so often that the Department of Labor (DOL) Employee Benefits Security Administration (EBSA) periodically studies and issues a report of its findings on this matter. 

Audit Deficiencies Identified
Thirty-three major deficiencies were identified in the report. The top five are listed, in order of most to fewest deficiencies found, below:

1. No or inadequate internal control environment.
2. No evidence of SOC 1 report/reliance.
3. Failure to assess or document control risk.
4. No or inadequate evidence of fraud brainstorming.
5. Lack of documentation or risk assessment procedures.

In the most recent version of the report, issued in May 2015, EBSA notes that 39% of the audits examined in the study contained “major” deficiencies (see sidebar). Significantly, the report reveals that providers completing the fewest number of audits—that is, fewer than 100 per year—reflected an even higher (76%) deficiency rate. Conversely, providers that performed the most plan audits reflected a much lower (12%) rate.

Additional Findings

The report points out that smaller CPA firms, i.e. those that performed the fewest number of EBP audits, tended not to be members of the American Institute of Certified Public Accountants’ (AICPA) Employee Benefit Plan Audit Quality Center (EBPAQC). Study results showed that these nonmembers performed audits with major deficiencies at a rate of 82%, while just 30% of members studied did so.

EBSA further reports that as the level of EBP-specific continuing professional education (CPE) increased, the percentage of deficient audits decreased. In firms where partners engaged in EBP audits received 0 hours of such training, the audit deficiency rate was 88%, whereas in firms where partners engaged in EBP audits received 24 or more hours of training, the rate was just 27%.

Finally, the report notes that peer review and practice monitoring efforts haven’t been effective in improving audit quality, stating that an “alarming” number of audits passed peer reviews, yet included both minor and major deficiencies. This finding was especially true in firms that performed fewer than 100 audits per year.

EBSA Recommendations

In its report, EBSA makes several recommendations for reducing the frequency of major deficiencies in EBP audits. These recommendations fall under the categories of Enforcement, Regulatory/Legislative, and Outreach. They include focusing on smaller CPA firms, especially those that deal with large amounts of plan assets; changing the peer review process; and creating a separate designation for EBP auditors.

These changes, as well as the others mentioned in the study, would go a long way toward resolving the audit deficiency issue. However, EBSA currently has limited enforcement ability, and changes may be slow in coming. In the meantime, the entity is engaged in outreach, education, and communication with the AICPA, state boards, and Capitol Hill, in an effort to establish more robust oversight.

Considerations for Choosing an EBP Auditing Firm

Plan administrators have a better chance of avoiding major auditing errors when they take steps to find the best EBP auditing professionals. Below are some questions plan administrators can ask to identify competent auditors.

How many benefit plan audits does the firm handle?It should be a significant number, but not so many that auditors don’t have time for careful work on each one.
Does the firm have experience working with different third-party administrators (TPAs) and other service providers?Auditors should be knowledgeable about the various software platforms these providers use.
Do auditors work onsite with plan administrators?Working onsite is critical for understanding the internal controls of each company.
How extensively is the firm involved with management?The auditor should be familiar with changes and amendments to the plan, attend quarterly meetings, and be available to assist when needed.
Does the auditor attend EBP plan trainings?While these trainings are meant for plan administrators, they’re also open to auditors, and can provide valuable information.
Is the firm a member of the AICPA EBPAQC?Members tend to produce audits that have fewer deficiencies.
Does the auditor have EBP-specific training?EBP-specific training contributes to high audit quality.


The most recent EBSA study on employee benefit plan audits reveals that firms whose EBP audits have the highest number of deficiencies are those that perform the fewest number of audits. These firms often are smaller, aren’t members of the AICPA EBPAQC, and don’t provide EBP-specific CPE. While plan administrators may be able to find firms of this description that produce clean audits, it is more likely that higher quality work will be found with larger firms that perform more than 100 audits per year. With severe consequences at stake, plan administrators should carefully research the capabilities of any audit firm they want to hire.

EKS&H has more than 150 professional working on over 250 EBP plans per year. We also have experience with more than 50 third-party administrators. Our expertise is supported by memberships in the AICPA EBPAQC and the Western Pension Benefits Council, as well as a close working relationship with the DOL. To learn more about how we can provide high-quality EBP audits for your company, please contact Theresa McDowell at 303-740-9400 or