Updated October 29, 2024
Every Independent Qualified Public Accountant (IQPA)’s retirement plan audit is different. There are countless iterations of service providers, plan formulas, payroll companies, investment philosophies, and internal control setups that must be considered when designing an audit plan. There are many audit considerations that are specific 403(b) plans that plan auditors must keep in mind when completing their audit steps. In this blog, we will go through the main differences between a 401(k) audit and a 403(b) audit, starting with what types of employers can have a 403(b) plan, followed by other IQPA audit considerations.
Entity Type
Only Section 501(c)(3) organizations or public education institutions as defined in IRC Sec. 170(b)(1)(A)(ii) may establish a 403(b) plan. The IRS provides an online tool that auditors can use to obtain information about tax-exempt organizations called the “Tax Exempt Organization Search” (TEOS) tool. The TEOS tool can be used to check information about an exempt organization’s federal tax status and filings. In addition, auditors may verify an organization’s tax-exempt status and eligibility to receive tax-deductible charitable contributions by requesting to see an organization’s IRS letter recognizing it as tax-exempt or by directly calling the IRS at 877.829-5500.
Obtain, Read, and Summarize an Executed Plan Document
The auditor must obtain a copy of the written 403(b) plan that satisfies, both in form and operation, the requirements of the final Section 403(b) regulations. A list of pre-approved prototype and volume submitter plans has been published. Plan sponsors can retain document providers of pre-approved, volume submitter, and prototype documents who restate the documents timely in accordance with the IRS restatement cycles.
For 403(b) Individually Designed Plans, under Rev. Proc. 2022-40, plan sponsors have been permitted to submit a determination letter application since June 1, 2023. The auditor will request formal amendments to comply with the latest applicable laws and regulations or Board resolutions or other authorization for upcoming changes.
The IRS annually publishes a Required Amendments List (RA List). The RA list is an annual list of changes in retirement plan qualification requirements. Additionally, it establishes the amendment deadlines for individually designed plans. The management representation letter includes a statement regarding the intent to amend the plans as required. For example, plans that adopted provisions of SECURE, CARES, and/or SECURE 2.0 have until the last day of the first plan year beginning on or after January 1, 2025 to formally amend the plan.
Once the auditor obtains, reads, and summarizes the plan document, adoption agreement, summary plan description, plan amendments, and representations regarding upcoming amendments, the 403(b) plan audit can begin.
403(b) Specific Audit Steps
ELIGIBILITY TESTING: UNIVERSAL AVAILABILTY, ONCE-IN-ALWAYS-IN (OIAI), LONG-TERM, PART-TIME (LTPT) EMPLOYEES
The auditor will verify compliance with universal availability for elective deferrals in accordance with IRC Sec. 403(b)(12)(A)(ii). Generally, the universal availability requirement is met if all employees of the plan sponsor are allowed to make 403(b) elective deferral contributions. If any employee defers, all employees must be allowed to defer. All for one, and one for all….with a few permitted exclusions.
IRS Reg. 1.403(b)-5(b) includes numerous rules and exclusions related to the universal availability requirement. Some of the permitted exclusions will have a limited lifespan of two years once the Long-term, Part-time (LTPT) rules become effective for 403(b) plans on January 1, 2025. In the meantime, the auditor will verify that the Once-In, Always-In Rule is followed when previously excluded participants become eligible to enter the plan. See our blog titled Are Your Part Time Employees “In or Out” OR “In and Out?” which explains that the OIAI exclusion states that if a Section 403(b) plan excludes part-time employees from making elective deferrals, once an employee becomes eligible to make elective deferrals, the employee cannot be excluded in the future, even if the hours drop to meet the exclusion criteria again.
SECURE 2.0 requires that employees who work between 500 and 999 hours for two consecutive years be permitted to contribute elective deferrals to their 403(b) plans effective plan years beginning in 2025. For plans that have permitted exclusions, the auditor will need to see census data for 2023 and 2024 to identify LTPT employees who must begin participation in 2025. Recent guidance clarified that the student-worker exclusion is still available to 403(b) plans. The LTPT rules do not apply to student employees, because the exclusion is based on an employment classification and not on service.
POST-SEVERANCE EMPLOYER CONTRIBUTIONS
403(b) plan sponsors have the option of making employer contributions for up to five years after the employee’s severance from employment.
In general, post severance employer contributions must be based on includible compensation for the employee’s last year of service and can be made for up to 5 years after the employee’s employment ends.
VERIFY THAT DISCRIMINATION TESTING WAS DONE FOR EMPLOYER CONTRIBUTIONS
403(b) deferrals are not subject to discrimination testing. 403(b) plans do not satisfy the nondiscrimination requirements with respect to salary reduction contributions through compliance with the actual deferral percentage, or ADP, test required of 401(k) plans. Instead, the universal availability requirement applies to salary reduction contributions in a 403(b) plan.
Nondiscrimination in Employer Contributions: Although 403(b) deferrals are not subject to the ADP test, the ACP test to ensure that match contributions are not discriminatory does apply. Failures of the ACP test can be corrected after the plan year end by timely recharacterization, distributions, or forfeiture of excess deferrals or contributions, as appropriate. Safe harbor plans are designed to avoid the ACP test.
For the mechanics of the ACP test, please refer to our blog titled The Maximum Contribution May Be Lower Than You Thought: ADP and ACP Test Basics for 401(k) and 403(b) Plans. Safe harbor plans are designed to avoid the ACP test. See our blogs titled What are the Available Safe Harbor Plan Formulas? and How to Order a Triple Stack Match for Your Plan for the available safe harbor formulas. Other employer contributions are also subject to discrimination testing if there is disparity in the allocation percentage. The mechanics of those tests are beyond the scope of this blog.
ADHERENCE TO CONTRIBUTION LIMITS
Maximum Employee Contributions: Generally, the maximum annual elective deferral to a 403(b) plan is $23,000 for 2024 and $22,500 for 2023. However, participants who have attained age 50 by year-end may also make catch-up contributions of a maximum of $7,500 for 2024 and 2023. In addition, 403(b) plans may permit employees with at least 15 years of service with the same qualified employer to contribute up to an additional $3,000 for five years for a lifetime limit of $15,000, further limited if the average elective deferrals since the date of eligibility for the relevant participant exceeds $5,000. In my opinion, 403(b) plans that disclaim the audit opinion due to potentially missing pre-2009 contracts should not offer the special catch-up, since lifetime deferral contributions are needed to compute the maximum available special-catch-up.
Please refer to our blog titled How to Compute the 15-Year Special Catch-Up for 403(b) Plans?…for the mechanics of the special 403(b) catch-up computation and the ordering rules of the two match contributions. In my opinion, 403(b) plans that disclaim the audit opinion due to potentially missing pre-2009 contracts should not offer the special catch-up, since lifetime deferral contributions are needed to compute the maximum available special-catch-up. See the Investments section below for more detail.
Maximum Annual Additions: In addition to the employees’ elective deferrals, the employer can make contributions in the form of match contributions or employer profit sharing contributions, even if the nonprofit entities that sponsor 403(b) plans do not have “profits”. The maximum annual addition to a 403(b) plan participant’s account, including all sources, such as elective deferrals, employer contributions, employee after-tax contributions, and allocated forfeitures is the lesser of $69,000 for 2024 and $66,000 for 2023 or 100% of the participant’s includible compensation. However, the catch-up contributions are allocated in addition to these limitations.
403(b) employer profit sharing contributions are often so generous that highly compensated employees are not able to defer the whole 402(g) limit out of their salaries and still stay within the IRC Section 415 limit. In those cases, the auditor must verify that the participant received some of the deferral contribution back as an excess contribution, and that the full employer contribution was allocated to the participant’s account.
Maximum Compensation: The maximum compensation amount that may be taken into account in computing maximum contributions is $345,000 for 2024 and $330,000 for 2023. This amount may be adjusted for inflation each year.
403(b) PERMITTED INVESTMENTS
SECURE 2.0 amended the Internal Revenue Code to allow 403(b) plans to hold Collective Investment Trusts (CITs) and Separate Accounts. However, 403(b) plans remain unable to maintain these investments due to limitations in existing securities law. The proposed Retirement Fairness for Charities and Educational Institutions Act of 2023, HR 3063 will remove this final roadblock if enacted. 403(b) plans with custodial accounts may soon finally be able to utilize CITs and unregistered insurance company separate accounts but for now, investments in 403(b) plans are limited to annuity contracts and mutual funds held in custodial accounts. Annuity contracts are required to be purchased from a state licensed insurance company. The auditor will make sure that the financial statements do not show disallowed investment types, such as pooled separate accounts that are not registered investments.
FINANCIAL STATEMENT PRESENTATION AND AUDIT OPINION
Historically, 403(b) contracts were administered as individual investment account arrangements rather than as a retirement plan. Before 2009, participants were able to move their contracts to a different custodian without the employer’s involvement. Employers are permitted to exclude from plan assets any fully vested pre-2009 contracts from the plan’s accounting if there are no further contributions to the contract and the participant has a right to exercise the rights and obligations of the contract without the employer’s involvement, as permitted by Field Assistance Bulletin (FAB) 2009-02. If pre-2009 annuity contracts are not included in the plan’s financial statements, that omission should be considered a GAAP departure, and the audit opinion will be disclaimed on account of the excluded assets.
ALLOCATED CONTRACTS vs. UNALLOCATED CONTRACTS
The auditor will obtain relevant information about allocated contracts as well as unallocated contracts. Even though allocated contracts are not reported in the plan’s financial statements, purchases of such contracts during the period are recorded, with an offsetting distribution. If the plan has investments in traditional annuities issued by the Teachers Insurance and Annuity Association of America and College Retirement Equities Fund (TIAA-CREF), consider whether the investments are properly reported as plan assets. According to ERISA Opinion Letter 2010-01A, the “Traditional Annuity” investment issued by TIAA-CREF is considered an unallocated insurance contract and should be reported as an investment in a plan’s financial statements.
PARTICIPANT LOANS vs. PLAN LOANS
Certain 403(b) plan custodians may offer loans directly to plan participants. Such loans, which are generally referred to as plan loans (as opposed to participant loans), are issued directly from the custodian’s funds and not through the plan from a participant’s account. The source of the funds, therefore, distinguishes plan loans from participant loans. Like participant loans, plan loans require adequate security, may be subject to restrictions, and may involve a portion of a participant’s account being set aside or held as collateral. The plan financial statements include participant loan balances but not plan loans. Plan loans should be disclosed if collateralized by participant accounts.
Expertise Matters: Selecting an Auditor
Obtaining a quality audit of a large plan’s financial statement is an important fiduciary responsibility. The DOL’s latest study found that 30% of audits had one or more major audit deficiencies, with firms performing at least 100 EBP audits having the lowest major deficiency rate. Specifically, CPA firms performing:
- Fewer than 25 audits had a major deficiency rate of 55%
- Between 25 and 99 audits had a major deficiency rate of 25%, and
- 100 audits or more had a 17% deficiency rate.
When selecting an IQPA, 403(b) plan sponsors should ensure that the auditor selected is well-versed in the rules that apply specifically to 403(b) plans. Just like any doctor won’t do when a patient needs a specialist, any auditor won’t do when you are looking for a specialty audit, like a 403(b) plan audit. With experience and specialization comes quality. When it’s time to select an IQPA, look for one that is well versed in 403(b) specific audit considerations.
