The ERISA 103(a)(3)(C) audit, explained

What does the law actually say?

The statute lets the auditor’s opinion leave out statements prepared by “a bank or similar institution or insurance carrier regulated and supervised and subject to periodic examination by a State or Federal agency”, if those statements are certified by the institution as accurate and made part of the annual report.^[1]

The DOL’s regulation puts it into practice: the accountant’s examination and report need not extend to information certified by such an institution, for assets the institution holds, provided the certification follows 29 CFR 2520.103-5.^[2]

Who can certify, and what must it say?

• Who: a bank, similar institution or insurance carrier that is regulated, supervised and periodically examined by a state or federal agency.^[2] The Form 5500 instructions add that “similar institution” does not extend to securities brokerage firms (DOL Advisory Opinion 93-21A), which matters for self-directed brokerage windows.^[4]
• What: the institution must certify the accuracy and completeness of the information, in a written declaration signed by a person authorized to represent it.^[3] The regulation’s model wording: “The XYZ Bank (Insurance Carrier) hereby certifies that the foregoing statement furnished pursuant to 29 CFR 2520.103-5(c) is complete and accurate.”^[3]
• Which institution, in practice: often a trust company behind the recordkeeper rather than the recordkeeper itself. The certification directory records who certifies for each recordkeeper and what the certification covers.

What changed under SAS 136?

SAS 136 (AU-C 703) applies to audits of ERISA plan financial statements for periods ending on or after December 15, 2021.^[5] It changed four things:

1. The name. “Limited scope” became the ERISA section 103(a)(3)(C) audit, and it is no longer treated as a scope limitation.^[5]
2. The opinion. The old disclaimer of opinion gave way to a two-part opinion: whether the amounts and disclosures not covered by the certification are presented fairly, and whether the certified investment information agrees to, or is derived from, the certification.^[5]
3. Management’s responsibilities. Before accepting the engagement, the auditor must obtain management’s acknowledgment that it is responsible for deciding whether the audit is permissible, whether the institution is qualified under 29 CFR 2520.103-8, whether the certification meets 29 CFR 2520.103-5, and whether the certified information is properly measured, presented and disclosed. The auditor must ask how management decided the institution qualifies.^[5]
4. The auditor’s work on certified information. The audit does not extend to it, except that the auditor obtains and reads the certification, compares the certified information with what the financial statements present, and reads the related disclosures.^[5]

On the Form 5500, the plan reports the election on Schedule H, Part III, line 3b, by checking “DOL Regulation 2520.103-8”.^[4]

What does it not limit?

Only the certified investment information is carved out. Contributions, distributions, loans, participant data, plan provisions and any assets the certification does not cover are audited as they would be in any audit.^[2][5] A certification that covers some investments and not others leaves the rest to be tested in full.

How common is it, and does it cost less?

It is the usual choice: the DOL found that 83% of plan audits were limited-scope in the 2020 filing year.^[6] Whether it costs less depends mostly on plan size. The 401(k) audit fee index compares what plans paid under each scope, from their own Form 5500 filings.