Recordkeepers / Guideline

Guideline and your plan audit

Guideline publishes 3 of the ten things an auditor needs to know. The rest are below as questions to put to them, with why each one matters.

Also known as now part of Gusto Retirement. Nothing here is inferred. A row either quotes Guideline’s own material or says that it does not exist.

Source read: 2026-09-11

Maintained by the audit team at Ledgerline. Vendor neutral by policy: we never rank or recommend ourselves here, including on this page.

What we know, and what to ask

3 confirmed, 7 open · reviewed September 2026
Certification
Arrives automaticallyNot published by Guideline. Ask them:Ask whether the certification comes with the annual package or has to be requested, and what it costs if it is priced separately. A certification you assumed was included, discovered in June, moves the whole engagement.Why this matters
Certifying entityNot published by Guideline. Ask them:Ask which regulated institution actually signs the certification. It is frequently a trust company behind the recordkeeper rather than the recordkeeper itself, and only a bank, similar institution or insurance carrier subject to state or federal examination may do it at all.Why this matters
What it coversNot published by Guideline. Ask them:Ask which assets the certification covers and, more importantly, which it does not. A self-directed brokerage window or a legacy annuity sitting outside it has to be audited in full, which is how an engagement quoted as limited scope becomes a much larger one.Why this matters
SOC 1 report
How to requestNot published by Guideline. Ask them:Ask who releases the SOC 1 report, whether an access or non-disclosure agreement is needed, and how long it takes. The person who can send it is rarely the person you normally speak to.Why this matters
Coverage periodNot published by Guideline. Ask them:Ask what period the current report covers, and confirm it is a Type 2. A Type 1 describes controls at a point in time and gives an auditor nothing to rely on.Why this matters
Bridge letterNot published by Guideline. Ask them:Ask whether a bridge letter is issued for the gap between the report period ending and your plan year ending, and how to request one. Report windows almost never match a plan year.Why this matters
Auditor access
Granting accessThe sponsor completes the audit task on the Guideline dashboard. Guideline's team then grants the auditor access to the portal to retrieve the audit package, so the auditor cannot collect it until that task is done.Published by Guideline · read 2026-09-11
Document transferNot published by Guideline. Ask them:Ask what secure channel to use for census and payroll files. These carry names, dates of birth and often full Social Security numbers for your whole workforce, and a plan year of registers in an inbox is a breach waiting to be reported.Why this matters
Engagement timing
Package release windowAudit packages are typically available to auditors between March 31 and April 30.Published by Guideline · read 2026-09-11
Audit firms namedGuideline lists three firms other clients have used: Pension Assurance, HCVT and Frank Rimerman + Co. It disclaims any representation about them, and Ledgerline is not on the list.Published by Guideline · read 2026-09-11

If you work at Guideline

7 of the ten rows on this page are blank because we could not find the answer published anywhere. If you can confirm them, they go in, and we send the draft before it publishes.

corrections@401kaudithelp.com

The same question across every recordkeeper

This page is one recordkeeper across every topic. The reference tables are one topic across every recordkeeper, which is the more useful cut when you are the auditor rather than the sponsor.

Certification directoryWho certifies, what it covers, and when the package is released.SOC 1 request pathsWhere to ask, what period it covers, and whether a bridge letter is issued.Granting auditor accessRead access without an administrator login, and how files should move.What an auditor asks forThe seventeen recurring requests, and which of four organisations holds each.