Recordkeepers / Vestwell

Vestwell and your plan audit

Vestwell publishes 3 of the ten things an auditor needs to know. The rest are below as questions to put to them, with why each one matters.

Nothing here is inferred. A row either quotes Vestwell’s own material or says that it does not exist.

Source read: 2026-09-11

Maintained by the audit team at Ledgerline. Vendor neutral by policy: we never rank or recommend ourselves here, including on this page.

What we know, and what to ask

3 confirmed, 7 open · reviewed September 2026
Certification
Arrives automaticallyRequested rather than automatic. Vestwell Trust Company can prepare a certified annual trust statement for the auditor, which the auditor needs in order to issue its report.Published by Vestwell · read 2026-09-11
Certifying entityVestwell Trust Company, a Vestwell subsidiary, rather than Vestwell itself.Published by Vestwell · read 2026-09-11
What it coversNot published by Vestwell. Ask them:Ask which assets the certification covers and, more importantly, which it does not. A self-directed brokerage window or a legacy annuity sitting outside it has to be audited in full, which is how an engagement quoted as limited scope becomes a much larger one.Why this matters
SOC 1 report
How to requestNot published by Vestwell. Ask them:Ask who releases the SOC 1 report, whether an access or non-disclosure agreement is needed, and how long it takes. The person who can send it is rarely the person you normally speak to.Why this matters
Coverage periodNot published by Vestwell. Ask them:Ask what period the current report covers, and confirm it is a Type 2. A Type 1 describes controls at a point in time and gives an auditor nothing to rely on.Why this matters
Bridge letterNot published by Vestwell. Ask them:Ask whether a bridge letter is issued for the gap between the report period ending and your plan year ending, and how to request one. Report windows almost never match a plan year.Why this matters
Auditor access
Granting accessNot published by Vestwell. Ask them:Ask for the read-only auditor or third party role and the steps to grant it. Do not settle for sharing your own administrator login, which hands the auditor transactional authority nobody intended.Why this matters
Document transferNot published by Vestwell. Ask them:Ask what secure channel to use for census and payroll files. These carry names, dates of birth and often full Social Security numbers for your whole workforce, and a plan year of registers in an inbox is a breach waiting to be reported.Why this matters
Engagement timing
Package release windowNo release window is published. A $500 late fee applies if Vestwell is not provided with a completed auditor's report by October 10, so the deadline runs the other way from most: it is about returning the finished report to them.Published by Vestwell · read 2026-09-11
Audit firms namedNot published by Vestwell. Ask them:Ask whether they keep a list of firms their clients have used. Most will not recommend one, but many will say who turns up, which is a useful signal when you have no other.Why this matters

If you work at Vestwell

7 of the ten rows on this page are blank because we could not find the answer published anywhere. If you can confirm them, they go in, and we send the draft before it publishes.

corrections@401kaudithelp.com

The same question across every recordkeeper

This page is one recordkeeper across every topic. The reference tables are one topic across every recordkeeper, which is the more useful cut when you are the auditor rather than the sponsor.

Certification directoryWho certifies, what it covers, and when the package is released.SOC 1 request pathsWhere to ask, what period it covers, and whether a bridge letter is issued.Granting auditor accessRead access without an administrator login, and how files should move.What an auditor asks forThe seventeen recurring requests, and which of four organisations holds each.