Auditing , Employee Benefits , Requirements
Organizations With Employee Benefit Plans Have New Requirements
Back in 2019, the American Institute of Certified Accountants (AICPA) rolled out a new audit standard for employee benefit plans (EPBs). Known as Statement on Auditing Standards (SAS) 136, the standard was originally scheduled to be implemented for periods ending on or after December 15, 2020. But, due to the pandemic, implementation was delayed until periods ending on or after December 15, 2021.
Why were these new standards created?
EBPs for organizations with 100 or more participants at the beginning of the plan year are required to have an audit of their financial statements completed by an independent qualified public accountant as outlined by the Employee Retirement Income Security Act (ERISA). ERISA Section 103(a)(3)(C) allows organizations to have limited scope audits where the auditor does not audit investment information certified by a qualified entity like an insurance company, bank, or other financial institution. For these limited scope audits, an auditor is allowed to issue an opinion disclaimer.
When the U.S. Department of Labor (DOL) conducted a study on the quality of EBP audits, results of the study showed major deficiencies in the audits, and SAS 136 was issued in response. The new audit standards pertain to all phases of audits, including engagement acceptance and reporting.
How can an organization fulfill the new plan requirements?
Organizations can continue to exclude certified investment information.
But instead of an auditor issuing a disclaimer of opinion, their opinions will consist of two parts:
- An opinion on the fair presentation of information in the financial statement not covered by the certification.
- An opinion on whether the investment information in the financial statements reconciles with information in the certification.
The organization must provide the auditor with a written statement that the audit is permissible, and that the certification satisfies the ERISA requirements. SAS 136 requires the organization to provide written representations regarding its responsibilities at the end of an audit. These responsibilities include keeping a copy of the EBP, including amendments, demonstrating that plan transactions are consistent with the plan and maintaining records on plan participants to determine benefits due.
SAS 136 also requires organizations to provide auditors with a completed Form 5500. If the auditor notes discrepancies between the financial statement and Form 5500, they will need to advise if the financial statement or Form 550 be corrected.
For this new process to move efficiently and correctly, it is important to hire a first-class plan auditor. Contact Whitlock today and ask for our EBP team to discuss your organization’s needs.
View Similar Blogs
Other blogs about cybersecurity and your business
IT Audit vs. Cybersecurity Assessment: What’s the Difference?
If you’ve been told you need an IT audit, you might have also heard the term cybersecurity assessment in the same conversation. They sound similar. They’re often confused. But they’re not the same...
Mid-Year Tax Planning: Why July Matters More Than January
For most business owners, tax planning is something that happens in the spring. You gather your documents, you meet with your accountant, and you deal with whatever the year produced. It feels like...
Third-Party Risk Management for Community Banks: A Practical Checklist
Every community bank uses outside vendors. Core banking. Payments. Cybersecurity. Loan platforms. The list adds up fast. Regulators know this. And they expect you to have a process for managing the...