1. EBPAQC 401(k) Basics, Part 2 Participant Data & Contribution Testing

2. Handouts for Today’s Event
You can download presentation slides (in PDF or PowerPoint format) and other handouts by clicking on in the toolbar at the bottom of your screen
Instructions to how obtain your CPE Certificate for today’s event
Webinar presentation slides (both .ppt and .pdf formats)
Summary of EBPAQC Resources and Tools
EBPAQC Common EBP Audit Deficiencies & Planning Tool
EBPAQC Parties in Interest and Prohibited Transactions Primer
Documentation of a Use of a Type 2 Service Auditor’s Report in an Audit of an EBP’s Financial Statements
Summary of Key Plan Document Provisions Relevant to a Defined Contribution Retirement Plan Audit

3. Presenters Marilee Lau Jennifer Allen Moderator Crowe Horwath LLP
Mark Blackburn
LBMC PC .
Jennifer Allen
Crowe Horwath LLP
Travis Jack
Metz & Associates PLLC

4. Introduction
Marilee Lau
Moderator

5. Today’s Forum Plan document, SSAE 16, and payroll testing
Participant data testing
Contribution testing
Parties in interest and prohibited transactions

6. Topics Discussed on Part 1
ERISA rules
Types of plans
Key parties
Planning and risk assessment
Internal controls

7. Plan Document, SSAE 16 and Payroll Testing
Travis Jack Managing Member Metz & Associates PLLC

8. Plan Document Types Plan specific (rarely used by smaller plans)
Prototype
Standardized (most common)
Nonstandardized
Volume submitter (sample plan to be used by a provider sent to IRS for review)
Determination letter
Not required
Amendments
Adoption agreement
“Roadmap” to plan operation
More specific than basic plan document
Summary Plan Description (useful but not a substitute)

9. Plan Document (Cont.) Purpose/Scope (Appendix A – Chapter 5)
Eligibility to participate
Funding
Employer
Employee
Entitlement to benefits
Vesting
Timing
Plan operation and administration
Fiduciary duties
Run the plan solely to benefit participants
Must act prudently (investment diversification)

10. Plan Document (Cont.) Auditor’s Concern
Must disclose key provisions in notes
Plan document compliance dictates procedures
Contributions (limits, matching, timing)
Benefits (vesting, timing and availability)
Eligibility (satisfy minimum requirements but may go beyond)
Eligible compensation (used to calculate contributions)
Key to establishing internal control
May require discussion with legal counsel
Must not discriminate
Read and consider in planning process

11. EBPAQC Plan Document Tool
Assist members in understanding the plan entity and in designing substantive audit tests in various audit areas by summarizing key plan provisions that may be relevant to the plan audit. The tool is presented in Word format to allow auditors to cut and paste information to the audit program or other audit documentation as necessary. It may be included in the permanent file and updated each year as the plan is amended. It is not intended to replace the plan document in the audit files, but rather is a supplement that summarizes pertinent plan document information.

12. SSAE 16 and SOC 1 Reports Audit Guide – Chapter 4 and Appendix B
Internal control of plans typically consists of two levels
Plan sponsor
Applicable service organizations
Service Organizations
Typically the Trustee/Custodian
Contributions
Distributions
Investment custody, valuation, and transactions
Third Party Administrator (TPA) or a payroll service
Recordkeeper
Different Types
Type I (Design)
Type II (Design and Operation)

13. SSAE 16 and SOC 1 Reports Audit Guide – Chapter 4 and Appendix B
Effect on audit procedures
Type I-
Provide information to assess risk (i.e., design of controls)
No basis to conclude on operating effectiveness without testing
Type II-
Provide a basis to rely on effective operations of controls and therefore REDUCE the extent of testing
Read the report
Tools in Benefit Plan Audit Quality Website
Period under audit versus period tested in report
Referencing specific testing to plan attributes
Plan sponsor controls (user controls)

14. SSAE 16 and SOC 1 Reports Audit Guide – Chapter 4 and Appendix B
Report format
Management’s assertions
Have prepared accompanying description of services
Description fairly presents services provided
Types of services
Related procedures
Availability
Controls provide reasonable assurance of achieving control objectives
“Suitably designed and operating effectively”
Independent service auditor’s report
Description of controls
Tests of controls and summaries of findings

15. SOC 1 Reports
AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization
The user audit should be satisfied regarding the following:
The service auditor’s professional competence and independence from the service organization
The adequacy of the standards under which the type 1 or type 2 SOC 1 report was issued.
The user auditor should consider the following:
Document procedures performed
Understand the services the user entity was contracted for
Determine the report covers appropriate controls
Evaluate of the proper date and period
If appropriate operating effectiveness had been tested, auditor may reduce testing

16. SOC 1 Reports Considerations
May need more than one SOC 1 Report for different systems
Need to understand exactly what controls are relevant to the 401(k) plan you are auditing
Need to understand the plan sponsor’s complementary user controls and that they are effective
Service Auditor’s report contains exceptions in testing and/or a modified report
Communicating to plan management and/or plan governance internal control matters
Fraud risk factors related to service providers

17. Payroll Chapter 2 in Audit Guide
Payroll controls, IT or manual, are important
Contributions are usually a component of a participant’s payroll
Rely on payroll controls
Hiring
Termination
Proper salary or wages
Proper payroll deductions for deferrals
Bonus
Test payroll controls/refer to payroll testing in plan sponsor audit
Document that payroll was substantively tested (and ensure it was tested) in plan sponsor audit
If you do not audit plan sponsor, test payroll controls

18. EBPAQC SOC 1 Documentation Tool
The tool is intended to assist members in documenting procedures and findings related to controls at a service organization that are likely to be relevant to the employee benefit plan’s internal control over financial reporting. It focuses on the user auditor’s use of a type 2 report.

19. Participant Data and AllocationsTesting
Mark Blackburn Partner LBMC PC 19

20. Participant Data and Allocations
401(k) plans provide an individual account for each participant and provide benefits based on the following:
Amount contributed by the participant
Amount contributed by the employer
Investment income (loss)
Plan expenses
When a participant withdraws from a plan, the amount paid to the participant is the amount allocated to that participant account

21. Participant Data and Allocations
Relevant Assertions:
The accuracy of the allocation of net assets to the individual participant accounts in accordance with the plan document.
The completeness and valuation of participant accounts (including the forfeiture account) in total.
The authorization of participant transactions and the accuracy that such transactions have been executed at the proper amount, in the proper period, and in accordance with the plan document and participant’s direction.

22. Participant Data and Allocations
Examples of identified risks of what could go wrong for participant data include:
Participant investment options or salary deferral amounts may not be in accordance with their stated elections
Allocations of income or expenses may be inaccurate, causing the participant’s account to be overstated or understated
Lack of reconciliations or improperly prepared reconciliations by management could result in missing contributions or improper allocations.
Employees not appropriately included or excluded from participating based on the plan’s provisions.

23. Participant Data and Allocations
Examples of identified risks of what could go wrong for participant data include:
Employee and employer contributions are incorrect due to the use of a definition of compensation different from the plan’s provisions.
Incorrect compensation or hours is used to determine compensation.

24. Participant Data
Types of participant data that are tested vary from plan to plan and may include:
Demographic data
Date of Hire (DOH)
Date of Birth (DOB)
Date of Termination (DOT)
Hours of service
Payroll Data
Wage rate
Hours worked
Earnings
Contributions to the Plan
Definition of compensation in plan document is essential
Inclusion/exclusion of fringe benefits
“W-2” or gross wages as a starting point
Utilize work done on corporate audit
Utilize SOC 1, if available

25. Automatic Enrollment Automatic enrollment – what is it?
A Company may automatically enroll employees in the Plan at a certain date as defined in the Plan document (i.e. date of hire, 3 months of service, etc.) unless the participant elects out of the Plan.
Plans with auto enrollment features will have a stated deferral rate that they will enroll the participant at as well as a qualified default investment in which to put the contributions if the participant does not give investment direction timely.
There can also be auto escalation clauses whereby each year of service, the participant’s contributions are automatically increased by a certain percentage as defined in the Plan unless elected differently by the participant.
The participant has 90 days after the first contribution to get their money back if they did not intend to enroll and didn’t elect out timely.

26. Participant Data Potential audit steps
Compare appropriate demographic data from employer files to data maintained by the recordkeeper.
Once you determine the eligibility requirements of the Plan, scan the census data for all employees outside those requirements. Then, select a few to see that they are not in the Plan.
As a test for fraud, consider specifically looking at those in a position to influence the plan (i.e. payroll, human resources, CFO, etc.) to make sure they are not allowed to enter the Plan prior to meeting the eligibility requirements.
Agree and reconcile employee deferrals from the census data to participant detail in total and for a sample of participants.

27. Participant Data Potential audit steps
Test the summarization of payroll journal to census data and trace postings of gross pay to general ledger.
Test payroll data for one or more pay periods and for a number of participants by:
Tracing the individual payrolls from the payroll journal to earnings records
For participants paid on an hourly basis, testing payroll hours, or other supporting evidence and testing the computation of hours.
Testing rates of pay to authorizations
Testing calculations of earnings
Reviewing personnel files for hiring notice, employment data, pay rates, etc.
Determine that deferral rates are applied to defined compensation

28. Participant Data Errors found in testing Eligibility:
Employees not allowed to participate because they are “part-time”. Many part-time employees have enough hours to satisfy the hour requirement.
Small businesses – look for spouses who are participating in the Plan, but who do not work for the company.
Watch for failure to notify employees of eligibility. Does the workforce speak English and can they understand the Plan materials?
Break-in-service – Company didn’t allow participants back in the Plan upon rehire in accordance with Plan document.

29. Participant Data Errors found in testing Eligibility, cont:
Plan Sponsor outsourced informing employees of eligibility. Outsourced service provider didn’t inform anyone for a year of their eligibility. Plan Sponsor is responsible for making sure service provider performs their duties.
Compensation as defined by the plan included bonuses, but employee deferrals were calculated excluding bonuses. Plan Sponsor had to make additional contributions to make these employees whole.

30. Participant Allocations
Potential audit steps
Investment income testing will be covered in Webinar #3.
Participant allocation to individual investments – testing is typically a combination of:
Reliance on SOC 1 (refer to previous webinar).
Confirmation with participant (that they did not have any issues with their allocations).
Overall analytical review of participant accounts.
Determine whether the sum of the individual accounts reconciles with the total net assets available for benefits.
Testing mathematical accuracy of individual participant accounts and determining whether opening participant account balance matches ending balance from the prior year statement.

31. Workpaper Documentation Tips
Information to consider including for participant data and allocations testing
Plan provisions
Participant allocation report
by investment type
by money type (EE contribution, ER match, Profit-sharing, rollover, etc)
SOC1 report and related checklist
Payroll data - compensation
Participant hire date and age documentation, as applicable
Participant election forms
Confirmations

32. Changes in Plan Recordkeeper
Changes in outside recordkeepers are common but can increase risk if not managed properly
Plan sponsors have a fiduciary responsibility to ensure that the change is monitored and performed properly

33. Changes in Plan Recordkeeper Overall Risks - What Can Go Wrong
Data transferred (participant/payroll) is not accurate or complete
Changes in plan design

34. Changes in Plan Recordkeeper What Can Go Wrong for a 401(k) Plan
Potential delays in remitting employee deferrals which could be deemed a PROHIBITED TRANSACTION
Participant data transfers, forfeitures
Challenges in change in plan administration – paper to paperless
What’s new for participants
Participant notes receivable
SOC 1 vs no SOC 1
Auto enrollment or deminimus cash outs?

35. Workpaper Documentation Tips
Key information to include in audit documentation
Prior recordkeeper
Allocation report by investment type
Allocation report by money type (EE contribution, ER match, Profit-sharing, rollover, etc)
Reconciliation between allocation report and investment statement
Current recordkeeper

36. Workpaper Documentation Tips
Key information to include in audit documentation
Minutes documenting approval of change in service provider
Consider obtaining communication regarding transfer to employees
Mapping between funds
Re-election of investments
Same investment options

37. Contribution & Party in Interest Testing
Jennifer Allen Partner Crowe Horwath LLP

38. Contributions and Contributions Receivable Assertions
Amounts received or due have been appropriately determined, recorded and disclosed in the proper period, in accordance with the plan’s provisions and with the applicable financial reporting framework
An appropriate allowance has been made for uncollectible plan contributions receivable
Participant’s contributions are authorized and have been executed at the proper amount, in the proper period and in accordance with the plan’s provisions and at the participant’s direction

39. Contributions and Contributions Receivable Assertions (Cont)
All active participants have been properly included in the employee eligibility reports and contribution records
Appropriate and accurate participant data, including payroll information, is being utilized in determining amounts contributed to the plan

40. Contributions – Examples of Risks and WCGW
Employees are not appropriately included or excluded based on the plan’s provisions
Employer or employee contributions are not properly calculated, authorized, or recorded in the proper period
Employee and employer contributions are incorrect due to the use of a definition of compensation different than what is specified in the plan’s provisions, including the application of true-up contributions.

41. Contributions – Examples of Risks and WCGW
Contributions are not accurate, complete or remitted in accordance with the plan’s provisions (ex: manual checks, bonuses)
Participant deferral percentages entered into payroll are inaccurate
Incorrect compensation or hours is used to determine compensation
Excess contributions such as failure to pass the ADP test are not properly determined or recorded

42. Contributions Received and Receivable
Read the Plan Document – know what types of contributions are allowed in the Plan.
Employee contributions – does the Plan allow catch-ups? Rollovers? After-tax? Roth?
Employer contributions – is the Plan a safe harbor plan? Do they have a matching contribution and/or a profit sharing contribution?

43. Contributions Types of Contributions Employee Pre-tax
Catch-up contributions
After-tax
Roth
Rollovers
Employer
Matching
Safe Harbor
Profit sharing
Discretionary
Qualified non-elective contributions (QNEC)
Merged plans

44. Contributions Definition of compensation
Applying an incorrect definition of compensation is one of the most common operational errors for a DC plan
Read the Plan Document
Identify the types of compensation that are included and the types that are excluded
Bonuses, commissions, shift differentials, moving costs, etc.
May have different definitions for different calculations (for example, employee deferrals vs employer matching contributions)
LLC’s – risk of neglecting to include K-1 earnings
Application of IRC annual compensation limit
Knowing the specifics here will help you design effective samples as well as appropriate tests

45. Contributions – Example Substantive Procedures
Refer to Chapter 5 of Guide for additional procedures and guidance
Agreeing total contribution amounts (by type) from the plan sponsor’s records to the plan’s reports (e.g. trustee or custodian/recordkeeper reports)
Perform analytical procedures and compare results to prior period and expectations (e.g. average deferral per participant; ratio of employer match to participant deferrals)

46. Contributions – Example Substantive Procedures
Testing whether forfeiture amounts, if any, have been properly applied in accordance with the plan document
Vouching contributions to wire transfer notices or other supporting evidence
Determine that accruals for contributions have been recorded in accordance with the applicable financial reporting framework and test the amounts of such accruals, such as by vouching to subsequent receipt

47. Contributions – Example Substantive Procedures
Evaluating the reasonableness of the plan’s allowance for estimated uncollectible accounts
Employer profit sharing contributions and discretionary contributions – Agree to authorization in minutes. Recalculate allocation to a sample of individual participant accounts.
Employer contributions – Qualified Non-Elective Contributions – Agree the calculation of the QNEC provided by the TPA to the Plan in total and for a sample of individual participant accounts.

48. Contributions – Example Substantive Procedures
Obtaining a schedule or inquiring of plan management about the timeliness of employee salary deferral contribution remittances to the plan. Failure to timely remit such amounts constitutes a prohibited transaction.

49. Contributions – Example Procedures for Sample of Participants with Contributions
Agree any demographic information relevant to eligibility determinations from the recordkeeper back to personnel files of the plan sponsor
Determine that the participant was eligible under the plan terms and elected to join the plan or were enrolled automatically in accordance with plan provisions
Determine that the participant authorized the deferral rate or deferral amount or for plans with automatic enrollment provisions, deferrals have been appropriately made in accordance with those provisions, including auto escalation provisions

50. Contributions – Example Procedures for Sample of Participants with Contributions
Recalculate contributions, by type, in accordance with the plan and IRC limits, including the proper definitions of eligible compensation, automatic deferral rates, and matching contribution formulas. Consider confirming such information with participants.
Employee deferral
Total of employee and employer contributions
Agree contributions to recording in the participant’s account and determine recorded in the investment option selected by the participant.

51. Rollover Contributions – Example Substantive Procedures
Determine plan document allows for rollovers
Obtain a listing of rollovers and agree to the plan’s financial statements
For sample of rollovers:
Test investment elections, if applicable
Test that the rollover amount properly applied to correct participant’s account

52. Errors Found in Testing Contributions
One pay period of deferrals was never received by the Plan.
Payroll service was erroneously calculating the match by failing to treat Roth deferrals as a deferral eligible for match.
Participant contributions were credited to the wrong participant’s account.
Lots of errors in the definition of compensation. (e.g. improperly including/excluding bonuses) Make sure the person in charge of determining eligible compensation knows the plan document.
Late remittances – Watch out for manual check runs and decentralized payroll operations.

53. Workpaper Documentation Tips
Key information to include in audit documentation
Definition of eligible compensation
Types of contributions allowed
Contribution formulas and limits
Copies of reports used in testing contributions (payroll reports, trust statements, participant level reporting)
Identity of individuals selected for testing of contributions to a sample of participants
An understanding of the internal controls associated with contributions

54. Party in Interest/Prohibited Transactions
A party in interest is a
fiduciary or employee of the plan,
any person who provides services to the plan,
an employer whose employees are covered by the plan,
an employee association whose members are covered by the plan,
a person who owns 50 percent or more of such an employer or employee association,
Relatives of such person just listed
A prohibited transaction is a transaction between a plan and a party in interest that is prohibited under Section 406(a) of ERISA
Statutory and administrative exemptions are available

55. What is Prohibited
Section 406(a) provides that a fiduciary shall not cause a plan to engage in a transaction if he knows or should know that such transaction constitutes an indirect or direct:
Sale or exchange or leasing of property between the plan and a party in interest;
Loan or other extension of credit between the plan and a party in interest (includes delinquent participant contributions);
Furnishing of goods, services or facilities between a plan and a party in interest;
Transfer to, or use by or for the benefit of, a party in interest, of any assets of the plan, or
Acquisition, on behalf of the plan of any employer security or employer real property in violation of section 407(a); and
No fiduciary shall permit the plan to hold any employer security or employer real property if he knows or should know that holding such security violates section 407(a)

56. Exceptions to Prohibited Transactions
In accordance with plan document and reasonable compensation for services performed
Reasonable compensation for office space and legal, accounting, and other services necessary for the operation of a plan are permitted if certain conditions are met
In-House Asset Manager (INHAM) Class Exemption

57. Why are Parties in Interest Important
Should be able to identify parties in interest of the plan
Party in interest vs. related party
Recognize the transactions between the parties in interest and the plan and understand the purpose of the transaction
Identify whether the transaction is prohibited
Plan sponsor may need to seek advice from ERISA counsel
Required reporting & disclosure

58. Parties in Interest – Audit Steps
Typical auditing procedures to determine existence
Evaluate the plan administrator's procedures for identifying and properly accounting and reporting for party in interest transactions.
Request from client a listing of parties in interest and any transactions with these parties during the period.
Review filings (for example, Forms 5500 and LM-2) and correspondence by the reporting entity with the DOL and other regulatory agencies for the names of parties in interest.
Review prior years' working papers for the names of known parties in interest.
Inquire of the plan administrator whether any prohibited transactions have been identified as a result of past DOL, IRS, or other governmental examinations.
Review agreements with service providers.
Provide audit personnel with the names of known parties in interest.
Review the minutes of applicable governance meetings

59. Parties in Interest – Audit Steps (cont)
Typical auditing procedures to test identified transactions
Obtain an understanding of the business purpose of the transaction.
Examine invoices, executed copies of agreements, contracts, and other pertinent documents.
Determine whether the transaction has been approved by the board of trustees or other appropriate officials.
Test for reasonableness the compilation of amounts to be disclosed or considered for disclosure.
Inspect or confirm and obtain satisfaction concerning the transferability and value of collateral.
Other testing procedures described in the AICPA’s Accounting and Audit Guide for Benefit Plans

60. Workpaper Documentation Tips
Key information to include in audit documentation
Listing of parties in interest
Listing of related parties
An understanding of management’s internal controls related to identification of parties in interest and related parties
Listing of types of transactions involving parties in interest and related parties
Support for disclosure in the financial statements of party in interest and/or related party transactions
Evidence of how these transactions were evaluated to conclude upon whether they constituted a prohibited transaction

61. Question & Answer Session

62. Don’t forget to download your CPE certificate! Click on Now!

63. We welcome your feedback! Please complete the online evaluation

64. Copyright © 2014 American Institute of CPAs. All rights reserved.
Thank You
Copyright © 2014 American Institute of CPAs. All rights reserved.