Read this if you are a plan sponsor of employee benefit plans.
This article is the sixth in a series to help employee benefit plan fiduciaries better understand their responsibilities and manage the risks of non-compliance with Employee Retirement Income Security Act (ERISA) requirements. You can read the previous articles here.
Plan sponsors have a fiduciary responsibility to provide oversight over the operations of employee benefit plans. This oversight involves a multitude of varying responsibilities. Failure to provide sufficient oversight can lead to non-compliance with rules and regulations. However, even if plan sponsors are providing sufficient oversight, lack of documentation of the oversight is arguably equally as severe as no oversight at all. Here are some common fiduciary responsibilities and how you should document them.
Review of the report on service organization’s controls
Most employee benefit plans have outsourced a significant portion of the plan’s processes, and the internal controls surrounding those processes, to a service organization. Regardless of how certain plan-related processes are performed—internally or outsourced—the plan sponsor has a fiduciary responsibility to monitor the internal controls in place surrounding significant processes and to determine if these controls are suitably designed and effective. The most commonly outsourced processes of an employee benefit plan are the administration, including recordkeeping of the plan, through a third-party administrator; payroll processing; and actuarial calculations, if applicable to the plan.
When plan processes are outsourced to service organizations, generally the most efficient way to obtain an understanding of the outsourced controls is to obtain a report on controls issued by the service organization’s auditor. You should request the service organization’s latest System and Organization Controls Report (SOC 1 report). The SOC 1 report should be based on the Statement on Standards for Attestation Engagements No. 18, Reporting on the Controls at a Service Organization, frequently known as SSAE 18.
Plan sponsors should perform a documented review of the SOC 1 report for each of the plan’s service organizations. The documented review should most notably include discussion of any exceptions noted within the service auditor’s testing performed, identification of subservice organizations and consideration if subservice organization SOC 1 reports need to be obtained, and assessment of the complementary user entity controls outlined in the SOC 1 report. The complementary user entity controls are internal control activities that should be in place at the plan sponsor to provide reasonable assurance that the controls tested at the service organization provide the necessary level of internal control over the plan’s financial statements. Contact a BerryDunn professional to obtain our SOC report review template to assist in documenting your review.
Documentation of the plan within minutes
To provide general plan oversight, plan sponsors should have a group charged with the governance of the plan. This group should meet on a routine basis to review various aspects of the plan’s operations. Minutes of these meetings should contain evidence that certain matters that would be of interest to the Department of Labor (DOL) were discussed.
We recommend minutes of meetings document the following:
- Investment performance—The plan sponsor has a fiduciary responsibility to ensure the investments offered by the plan are meeting certain performance expectations. Investment statements and the plan’s investment policy should be reviewed on a regular basis with documentation of this review retained in minutes of meetings. Any conclusions reached about the need to change investments or put an investment on a “watch-list” should also be documented in the minutes, including any additional steps that need to be taken.
- SOC 1 report review—As noted above, the plan sponsor has a fiduciary duty to ensure all third-party service organizations utilized by the plan have suitably designed and effective internal controls. Plan sponsors should perform a documented review of the SOC 1 report for each of the plan’s service organizations. The results of these reviews should then be reported at plan oversight meetings with any subsequent actions or conclusions documented in the minutes to these meetings.
- Reasonableness of fees—The DOL requires plan fiduciaries to determine if the fees charged under covered service provider agreements are reasonable in relation to the services provided. To determine the reasonableness of fees, the plan may (1) hire a consultant, (2) monitor industry trends regarding fees, (3) consult with peer companies, (4) use a benchmarking service, or (5) conduct a request for proposal. Failure to determine the reasonableness of the fees charged can result in a prohibited transaction. When doing such a review, the fiduciaries of the plan should document in the minutes the steps taken and conclusions reached.
- Overall review of the plan—Plan sponsors have a fiduciary responsibility to review the activity of the plan as well as participant balances. We recommend plan sponsors implement and document monitoring procedures over the activities of the plan and participant balances. This review could be incorporated into documented self-testing procedures, by haphazardly selecting a sample of participants each quarter and reviewing their account activity and participant balances. The results of such self-testing should then be reported at plan oversight meetings with any subsequent actions or conclusions documented in the minutes to these meetings. Reach out to a BerryDunn professional to obtain our participant change review workbook to assist in performing this self-testing.
Retention of salary reduction agreements
During our audits of employee benefit plans, we often note that employee deferrals are not consistently supported by salary reduction agreements or other forms maintained in employees’ personnel files. Many third-party administrators allow participants to make changes to their elective deferral rates directly through the third-party administrators without the involvement of the plan sponsor.
We often recommend that you maintain all changes to employee elective deferral rates in employees’ personnel files using salary reduction agreements. We also recommend that employees’ elections to not participate in the plan be documented in their personnel file. If employees can elect to change their deferral rates directly with the third-party administrator, we typically recommend that management print support from the third-party administrator’s online portal as documentation to support the change in the employee’s deferral rate and retain this support in the employees’ personnel file. However, if the third-party administrator’s online portal provides adequate history of deferral election changes, the plan sponsor may be able to rely on this portal for documentation retention. In these instances, the plan auditor should request a deferral feedback report directly from the third-party administrator.
Monitoring of inactive accounts
Inactive accounts should be monitored by the plan sponsor for unusual activity or excessive fees that may be posted to these accounts. To the extent that inactive accounts have not exceeded $5,000, consideration should be given to cashing out the accounts if allowed by the plan document. Plan sponsors should, on a periodic basis, review the accounts of inactive participants or those who have been separated from service to ascertain whether the changes and charges to those accounts appear reasonable.
Plan sponsors have many documentation responsibilities. This list is not meant to be all-inclusive. And, the facts and circumstances of each employee benefit plan will change the applicability of these items. However, this list should be used as a tool to help plan sponsors perform a deep dive of their current plan documentation processes. And, hopefully, a result of this deep dive will be a robust documentation process that deliberately documents all major decisions and review functions related to the plan.