Your 401(k) auditor has two essential and one optional step to take with regard to internal control deficiency findings. Before you hire your auditor, ask what you can expect with regard to communication and recommendations. By including your expectations in your engagement letter, you’ll get a better quality audit and can get information that will help you.
Two essential steps for your auditor
1. Evaluate the severity of deficiencies – Your auditor will determine if an individual or combination of deficiencies are material weaknesses or significant deficiencies. The measure used to determine severity is the:
- Magnitude of the potential misstatement
- Degree of possibility that the plan’s controls will fail to prevent, or detect and correct a misstatement of an account balance or disclosure.
2. Communicate the deficiencies in writing – Your auditor has no more than 60 days following the financial statement issuance date to communicate the deficiencies to you. For plans that file a Form 11-K with the SEC, the deadline is to communicate within 45 days. If no deficiencies are found, the auditor must also communicate a lack of deficiencies.
Note: Auditors are required to put the same deficiencies in writing repeatedly until the deficiency is corrected. And, the deficiencies found must be put in writing even if they were corrected after a verbal notice of the deficiency.
One optional step for your auditor
Recommend steps to take to improve internal controls – To me, this step separates an adequate auditor from a good auditor. Your organization can gain valuable insight from the recommendations prepared by your auditor. The recommendations give you fiduciary guidance that you can use to evaluate the costs and benefits for revising internal controls.
Such focused attention on internal controls gives plan fiduciaries a confirmation of governance, which is justification of a well-managed plan.