"AICPA Audit & Accounting Guide - Employee Benefit Plans
6.22
Benefit plans are increasingly using service providers to initiate, execute and perform the accounting processing of transactions on behalf of the plan administrator. Often the plan does not maintain independent accounting records of such transactions. For example, for 401(k) plans, many plan sponsors no longer maintain participant enrollment forms detailing the contribution percentage and the investment fund allocation option. For health and welfare plans, often claims are submitted electronically from the health care provider directly to a claims administrator for adjudication and payment. In these situations, the auditor may not be able to obtain a sufficient understanding of internal control relevant to such transactions to assess the risks of material misstatement and design the nature, timing, and extent of further audit procedures without considering those components of internal control maintained by the service organization. This understanding can be efficiently achieved by obtaining and reading the entire document prepared in accordance with SAS No. 70 for the service organization. SAS No. 70 reports generally cover the relevant operations of a service organization; however, certain operations of the service organization may not be addressed in the SAS No. 70 report, and those operations may be significant to the plan audit. In these instances, the engagement team will need to obtain an understanding of the controls in the relevant areas excluded from the scope of the SAS No. 70 report." Emphasis added.
Both the above guide and the Employee Benefit Plans Strategic Briefing include "recordkeeping" and "benefits administrators" so it covers TPA's. I agree that a SAS 70 report is not required. But with VRUs and automated loan processing, etc., plan administrators/sponsors just do not have any control over these transactions (that is why they have a TPA). As these transactions are a significant part of a plan's internal control they must be tested. Without a SAS70 Type II report on the TPA covering, say, participant investment allocation, how can a plan satisfy me as an auditor that participants balances are correct?
Dell's answer is absolutely correct.