401(k) Plan Annual Audit

[oriecat]

Our auditors for our 401(k) plan are coming tomorrow, and they just faxed me a listing of requested stuff they will want to see and this year, they are asking for I-9s for new enrollees and employee files for departed participants. They have never asked for these things before and I find them very odd and I am a bit uncomfortable with this. Is this normal practice? Why would they want those things?

[Guest Kevin1]

I do know that the audit requirements have been increased for CPAs. I believe there was a new pronouncement issued that expands information they require. Not surprising that additional verification data is required.

[JanetM]

Some is SOX result. Increased record keeping by plans means increased testing for auditors. Call it CYA. We have the same thing going. Used to be we would be happy to pay surviving spouse based on obit in the paper. Now it has to be death certificate.

[Guest mjb]

Where is there a requirement that plan participants have I-9 as a condition to enrollment? Why not ask the auditors for the basis for requesting such documents in a plan audit? Dont be surprised if the answer is SOX.

[oriecat]

I called to talk to them about it, and they want the I-9 to verify the birth date, and the file to verify termination date. I said I wasn't comfortable giving them the whole file, but would make copies of the separation sheet or resignation so they can see the date they want, and she said that is ok.

[austin3515]

Back in my auditing days, we would ask for I-9's on all clients. IT's the easiest way to verify DOB and often date of hire (i..e, when did they sign the I-9). One thing auditors hate to hear is "you can't have access to that." That's a BIG red flag Sounds like you have a good relationship with the auditor, and nothing seemed out of line, otherwise they would have made a bigger issue about it.

Out of curiosity, why are I-9's more sensistive then payroll information?

[Guest mjb]

I-9s are not required for all employees, e.g. only those hired in 1986 or later have I-9s. So other records are still needed which leads to the Q why ask for 2 sets or records when one e.g. plan DOB will be acceptable for ees hired before 1986?

[austin3515]

The point is to get evidence of the employees birth date. Referencing the Plan's records regarding dates of birth isn't auditing at all. Now getting an I-9, that's auditing!! The employee signed it and everything! They probably even kept a copy of the driver's license!

Most employers have I-9's for all employees, particularly companies started after 1986. I audited 100s of plans (if you added up the 4 years I did this) and this was NEVER an issue with any of my clients. Okay, so if you ask for 20 I-9's and they only track down 18 and you need to do alternate procedures for a couple of participants.

I think you are making way too big a deal over a simple request. My question regarding payroll was intended to remind you that the auditor is going to have access to information that is much more confidential then I-9's. I pose the question again, why are the I-9's more confidential then the payroll records?

[oriecat]

I wasn't overly concerned about the I-9s, I was more uncomfortable with handing them the entire employee file for departed individuals. And rationally, I realize that the auditors wouldn't use any of the information, they would just verify what they are looking for. I think my reaction at first was just that, a reaction to a changed procedure. And as a payroll professional, I am very protective of giving any information out, especially if I don't know why. The auditors already have access to the payroll data through their access to our plans account, so I'm used to that. I don't think I'm making a big deal out of anything, I was just wondering why they would want these things. I'm not fighting giving them what they need.

[austin3515]

Gotcha - I was focused on the I-9 portion of your request.

I hadn't even noticed that you indicated they asked for the employee's file which is NOT a reasonable request. In fact, depending on what's in their, you might be violating HIPPAA by doing so.

[Guest fender5150]

Great point on HIPPAA. IE: If there are medical records in the file; your can't let anyone see it without the employees written permission. Aside from that, you risk a letigious violation of the employee's privacy if there are employee reviews and other personal HR information in the file.

And it brings up another point. We have to comply with so many frickin rules, it gets hard to keep up with it everything. I mean come on; throw me a frickin bone here!