Coronavirus distribution affecting current vesting on termination payout?!

Here's a odd one for this afternoon - We are TPA on a plan that requires the independent audit report for the 5500 due to size.  The plan is with a large recognized national 401k vendor.  The auditors are currently doing a review of selected participant distributions.  They were unable to match the amounts forfeited on two individuals based on the vesting so of course came to me for explanation.  I also could not match the amounts that were paid out/forfeited so I checked both my system and the participant hard copy distribution form.  Both of those reflect the proper vested percentage for each participant.  I then went to the vendor for explanation as to how the vested percentage was computed.  In both cases the participants had taken a Coronavirus withdrawal back in 2020 and the vendor is telling me that affected the final payment and subsequently the forfeitures for each participant.  That would indicate to me that a portion of the Coronavirus distribution was made from non-vested funds.  We're not talking about a lot of money here because this particular client limited the CVD to $3,450 per participant.  Both participants had deferral accounts and for one of them the vendor didn't even take 100% of the deferral account before taking from the Employer sources.  It's pretty confusing to me anyway.

Ultimately I guess my question is - I was unaware that it was even allowed at the time to take non-vested funds as part of the CVD distributions.  Does anyone know if this was a thing?

Thanks in advance!

See Section 2A in Notice 2020-50 Guidance for Coronavirus-Related Distributions and Loans from Retirement Plans Under the CARES Act.  The gist is the plan could expand the amounts that could be distributed if the plan permitted the distributions, but you cannot pay out amounts that are not permitted to be paid (which I read is like non-vested amounts).

The vendor may have gotten creative and allowed payments of a vested portion of an account that was only partially vested (e.g. a partially vested NEC account).  That would then require them to use the funky formula to add into the current calculation of a vested amount an add-back of the previously distributed amount.

The auditors should look to the vendor to 'splain what they did.

Thanks Paul.  I did refer the auditors back to the vendor for explanation.  Apparently it was explained to the auditors' satisfaction because we just got the final copy of the financials for last year and can have the client file !

I consider myself pretty good with math, so another part of this was my wanting to understand how the vendor arrived at the payout & forfeiture amounts.  I could not make heads or tails of the amounts, even accounting for the coronavirus distributions.