Significant Deficiency

If an auditor concludes that a plan has a "significant deficiency" in the plan's internal controls (but that deficiency does not rise to a "material deficiency"), must that be reported in the plan's financial statements attached to the plan's Form 5500?

If the independent qualified public accountants delivered an “unmodified” report the IQPA authorizes the plan’s administrator to upload in the Form 5500 report, that the administrator received a management-weaknesses letter (see below) is not itself a distinct disclosure item in Form 5500.

What is a management-weaknesses letter?

Under certified public accountants’ professional standards, an auditor must communicate to “management”—for an ERISA-governed employee-benefit plan, the plan’s administrator—about “significant deficiencies” and “material weaknesses” in the plan’s internal control. (Internal control is auditor-speak for ways of making sure you do things correctly, and ways of preventing, or at least detecting, what someone does wrong.) If the accountants during their audit of a plan’s financial statements found an internal-control problem, the firm typically sends a “management weaknesses” letter. The letter usually includes at least the deficiencies and weaknesses the CPAs’ professional standards require them to tell you about. Also, the rules permit an auditor to tell “management” about other control-related matters.

Why you should read the management-weaknesses letter

Instead of just filing away the letter, read it. First, receiving information and failing to consider it likely is a breach of a fiduciary’s duty of care. And one might as well use something the retirement plan or its sponsor already has paid for.

Look for a “false positive”

When you read the auditor’s letter, use some prudent skepticism yourself. Even a careful auditor obtains only an incomplete, and sometimes incorrect, understanding of a plan’s provisions and operations. A finding about a deficiency or weakness might be wrong. If you have even a slight doubt about a finding, check the source documents and records yourself, or get a careful worker to test the auditor’s finding.

If you see a mistake, don’t ignore it. Instead, write an explanation of your plan’s procedure for the task involved. Or if the mistake is that your auditor’s finding is that you lack a control that’s unnecessary for your plan, write a cogent explanation about why the control is unnecessary. Respond to every mistake; doing so can help avoid wasted time and effort in the next audit.

Look for procedures that need improvement

On some points, you might concur with your auditor’s finding that a procedure or control could be tighter. If so, start work on the needed improvements. Aim not only to design but also to implement the improvements before the next audit engagement begins. (Many auditors use the preceding years’ management-weaknesses letters, and a client’s responses to them, as tools to help evaluate risks the auditor must consider in planning an audit.) But if making a new procedure or control would require the retirement plan to incur an expense, you must as a prudent fiduciary evaluate whether the value of the improvement makes the expense worthwhile.

Get help from your advisers

A plan’s administrator might ask its lawyer for advice about the management-weaknesses letter and how the administrator should act on the information. After considering the lawyer’s advice, an administrator might consider sharing the auditor’s letter with its third-party administrator, recordkeeper, and other service providers. They might suggest ways to improve the plan’s procedures. A TPA’s or recordkeeper’s way to fix a problem might be more efficient than a method the employer/administrator alone would have found.

Using good sense

Even if a list of problems feels unwelcome, an employer/administrator can evaluate and act on an auditor’s management-weaknesses letter to keep making improvements in how one administers the retirement plan.

This is only general information, and is not advice to anyone.

Thanks!