Internal Controls for Employee Benefit Plans

When an employee benefit plan is implemented, it is important for the plan sponsor (or employer) to communicate the roles and responsibilities of the affected departments, typically human resources, payroll and accounting. The human resource department communicates information about the benefit plan to employees as part of the orientation process, as well as monitors eligibility and enrollment. Payroll is tasked with ensuring employee paychecks reflect proper deductions for things like elective deferrals and loan payments. Accounting then ensures that cash payments to the plan or for the plan are accounted for properly. As a result, it is vital to the operation of a plan that these departments have established roles and responsibilities. This article provides a framework to consider when developing effective internal controls to properly maintain an employee benefit plan.

Maintaining tax-exempt status

One major benefit of sponsoring an employee benefit plan is that most contributions are tax-deferred to the employee or a tax deduction to the employer. Therefore, maintaining the tax-exempt status of a plan is critical to both groups. Tax-exempt status is maintained by operating the plan in compliance with the plan document. And as anyone who has read a plan document can attest, these documents are not an easy read. A plan document continually references specific sections of the Internal Revenue Code, the regulations governing benefit plans. As a plan is tailored to the needs of the employer, specific elections are made. Each election can have numerous implementation pitfalls, jeopardizing the employee benefit plan’s tax-exempt status.

For example, plans generally elect a minimum age for eligibility and a minimum service requirement. Improper implementation of either of these elections for an employee, if left uncorrected, can jeopardize the plan’s tax-exempt status.

There are four types of failures that can jeopardize a plan’s tax-exempt status: 1) plan document failures, 2) operational failures, 3) demographic failures, and 4) employer eligibility failures. This article focuses on operational failures as they are the most common failures that plan sponsors encounter.

Internal Controls & Operation Failures

Operational failures are simply put, a failure to follow plan provisions. Operational failures occur when a plan sponsor incorrectly interprets a plan provision, implements processes that contradict the plan provisions or fails to consider the impact of changes in business operations on the plan. Correcting operational failures can be costly endeavors, both financially and in staff resources.

Designing internal controls is an important process that all business entities should undertake; employee benefit plans are no different. Establishing effective internal controls to prevent and detect problems can provide Plan Sponsors with reasonable assurance that the objectives of the employee benefit plan are met, and operational failures are avoided.

Internal Control, developed by leadership, is a process designed to provide assurance regarding the achievement of objectives relating to operations, reporting and compliance. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) recently released updated guidance on Internal Control. Internal Control – Integrated Framework COSO aligns seventeen principles with five integrated components; 1) Control Environment, 2) Risk Assessment, 3) Control Activities, 4) Information and Communication and 5) Monitoring Activities. To view the executive summary of Internal Control – Integrated Framework follow this link COSO Executive Summary.

Operational Failure: Eligibility

Operational failures related to eligibility arise from misinterpretation or failure to implement Plan provisions. For example, consider a plan with the following characteristics: 1) employees become eligible to participate after one year of service and the completion of 1,000 hours, 2) the eligibility computation period is the period beginning the employment commencement date through the anniversary date, and 3) the Plan has two entry dates January 1 & July 1.

Participant 1Participant 2
Employment DateMarch 1, 20X1August 1, 20X1
Anniversary DateMarch 1, 20X2August 1, 20X2
Hours Worked9991,001
Plan Entry DateNot eligibleJanuary 1, 20X3

Participant 1 is not eligible to enter the Plan as 1,000 hours was not reached by the Anniversary date.

Participant 2 is eligible to enter the Plan as of August 1, 20X2. The next plan entry date, after achieving eligibility, is January 1, 20X3, therefore the Participant begins participating at that time.

Control Considerations:

  • Sponsor should ensure that the time keeping system is setup to capture the data required to measure eligibility (hours worked).
  • Sponsor should generate a report of employee hours based on employment date, not plan year.
  • The hours report should be reviewed on a monthly or quarterly basis
  • In December and June of each year, eligible employees are notified of their eligibility and the pending entry date. Enrollment forms would then be completed.

Operational Failure: Compensation

Operational failures related to compensation typically arise from misinterpretation of the Plan’s definition of eligible compensation. Each plan specifically defines eligible compensation to include or exclude items like bonuses, fringe benefits, overtime, etc. For example, consider a plan for a company in the hotel industry that has elected “W-2 wages” as eligible plan compensation. In the hotel industry, employees are compensated in numerous ways, like salaried, hourly, tips, commissions, etc.

Participant 1Participant 2
Regular wages5,4605,460
Overtime wages2,3402,340
Reception tips12,500
Plan Compensation20,30020,300
Elective deferral %10%10%
Elective deferral2,030780


W-2 wages includes all of the compensation types listed in our example, however something went wrong in payroll, and the pay code for commissions was not included in the computation of  elective deferrals. As illustrated above, participant 1 correctly had $2,030 of elective deferrals withheld from his paycheck while participant 2 missed the opportunity to defer $1,250 ($12,500 * 10%). The correction for this type of operational failure is the Sponsor contributes 50% of the missed deferral opportunity ($625 = $1,250 * 50%) and 100% of any employer matching contributions, plus lost earnings.

Control considerations

  • Review of active pay codes to ensure all wages subject to W-2 reporting are set up to have elective deferral contributions withheld.
  • Management review of new pay codes, when added.

Operational Failure: Hardship distributions

Operational failures related to hardship distributions can occur AFTER a proper distribution is completed. Under IRC regulations, a participant will be unable to contribute to the plan for six months after the receipt of a hardship withdrawal. Consider this example, where a sponsor properly authorized a hardship distribution for participant X.

Participant X

DatePlan CompensationDeferral %Eligible deferralsIneligible deferral
Hardship distribution6/30/20X1
6-month suspension7/1/20X1 – 12/31/20X1
Plan compensation1/1 – 6/30/20X125,00010%2,500
Plan compensation7/1 -12/31/20X125,00010%2,500

The operational failure in this instance is the failure to suspend deferrals for a period of six-months after the receipt of a hardship distribution. The correction is to make a taxable distribution of the ineligible deferrals to the participant and any matching contributions associated with the ineligible deferrals are forfeited.

Control considerations

  • The individual approving the hardship withdrawal should communicate with Payroll to ensure elective deferrals are suspended for six months.
  • Internal tracking system for individuals on suspension
  • Monthly review by management to ensure withdrawals resume after the six month suspension period.


Plan sponsors must be diligent in reviewing plan documents and ensuring that all plan provisions are implemented and plan compliance is monitored.  Appropriate processes and control activities implemented within the organization can reduce the risk of errors (noncompliance) to an acceptable level. Control activities should be reviewed at least annually and when significant process changes occur. Monitoring activities performed by senior leadership should occur on a more frequent basis to ensure the operating effectiveness of the control activities.

Implementing internal controls to prevent operational failures can be time consuming, however corrections can be costly, both financially and in staff resources. While the corrections of isolated incidents can be a simple endeavor, there are specific methods that the IRS & DOL prescribe for these corrections. Click on these links for more information on the Employee Plans Compliance Resolution System (EPCRS) and the Voluntary Fiduciary Correction Program (VFCP).

Travis Jones
Travis Jones

Travis Jones is an Accounting and Assurance Senior Manager at BeachFleischman PC. He has planned and conducted several audits, reviews, and compilations for closely held private companies and nonprofit organizations, as well as benefit plan audits.