What a plan audit’s deficiency rate actually measures, and the one response to it that does not require getting big.
In February 2026, the Department of Labor’s Employee Benefits Security Administration closed its books on fiscal year 2025: 878 civil investigations into retirement and welfare plans, 63 percent of them ending in a monetary recovery or another corrective action, and $1.4 billion restored to plans and participants. Enforcement is getting more aggressive. The deficiency problem it is aimed at has not moved by nearly as much.
Three numbers describe that problem better than the enforcement total does. They are the share of employee benefit plan audits found to contain at least one major deficiency, sorted by how many such audits the firm performs in a year, from the Department’s most recent assessment of audit quality in this field, published in November 2023 and covering the 2020 Form 5500 filing year.
Figure 1. Share of audits reviewed containing one or more major deficiency. Department of Labor, EBSA, Assessing the Quality of Employee Benefit Plan Audits, November 2023. Strata are as defined by the Department and are not equally sized, so this is ordered by volume rather than plotted on a continuous axis. The relationship has held across all four of the Department’s assessments.
Across the whole sample of 307 audits, 30 percent contained one or more major deficiencies against generally accepted auditing standards. That is a genuine improvement on the 39 percent found in the 2015 study, and the improvement deserves acknowledging before anything else.
major deficiencies
Figure 2. The 307 audits reviewed, by outcome. The Department estimates that the deficient share left $927 billion and 11.7 million participants and beneficiaries exposed, an increase of $274 billion on its earlier studies, because plan assets grew faster than audit quality improved.
Both charts describe the same profession. The aggregate is getting better while the spread between its best and worst practitioners stays enormous, and the variable that sorts them is not seniority, firm brand, or years qualified. It is throughput. And throughput is exactly what the Department’s enforcement arm has spent the last year squeezing: more investigations, a higher corrective‑action rate, more money moved. None of that enforcement pressure resets the distribution above. It just raises the cost of sitting on the wrong side of it.
What the Hundredth Plan Buys
The Department’s own reading is that occasional auditors should probably stop, and the market has partly agreed already: firms performing fewer than six of these audits a year fell from 5,203 to 2,589 between the two studies, a decline of roughly half.
Figure 3. CPA firms performing fewer than six employee benefit plan audits a year. The smallest stratum has roughly halved between the Department’s two most recent studies. Some of that is firms concluding the work no longer pays at low volume; some is a 2023 DOL rule change to how participants are counted toward the audit threshold, which the Department estimated would reclassify about 19,400 plans as small enough to skip the audit requirement entirely. The study does not separate the two effects.
That is sound advice and an incomplete explanation. Specialisation describes the pattern without saying what the specialist actually possesses.
It is not, mainly, deeper knowledge of ERISA. It is that by the hundredth plan the specialist has seen each record keeper’s export enough times to know where the fields sit, which columns are unreliable, and what a normal file looks like before anyone tests anything. The reconciliation was built once and has been reused ninety‑nine times. The work has become repeatable.
The firm auditing three plans rebuilds all of that annually, from nothing, on files it half‑remembers. Every record keeper exports differently. Every payroll provider structures its fields differently. Census data arrives from systems that were never designed to speak to each other and were not built with an auditor in mind. That is a translation cost. It is paid every year, in full, by precisely the firms with the least capacity to absorb it, and it never amortises. Which reframes the whole distribution: the specialist is not necessarily auditing better, but is certainly auditing from a standing start far closer to the finish line.
Where Does Your Firm Sit?
The three strata above are categories, not a dial — the Department does not publish a deficiency rate for every possible volume. Pick the band that matches your firm’s employee benefit plan audits this year to see which one you are actually in, and what that stratum’s translation cost looks like.
Where the Audit Begins
The masterclass this draws on, presented by Kelly Mann, argues that plan audits do not begin with testing at all. They begin with reconstruction. Mann founded and leads AuditMiner and its closing episodes demonstrate her own product, so the argument is made by an interested party; the structural description is nonetheless recognisable to anyone who has done this work.
A team requests census data, payroll reports, contribution detail, distributions, loans, investment activity. What arrives is an assortment: portal exports, spreadsheets, PDFs, a package from the record keeper. Before a single procedure runs, somebody must establish whether the material is even complete. Then something fails to tie. The contribution file disagrees with payroll. The census does not match participant activity. The team queries the client, waits weeks, receives a revised file, rechecks, and surfaces the next gap. The engagement moves backwards. It is not evidence of careless clients or lazy auditors; it is what happens when the inputs are unstable.
Her proposed alternative is a four‑stage sequence, and the useful thing about it is that three of the four stages cost nothing but sequencing: collect for completeness rather than accumulating documents, validate early so missing participants and mismatched totals surface before procedures begin, standardise each provider’s format into one consistent shape, then deliver the data in the form the audit actually needs.
Stage three is where the chart at the top of this article gets its explanation, and it is worth hearing how Mann describes building it, in a conversation recorded for Miles Masterclass:
“We didn’t try to anticipate every format upfront — we built the system to be flexible enough to absorb them over time. The architecture is provider‑agnostic, meaning we don’t assume anything about how the data comes in. What we’ve built is essentially a translation layer that normalizes whatever the service provider outputs into a consistent structure our tools can work with. The coverage we have today came from real engagements — every new provider our clients brought us made the system stronger.”
— Kelly Mann, founder and CEO, AuditMiner
Standardisation, in other words, is exactly what the hundred‑plan firm has accumulated by repetition, and it is the one component of the distribution above that can be manufactured instead of earned. A firm doing three plans a year cannot buy ninety‑seven more years of pattern recognition. It can build, or license, a consistent translation layer for the handful of record keepers and payroll providers it actually meets.
The Boundary Worth Keeping
Two limits belong on this, and the masterclass states the first itself. None of it changes what an audit is. The standards do not move, judgment does not move, and cleaner inputs are not assurance. A standardised file is still a file that must be tested.
The second limit the masterclass passes over. Data delivered pre‑assembled by a third party is itself information the auditor relies upon, and evaluating its relevance and reliability is the auditor’s problem, not the provider’s. That question is being formalised around these engagements already: SAS 136 renamed the limited scope audit as the ERISA Section 103(a)(3)(C) audit and added requirements concerning management’s investment certification, and the IAASB’s revision of ISA 500 on audit evidence is being modernised expressly for automated tools. Substituting somebody else’s pipeline for your own reconstruction changes what the evidence is. It does not remove the duty to assess it.
To see that completeness argument worked through in full, including how the four‑stage sequence runs on an actual engagement, watch Audit Beyond Spreadsheets on Miles Masterclass.
