Why a 403(b) plan sponsor’s internal controls matter

Written by Linda Segal Blinn

In its webpage “Retirement Plan Errors Eligible for Self-Correction,” the Internal Revenue Service (IRS) reminds employers,* “The plan sponsor must have routinely followed established procedures to operate the plan in compliance with the law. A plan document alone isn’t evidence of established procedures.” 

What are internal controls?

Internal controls serve as an employer’s established procedures to operate its 403(b) plan in accordance with the terms of the 403(b) plan document, the Internal Revenue Code (IRC), and (if applicable) the Employee Retirement Income Security Act (ERISA).  

Why do internal controls matter?

In the event of an IRS audit of a 403(b) plan, the strength and adequacy of an employer’s internal controls may be a factor in whether the IRS audit is extensive or not. In addition, if a plan sponsor has established internal controls, that employer may be able to utilize the IRS’s self-correction program to resolve certain operational failures.

What procedures should a 403(b) plan sponsor’s internal controls cover?

Human Resources procedures, including:

• notifying eligible employees of the opportunity to contribute to the 403(b) plan,
• communicating the plan to newly hired employees,
• determining under what circumstances an individual is considered an independent contractor rather than an employee, and
• maintaining records regarding an employee’s date of hire and termination (and, if applicable, rehire).

Payroll procedures, including:

• remitting contributions to the plan’s investment providers, and
• maintaining payroll systems edits to safeguard against amounts contributed in excess of annual IRC contribution limits.

Preservation of documents in compliance with applicable laws, including:

• 403(b) plan document, plan amendments, and related board resolutions authorizing adoption of the plan document or amendments (as applicable),
• employees’ completed salary deferral election forms,
• supporting documentation (including date of birth and years of service) for employees who are making any catch-up contributions as may be permitted under the 403(b) plan,
• a list of investment providers currently authorized to receive contributions and/or contract exchanges under the 403(b) plan, and
• information sharing agreements with current and legacy investment providers in accordance with IRS regulatory requirements for loans, hardships, and other distributions from the 403(b) plan.

Best practices

Employees with knowledge about the employer’s personnel records, payroll systems and operation, and employee benefits manuals and guides collectively can:

• Establish protocols to ensure that the 403(b) plan is operating in accordance with plan provisions and applicable law.  
• Review those protocols at least annually to assess whether any topic currently is not addressed or should be modified or updated.  
• Compare the most recent employee handbook against the terms of the plan document.  If provisions between the two documents are not consistent, determine which document needs to be modified to reflect both the employer’s operating procedures and the IRS rules. 

Resources

• Internal Revenue Manual Section 4.72.13.6 (“Evaluation of Internal Controls”) available at  https://www.irs.gov/irm/part4/irm_04-072-013#idm140185744837120 (part of the IRS 403(b) Examination Guidelines at https://www.irs.gov/irm/part4/irm_04-072-013)
• IRS webpage “Retirement Plan Operation and Maintenance” (available at https://www.irs.gov/retirement-plans/retirement-plan-operation-and-maintenance)
• IRS webpage “Policies, Procedures and Internal Controls Self-Audit” (available at https://www.irs.gov/retirement-plans/policies-procedures-and-internal-controls-self-audit)