PriceKubecka Logo

How SECURE 2.0 Is Changing 401(k) Audits in 2026

by | May 6, 2026

The SECURE 2.0 Act is no longer just “new legislation” sitting in the background. In this year’s 401(k) audit season, its operational impact is now showing up directly inside employee benefit plan audits.

What many plan sponsors are discovering this year is that SECURE 2.0 did not simply add new retirement plan features. It added new layers of compliance, payroll coordination, eligibility tracking, participant communication requirements, and documentation expectations.

And from an auditor’s perspective, many of the biggest issues we’re seeing are not traditional accounting problems. They are operational failures caused by disconnected payroll systems, inconsistent processes, incomplete plan administration, and poor communication between HR, payroll providers, TPAs, and recordkeepers.

For plan sponsors, this year’s audits are becoming a real-world test of whether their processes can support the complexity SECURE 2.0 introduced.

Man working on phone

Why SECURE 2.0 is Creating More Audit Complexity

The SECURE 2.0 Act introduced dozens of retirement plan changes with staggered effective dates. Some provisions are mandatory. Others are optional. Many require payroll system updates, plan document amendments, participant notices, and operational controls.

As auditors, we are now seeing increased attention around:

  • Roth catch-up contribution preparation
  • Enhanced catch-up limits for ages 60–63
  • Long-term part-time employee eligibility
  • Automatic enrollment requirements
  • Forfeiture account usage
  • Late remittance testing
  • Payroll coding accuracy
  • Cybersecurity and participant data controls
  • Operational consistency between plan documents and actual plan administration

The biggest theme of the 2026 audit season is this: Operational compliance is becoming just as important as financial accuracy.

Roth Catch-Up Contributions Are Driving New Payroll Risks

One of the largest SECURE 2.0 changes impacting 401(k) audits is the upcoming mandatory Roth catch-up contribution requirement for high earners.

Beginning in 2026, employees earning more than the IRS wage threshold in the prior year must make catch-up contributions as Roth contributions rather than pre-tax contributions. The IRS issued final regulations in 2025 confirming the implementation timeline and operational requirements.

While many sponsors know the rule is coming, auditors are already evaluating whether plans are operationally prepared. This includes reviewing:

  • Payroll coding accuracy
  • Roth source setup
  • W-2 wage threshold tracking
  • Catch-up contribution classification
  • Coordination between payroll and recordkeepers
  • Plan document consistency
  • Participant communication procedures

For plans that still do not offer Roth contribution functionality, the risk is even greater because affected employees may lose the ability to make catch-up contributions altogether if systems are not updated properly.

Enhanced Catch-Up Limits for Ages 60–63 Add Another Layer of Complexity

SECURE 2.0 also increased catch-up contribution limits for participants ages 60–63.

While this sounds straightforward, operationally it creates additional testing and monitoring requirements during audits. Auditors are reviewing whether:

  • Payroll systems correctly identify eligible age groups
  • Contribution limits are monitored accurately
  • Participants are receiving the correct limits
  • Excess deferrals are identified timely
  • Recordkeepers and payroll providers are aligned

Even small payroll coding errors can create compliance issues that surface during testing.

Long-Term Part-Time Employee Rules Continue to Create Audit Findings

Long-term part-time (LTPT) eligibility continues to be one of the biggest operational challenges for plan sponsors.

Under SECURE 2.0, more part-time employees are becoming eligible to participate in retirement plans due to reduced service requirements. For many sponsors, this has exposed weaknesses in:

  • Hour tracking
  • Eligibility monitoring
  • Employee classification
  • Enrollment timing
  • Communication procedures

Auditors are spending significant time reviewing whether eligible employees were admitted to the plan correctly and timely. This is especially important because failures involving excluded eligible employees can trigger correction requirements under IRS and DOL rules.

Automatic Enrollment Requirements Are Increasing Operational Pressure

Beginning in 2025, many newly established 401(k) and 403(b) plans became subject to mandatory automatic enrollment requirements under SECURE 2.0.

For affected plans, auditors are reviewing whether:

  • Eligible employees were automatically enrolled properly
  • Default contribution percentages were applied correctly
  • Annual escalation features are functioning
  • Opt-out elections are documented
  • Payroll deductions align with plan provisions
  • Required participant notices were distributed

Automatic enrollment sounds simple on paper, but operationally it requires strong coordination between HR, payroll, TPAs, and recordkeepers. Many of this year’s audit issues are emerging because systems were never fully aligned before implementation.

Late Remittance Testing Is Receiving Increased Scrutiny

Late remittance testing has always been an important audit area, but SECURE 2.0 has amplified attention on payroll process controls overall. Auditors are seeing more situations where:

  • Payroll files are transmitted inconsistently
  • Contribution deposits are delayed
  • Approval processes are unclear
  • Responsibility between departments is not clearly defined

Because retirement plans are becoming more operationally complex, weak payroll processes are standing out more during audits. For many sponsors, the audit is revealing that the real issue is not the accounting records — it is the underlying workflow.

Forfeiture Accounts and Plan Document Alignment Matter More Than Ever

The IRS and auditors are also paying closer attention to forfeiture account usage and whether plans are administering forfeitures according to plan terms and updated guidance. Auditors are increasingly testing:

  • Timing of forfeiture usage
  • Allocation methods
  • Expense applications
  • Plan document consistency
  • Whether forfeitures are accumulating improperly

This area often becomes problematic when operational practices evolve over time but plan documents are never updated accordingly.

SECURE 2.0 is forcing many sponsors to re-evaluate whether their operational practices actually match their governing documents.

Cybersecurity Is Becoming Part of the Audit Conversation

While cybersecurity is not technically a new SECURE 2.0 provision, the increased reliance on payroll integrations, participant portals, APIs, and automated data transfers has elevated cybersecurity discussions during employee benefit plan audits. Auditors are increasingly asking about:

  • Access controls
  • Payroll file transfer security
  • User permissions
  • Vendor oversight
  • Participant data protection
  • SOC reports
  • Multi-factor authentication

The retirement plan ecosystem is becoming more digital and interconnected, which means cybersecurity risks are becoming more relevant during audits.

What Plan Sponsors Should Be Doing Right Now

The biggest mistake plan sponsors can make is treating SECURE 2.0 as purely a legal or document amendment issue. The real risk is operational execution. Before your next audit, plan sponsors should evaluate:

  • Does payroll match plan provisions?
  • Are Roth sources configured correctly?
  • Are eligibility rules functioning properly?
  • Are contribution limits monitored accurately?
  • Are forfeitures administered consistently?
  • Are automatic enrollment procedures documented?
  • Are HR, payroll, TPAs, and recordkeepers aligned?
  • Are internal controls clearly defined?

The plans with the smoothest audits this year are typically the ones with strong processes, clear documentation, and proactive coordination between providers.

A 401(k) Auditor’s Final Thoughts on SECURE 2.0

SECURE 2.0 is fundamentally reshaping the employee benefit plan audit landscape.

The 2026 audit season is proving that retirement plan compliance is no longer just about numbers. It is about systems, workflows, controls, communication, and operational discipline.

Plan sponsors who proactively address these changes now will reduce compliance risk, minimize audit disruption, and create a smoother experience for both participants and auditors.

At PriceKubecka, we specialize in streamlined, year-round 401(k) audits designed to reduce disruption for plan sponsors while helping identify operational risks before they become major compliance issues.

Need help with this year’s EBP audit or evaluating your SECURE 2.0 compliance? Let’s connect.

Frequently Asked Questions

How is SECURE 2.0 affecting 401(k) audits in 2026?

SECURE 2.0 is increasing audit complexity by adding new operational and compliance requirements related to Roth catch-up contributions, automatic enrollment, long-term part-time employee eligibility, enhanced contribution limits, and payroll coordination.

What are 401(k) auditors focusing on most this year?

Auditors are heavily focused on payroll processes, participant eligibility tracking, contribution coding accuracy, late remittances, forfeiture usage, and whether plan operations match plan documents.

What is the biggest operational risk for plan sponsors?

The biggest risk is lack of coordination between payroll, HR, TPAs, and recordkeepers. Many audit findings now stem from operational breakdowns rather than accounting errors.

Does SECURE 2.0 impact automatic enrollment requirements?

Yes. Many newly established 401(k) and 403(b) plans are now required to implement automatic enrollment and automatic escalation features.

What makes PriceKubecka different from other 401(k) auditors?

PriceKubecka is among the top 1% of CPA firms nationally by 401(k) audit volume. Three key differentiators: (1) proprietary technology that automates 90% of the audit, (2) a flat-rate fee starting at $12,000 with no surprises, and (3) a comprehensive approach that reviews ALL payroll data rather than just a sample, catching errors other auditors miss.

Does a Fiscal-Year 401(k) Plan Still Need an Audit?

Potentially, yes.

Operating on a fiscal year does not eliminate or change the basic requirement for an independent employee benefit plan audit. Whether a defined contribution plan requires an audit generally depends on its Form 5500 filing status and the applicable participant-count rules—not whether its plan year ends December 31.

For defined contribution plans, the relevant participant count now focuses on participants and beneficiaries who have account balances at the beginning of the plan year, rather than everyone merely eligible to participate.

So an off-cycle plan sponsor should answer two separate questions:

Do we have an audit requirement?

And, if so:

When must that audit be completed so our Form 5500 can be filed on time?

Those are related questions, but they aren’t the same question.

When Should a Fiscal-Year 401(k) Audit Start?

The Form 5500 deadline should be the end of your audit timeline—not the beginning of it. The safest approach is to work backward from your actual filing deadline and establish the audit schedule well in advance.

If an independent audit is required, the auditor’s report generally accompanies the Form 5500 filing. That means the audit needs to be substantially complete before your filing deadline arrives.

There isn’t one audit-start date that works for every plan. The amount of time needed depends on factors such as plan size, the availability of records, the complexity of the plan and whether testing identifies issues requiring follow-up.

A practical timeline should allow time for:

Data collection: Your team may need to gather census information, payroll data, contribution records, recordkeeper reports, participant files and plan documents.

Audit testing: Your auditor will perform required procedures and may select participants or transactions for additional documentation.

Follow-up questions: Missing information and discrepancies often require responses from HR, payroll, the recordkeeper, TPA or other providers.

Resolving exceptions: Eligibility errors, contribution discrepancies, participant loans, distributions, compensation issues and other findings can require additional investigation.

Final review and issuance: The audit team still needs time to complete its review and issue the auditor’s report before the Form 5500 is finalized.

Example: A 401(k) Plan With a March 31 Year-End

Suppose your plan year ends March 31.

Your normal Form 5500 deadline is generally October 31.

With a timely Form 5558 extension, the deadline can generally be extended to January 15.

That does not mean January should become your target date for beginning the audit.

Instead, the plan sponsor and auditor should establish a timeline that leaves enough time before the applicable deadline to obtain records, complete testing and address any unexpected issues.

In other words:

March 31 plan year-end → October 31 normal deadline → January 15 extended deadline

Your audit calendar should be built backward from whichever filing deadline applies.

Example: A 401(k) Plan With a June 30 Year-End

A June 30 plan operates on a very different schedule.

Its Form 5500 would generally be due January 31 of the following year.

With a timely Form 5558 extension, the deadline would generally move to April 15.

For that employer, traditional summer 401(k) “audit season” may be largely irrelevant. Its audit preparation and testing may instead take place during the fall and winter.

That is why a plan with a non-calendar-year end should work with an auditor that maintains employee benefit plan audit capabilities throughout the year.

What Can Delay an Off-Cycle 401(k) Audit?

Having a different deadline doesn’t protect a plan from the same issues that slow down calendar-year audits.

Some common audit roadblocks include:

  • Missing or inaccurate census information
  • Eligibility and plan entry-date errors
  • Incorrect employer contribution or match calculations
  • Incorrect application of the plan’s compensation definition
  • Late participant contributions
  • Participant loan problems
  • Vesting or forfeiture discrepancies
  • Distribution documentation issues
  • Differences between payroll and recordkeeper data
  • Delays obtaining information from outside service providers

One of the advantages of starting early is having time to resolve those issues before they become filing-deadline problems.

What If Your Fiscal-Year Form 5500 Deadline Falls on a Weekend or Holiday?

There is an important exception to the dates in the chart.

If a Form 5500 filing deadline falls on a Saturday, Sunday or federal holiday, the filing can generally be made on the next day that is not a Saturday, Sunday or federal holiday. U.S. Department of Labor

That means sponsors should verify the precise deadline for the applicable filing year rather than relying solely on a recurring calendar.

The month-by-month chart is best used as a planning guide.

What About Short Plan Years?

A short plan year can occur when, for example, a plan changes its plan-year end or terminates and completes the distribution of plan assets.

The general Form 5500 timing rule still applies: the filing is generally due by the last day of the seventh calendar month after the short plan year ends, subject to an authorized extension. U.S. Department of Labor

Short plan years can introduce additional reporting and audit considerations, so sponsors should coordinate the filing timeline with their TPA, auditor and other advisors rather than assuming the normal annual schedule applies.

Don’t Build Your Audit Around October 15 If October 15 Isn’t Your Deadline

October 15 gets enormous attention in the 401(k) industry because it is the extended Form 5500 deadline for many calendar-year plans.

But it’s only one deadline.

For a non-calendar-year plan, your filing date could fall in January, April, June, November—or virtually any other month.

Your audit calendar should therefore begin with three questions:

When does our 401(k) plan year end?

When is our Form 5500 due?

When does the audit need to begin to comfortably meet that deadline?

Once those dates are established, your organization can build a recurring compliance calendar around its own plan rather than someone else’s audit season.

Looking for a 401(k) Auditor for a Fiscal-Year Plan?

PriceKubecka performs employee benefit plan audits throughout the year for both calendar-year and non-calendar-year 401(k) plans.

Our employee benefit plan specialists perform more than 400 EBP audits annually, including 401(k), 403(b) and ESOP audits. Because employee benefit plan auditing is a significant part of our audit practice, we can work with plan sponsors whose audit and Form 5500 deadlines fall throughout the year.

Whether your plan ends March 31, June 30, September 30 or another date, your audit should be built around your plan year and your deadline.

[Talk to a 401(k) Auditor]

Example: A 401(k) Plan With a March 31 Year-End

Suppose your plan year ends March 31. Your normal Form 5500 deadline is generally October 31.

With a timely Form 5558 extension, the deadline can generally be extended to January 15.

That does not mean January should become your target date for beginning the audit.

Instead, the plan sponsor and auditor should establish a timeline that leaves enough time before the applicable deadline to obtain records, complete testing and address any unexpected issues.

In other words:

March 31 plan year-end → October 31 normal deadline → January 15 extended deadline

Example: A 401(k) Plan With a June 30 Year-End

A June 30 plan operates on a very different schedule.

This plan’s Form 5500 would generally be due January 31 of the following year. With a timely Form 5558 extension, the deadline would generally move to April 15.

For that employer, traditional summer 401(k) “audit season” may be largely irrelevant. Its audit prep and testing may instead take place during the fall and winter.

That’s why a plan with a non-calendar-year end should work with an auditor that maintains EBP audit capabilities throughout the year.

In other words:

June 30 plan year-end → January 31 normal deadline → April 15 extended deadline

What Can Delay an Off-Cycle 401(k) Audit?

Having a different deadline doesn’t protect a plan from the same issues that slow down calendar-year audits. Some common audit roadblocks include:

  • Missing or inaccurate census information
  • Eligibility and plan entry-date errors
  • Incorrect employer contribution or match calculations
  • Incorrect application of the plan’s compensation definition
  • Late participant contributions
  • Participant loan problems
  • Vesting or forfeiture discrepancies
  • Distribution documentation issues
  • Differences between payroll and recordkeeper data
  • Delays obtaining information from outside service providers

One of the advantages of starting early is having time to resolve those issues before they become filing-deadline problems.

What If Your Fiscal-Year Form 5500 Deadline Falls on a Weekend or Holiday?

There is an important exception to the dates in the chart. If a Form 5500 filing deadline falls on a Saturday, Sunday or federal holiday, the filing can generally be made on the next day that is not a Saturday, Sunday, or federal holiday. 

That means sponsors should verify the precise deadline for the applicable filing year rather than relying solely on a recurring calendar. The month-by-month chart is best used as a planning guide.

What About Short Plan Years?

A short plan year can occur when, for example, a plan changes its plan-year end or terminates and completes the distribution of plan assets.

In this case, the general Form 5500 timing rule still applies: the filing is generally due by the last day of the seventh calendar month after the short plan year ends, subject to an authorized extension. 

Short plan years can introduce additional reporting and audit considerations, so sponsors should coordinate the filing timeline with their TPA, auditor, and other advisors rather than assuming the normal annual schedule applies.

Don’t Build Your Audit Around October 15 if it isn’t Your Deadline

October 15 gets enormous attention in the 401(k) industry because it is the extended Form 5500 deadline for many calendar-year plans. But it’s only one deadline.

For a non-calendar-year plan, your filing date could fall in January, April, June, November—or virtually any other month. Your audit calendar should therefore begin with three questions:

  1. When does our 401(k) plan year end?
  2. When is our Form 5500 due?
  3. When does the audit need to begin to comfortably meet that deadline?

Once those dates are established, your organization can build a recurring compliance calendar around its own plan rather than someone else’s audit season.

Looking for a 401(k) Auditor for a Fiscal-Year Plan?

PriceKubecka performs employee benefit plan audits throughout the year for both calendar-year and non-calendar-year 401(k) plans.

Our EBP specialists perform more than 400 audits annually, including 401(k), 403(b) and ESOP audits. Because employee benefit plan auditing is a significant part of our audit practice, we can work with plan sponsors whose audit and Form 5500 deadlines fall throughout the year.

Whether your plan ends March 31, June 30, September 30, or another date, your audit should be built around your plan year and your deadline.

[Talk to a 401(k) Auditor]

Related Articles