SECURE 2.0 Compliance Is Moving Forward. Is Your EBP Auditor Ready?

The SECURE 2.0 Act introduced some of the most significant retirement plan changes in recent years, affecting plan operations, administration, documentation, and compliance oversight. For employers that sponsor retirement plans, the challenge is not only understanding what changed, but also demonstrating that required provisions are being applied correctly as they take effect.

That distinction matters now. Many SECURE 2.0 provisions require operational compliance before formal plan document amendments are due. For many nongovernmental qualified retirement plans and nongovernmental 403(b) plans”, the formal amendment deadline is December 31, 2026, but plan sponsors are generally expected to operate in accordance with applicable SECURE 2.0 provisions based on their effective dates. That means plan operations, payroll processes, participant data, and administrative decisions may already be part of the audit conversation.

This creates a more nuanced audit environment. Plan sponsors do not need an auditor who functions as a pre-audit coach or last-minute reviewer. They need an auditor with the technical knowledge to understand how applicable SECURE 2.0 provisions may affect audit evidence, documentation, and plan operations.

.

Operational Compliance and Plan Amendments Are Not the Same

One of the most important SECURE 2.0 considerations for plan sponsors is the difference between plan document compliance and operational compliance.

Plan document compliance focuses on whether the written plan is formally amended to reflect required law changes by the applicable deadline. Operational compliance focuses on whether the plan is being administered in accordance with those changes as they become effective.

Those two tracks often move on different timelines. A plan may not yet have adopted its formal SECURE 2.0 amendment, but it may still need to operate as though certain provisions are already in effect. For audit purposes, the issue is not simply whether the plan document has been updated. It is whether the plan sponsor can show that current operations align with applicable requirements and that the documentation supports the way the plan is being administered.

Where SECURE 2.0 Is Increasing Audit Complexity

Several SECURE 2.0 provisions may create additional audit considerations because they rely heavily on accurate data, consistent administration, and coordination between internal teams and service providers.

Automatic enrollment and automatic escalation
New automatic enrollment requirements for certain new 401(k) and 403(b) plans established after December 29, 2022, place greater emphasis on eligibility tracking, payroll setup, opt-out procedures, deferral processing, and participant communication. Errors in these areas may affect whether eligible participants are enrolled timely and whether contributions are processed correctly.

Long-term part-time employee eligibility
Expanded eligibility rules for long-term part-time employees require plan sponsors to track service over multiple years and determine when employees become eligible to participate. This can increase the importance of accurate census data, payroll records, and coordination with third-party administrators.

Catch-up contribution changes
Beginning generally in 2026, SECURE 2.0’s catch-up contribution provisions, including Roth treatment requirements for certain higher earners, may add payroll and reporting complexity. Sponsors should be able to show how affected participants are identified and how contribution treatment is applied.

Plan amendment timing and documentation
Delayed amendment deadlines do not eliminate the need for operational support. Plan sponsors should maintain documentation showing how SECURE 2.0 provisions were evaluated, when operational changes were made, who was involved, and how those changes were communicated to service providers and internal stakeholders.

Why Self-Correction Timing Matters

SECURE 2.0 expanded certain self-correction opportunities under EPCRS, while recent DOL updates to the Voluntary Fiduciary Correction Program have also made timely issue identification more important in specific fiduciary correction contexts. These opportunities often depend on acting within the required time frame and maintaining appropriate documentation.

One area receiving renewed attention is the timely remittance of participant contributions and loan repayments. Under the Department of Labor’s updated Voluntary Fiduciary Correction Program, certain eligible delinquent participant contributions and loan repayments may be self-corrected if specific requirements are met, including applicable lost earnings limits of $1,000 or less, EBSA notice requirements, and remittance of delinquent amounts within 180 calendar days from the date they were withheld from participants’ pay or received by the employer.

That timing matters because an employee benefit plan audit often occurs months after year-end. If a remittance issue is not identified until the audit process, the sponsor may already be outside the available self-correction window. This does not mean sponsors should wait for an auditor to find errors. Rather, it reinforces the need for internal monitoring, payroll controls, and regular coordination with service providers throughout the year.

Because correction methods and plan compliance requirements can vary based on the facts and circumstances, plan sponsors should coordinate with ERISA counsel, plan advisors, third-party administrators, recordkeepers, and payroll providers when evaluating potential issues and determining the appropriate response. For auditors, the focus is on whether the plan sponsor has appropriate documentation, whether corrections were handled in accordance with available guidance, and whether the plan’s processes support consistent compliance.

Why EBP Audit Experience Matters

SECURE 2.0 does not turn the audit into a compliance cleanup exercise. Instead, it increases the importance of working with an auditor who understands how the law affects plan operations, audit evidence, and documentation.

An experienced EBP auditor can evaluate whether documentation supports the plan’s administration, whether operational changes are consistently reflected across payroll and participant records, and whether the sponsor has maintained sufficient support to demonstrate compliance. This is especially important when formal plan amendments are still pending, but operational requirements are already in effect.

The right auditor should understand the technical requirements, ask informed questions, and evaluate the plan fairly in accordance with the law, available guidance, and the sponsor’s documentation. That level of knowledge can support a more efficient audit process and give plan sponsors greater confidence that SECURE 2.0 issues are being reviewed appropriately.

Strengthening Documentation Before the Audit

Plan sponsors can help support the audit process by maintaining documentation throughout the year. This may include:

• Records showing how SECURE 2.0 provisions were evaluated and implemented
• Payroll and census data used to determine eligibility and contribution treatment
• Communications with third-party administrators, recordkeepers, payroll providers, and legal counsel
• Documentation of participant notices, opt-out procedures, and enrollment processes
• Evidence of internal reviews related to contribution timing, eligibility, and data accuracy
• Support for any corrections made, including timing, methodology, and management approval

This documentation helps show not only what decisions were made, but why they were reasonable and how they were applied.

Why Now?

The timing matters because SECURE 2.0 provisions are already affecting plan administration, while many formal plan amendments may still be pending. Operational compliance and document compliance are related, but they are not the same.

As the 2026 amendment deadline approaches for many plans, sponsors should be prepared to show how current operations align with applicable SECURE 2.0 requirements. They should also consider whether their auditor has the dedicated employee benefit plan experience needed to evaluate those issues accurately and understand how operational requirements, documentation, and amendment timing interact.

Positioning Your Plan for a Stronger Audit

While SECURE 2.0 has added new layers of complexity to employee benefit plan audits, it has also created an opportunity for plan sponsors to strengthen documentation, improve coordination, and better support compliance. The priority is not to identify problems at the last minute. It is to make sure the plan’s operations, records, and audit evidence clearly support what the sponsor is already doing.

Contact your CRI advisor to discuss how SECURE 2.0 may affect your employee benefit plan audit and whether your current documentation is positioned to support a clear, well-informed review. CRI’s dedicated Employee Benefit Plan Audit team brings year-round experience and technical knowledge to help plan sponsors navigate evolving audit considerations with confidence.