Compliance June 13, 2022

Understanding the IRS’ New Pre-Audit Letter Program

Attorneys say plan sponsors have a couple of strong incentives to identify and correct any compliance failures upon receiving a pre-audit letter under a new IRS program.

Reported by

At the beginning of June, the IRS announced a new pre-audit compliance program for retirement plans, under which its auditors will send a pre-audit letter to plan sponsors whose retirement plans have been selected for upcoming reviews.

Upon receiving such a letter, the plan sponsor has 90 days to identify and correct any compliance issues with their plans—and to notify the IRS of the corrective actions taken. Attorneys who have reviewed the terms of the pre-audit program say it presents plan sponsors with an important opportunity to self-correct issues in advance of their plan’s review.

For more stories like this, sign up for the PLANSPONSOR NEWSDash daily newsletter.

According to commentary shared by Peter Daines and R. Sterling Perkinson, attorneys with Kilpatrick Townsend, plan sponsors have “a couple of strong incentives” to take action to identify and correct any compliance failures upon receiving a pre-audit letter.

“The IRS’s announcement indicates that if a plan sponsor does not respond to the pre-audit letter within 90 days, it will move forward with scheduling an audit,” the pair explain. “But if a plan sponsor responds to the pre-audit letter, the IRS will assess whether to issue a closing letter or to conduct a limited or full scope audit.”

As Daines and Perkinson point out, the IRS has not actually provided guidelines as to how it will make this assessment, but it appears to the attorneys that plan sponsors will have some ability to avoid or limit a potential audit by responding to the pre-audit letter “in a way that demonstrates a commitment to voluntary compliance.”

“The IRS has indicated that it will assess sanctions for any compliance failures corrected under the pilot program (other than failures eligible for self-correction) based on the user fees for its Voluntary Correction Program (VCP), which currently has a maximum user fee of $3,500,” Daines and Perkinson explain. “VCP is not available to plan sponsors once they have received verbal or written notification of a pending audit.”

Ordinarily, the attorneys note, compliance issues discovered under audit, other than “insignificant” operational failures, are subject to sanctions under the IRS’ Audit Cap Program. The level of such sanctions will depend on the IRS’ assessment of the “nature, extent and severity of the failure.” According to the Kilpatrick Townsend attorneys, in any case, these sanctions tend to be significantly higher than VCP user fees.

“As a result, plan sponsors that receive a pre-audit letter should begin the process of assessing any compliance failures, taking any appropriate corrective actions, and preparing a summary of any compliance issues for the IRS,” they conclude.

Dannae Delano, a partner with the Wagner Law Group, shares a similar perspective regarding the pilot program. She notes that, under the pilot program, the IRS will send an initial letter to plan sponsors whose retirement plans have been selected for upcoming audits. This letter will explain that the plan has been identified for audit and that the sponsor has 90 days to identify and voluntarily correct any compliance issues with the plan and notify the IRS of the corrective actions taken.

“This is a welcome departure from the longtime voluntary correction principle that allowed voluntary correction only until the IRS had identified the plan for audit,” Delano says. “The IRS will evaluate whether to continue the program and/or include it in its EPCRS program at the end of the pilot program, the date of which wasn’t disclosed.”

Delano says the program, at least as described in the announcement, provides some powerful incentives to encourage plan sponsors to voluntarily comply in the 90 days following receipt of the initial letter. As noted by the Kilpatrick Townsend, the first of these is a potentially substantial reduction in the sanctions involved in the audit process.

“The announcement also indicates that if a plan sponsor responds to the initial letter, the IRS will determine whether to issue a closing letter or to conduct a limited or full scope audit,” she adds. “How it will make that determination has not been disclosed, but it appears that plan sponsors may have some ability to limit an impending audit or avoid an audit completely by responding to the initial letter in a way that demonstrates full compliance.”

According to Delano, plan sponsors that receive an initial letter should immediately contact their retirement plan advisers to begin the process of identifying compliance failures, taking any appropriate corrective actions and preparing a summary of the compliance issues and corrections made for the IRS.

“In addition, operational and plan document errors discovered by a plan sponsor should receive priority for timely correction to ensure any compliance issue can be resolved within 90 days of the receipt of an initial letter,” Delano concludes.

Compliance June 13, 2022

PSNC 2022: Plan Sponsor Cybersecurity Responsibilities

Experts discussed what procedures plan sponsors can put in place and how to encourage participants to do their part in keeping data and accounts secure.

Reported by

On the final day of the 2022 PLANSPONSOR National Conference in Orlando, a panel of experts discussed retirement plan cybersecurity, with the goal of steeling retirement industry professionals against the rapidly evolving threats they face.

The speakers included Larry Crocker, CEO of Fiduciary Consulting Group, Inc.; Beth Kushner, deputy director of administration for the New York City Deferred Compensation Plan; and Percy Lee, an associate at Ivins, Phillips & Barker. As the trio explained, there has been a clear increase in cybersecurity-related incidents involving retirement plans and related benefit offerings, raising the stakes for fiduciaries and the companies and plan participants they serve.

Never miss a story — sign up for PLANSPONSOR newsletters to keep up on the latest retirement plan benefits news.

“Over the past several years, we have all become more familiar with cybersecurity as a general concept, in part because many of us moved to remote-first work arrangements due to the pandemic,” Lee said. “As the level of awareness has increased, however, so has the size and complexity of the cybersecurity problem from the perspective of plan fiduciaries.”

As Kushner recounted, remote work was a blessing in that it allowed so many people to continue to get their jobs done, but it also meant the effort of keeping systems safe and secure got a lot more complicated. In New York City’s case, all remote connections must be established in an encrypted manner, and employees are constantly reminded about their role in keeping systems safe and secure. In fact, the city has run multiple simulated phishing campaigns in the interest of exposing potential vulnerability. If mistakes are made, targeted training is immediately provided to individual workers.  

As Lee and Crocker noted, the cybersecurity stakes are high. In the past few years, multiple recordkeepers and/or plan committees have been sued in the aftermath of fraudulent transactions or data breaches. In one well-publicized case against Abbott Laboratories, the plaintiff alleged that failures in website and call center protocols resulted in $245,000 in unauthorized distributions from the individual’s plan account. While the allegations directed specifically against Abbott Labs were eventually rejected by the district court ruling on the case, the recordkeeper later agreed to pay a settlement to resolve the matter.

“When it comes to cybersecurity and fiduciaries’ responsibilities, these issues haven’t been fully tested in the courts, but they have figured in settlements,” Lee said. “Something else we have seen in settlements in excessive fee cases is that plan sponsors will agree to forbid their recordkeeper from using plan data to cross-sell other services to individual participants.”

Crocker and Lee said they expect it will take some years before the basic question of whether plan data is to be defined as a plan asset under ERISA is resolved. In the meantime, it is probably smart for plan sponsors to behave as if this is the case, meaning they should strive to protect plan data in the same way they strive to protect plan assets. Regulatory action could also have an impact, they explained, as Congress has empowered the Department of Labor to set out the definition of plan assets via regulation.

Crocker and Lee emphasized the importance of the fiduciary process, meaning it is critical for plan fiduciaries to discuss and act on cybersecurity-related topics—activity which should be reflected in meeting records, service provider requests for proposal, contract negotiations, etc.

Asked to discuss what resources New York City has used to support its internal cybersecurity efforts, Kushner noted the significance of backup and collaboration.

“Like any plan sponsor, we strive to collaborate closely with our recordkeeper on cybersecurity,” she said. “I would say it is a true partnership, where we monitor which programs they have in place and what tracking and defensive work they are doing, and they bring best practices to the table on our behalf. Something new is that we have started incorporating specific cybersecurity policies into our contracts.”

Kushner said a key step forward has been the addition of regular cyber assessments run by the plan’s independent auditor’s own expert partner. One recommendation coming out of the audit, which New York City has implemented, was the hiring of a chief information security officer. The CISO is tasked with monitoring the retirement plan system’s moment-to-moment cybersecurity footing and ensuring it is always moving toward a more secure environment.

Ironically, cyberbreaches are often accomplished via relatively low-tech means, the panel noted. An unwitting employee might click on a malicious email, and from there, it’s off to the races. The panel also stressed the importance of putting multiple layers of defense and multiple security strategies in place.

“For example, if there are large withdrawals requested, the recordkeeper should be looking at this and there should be stops in place,” Kushner said. “For example, if there is a change in banking information filed on the same day as a large withdrawal request and a change of address request are made, this needs to be flagged and reviewed. Yes, it is a bit of an inconvenience at times, but we need to ensure we are protecting our people and their assets.”

«