The SAS 136 employee benefit plan audit standard reshaped how auditors form opinions, what they put in writing, and what plan sponsors must do to support the engagement. Issued by the AICPA Auditing Standards Board, SAS No. 136 is titled “Forming an Opinion and Reporting on Financial Statements of Employee Benefit Plans Subject to ERISA.” It created a new AU-C section 703 and applies to audits of ERISA-covered retirement and welfare plans, including the 401(k) and pension plans that most plan sponsors administer.
If your plan crosses the 100-participant threshold and requires an annual audit, the way your auditor communicates with your governance team changed under this standard. Two areas matter most for sponsors: the expanded written communications, especially the concept of reportable findings, and the new acknowledgments your plan management must make in writing.
Quick answer: Under SAS 136, an employee benefit plan auditor must communicate reportable findings to those charged with governance in writing and on a timely basis. A reportable finding is any noncompliance or suspected noncompliance with laws or regulations, any finding the auditor judges significant and relevant to the governance team’s oversight of financial reporting, or any internal control deficiency the auditor believes merits management’s attention. Plan sponsors must also accept expanded written responsibilities, including a written acknowledgment of their duties when they elect an ERISA Section 103(a)(3)(C) audit.
What Did SAS 136 Change, and When Did It Take Effect?
SAS 136 is effective for ERISA plan financial statement audits for periods ending on or after December 15, 2021. The original effective date was one year earlier, but the AICPA issued SAS No. 141 to delay the effective dates of SAS Nos. 134 through 140, which moved the implementation date back by a year in response to the disruption of 2020.
The standard reframed the former “limited scope” audit as an ERISA Section 103(a)(3)(C) audit. This is the engagement where the plan administrator elects to exclude from the audit certain investment information that a qualified institution, such as a bank or insurance company, has certified as complete and accurate. The substance of the election is similar to the old limited scope audit, but the auditor’s report and the sponsor’s responsibilities are materially different.
Under the prior approach, an auditor performing a limited scope audit disclaimed an opinion on the financial statements as a whole. The Department of Labor had raised concerns for years that this structure correlated with weaker audit quality, with one DOL study finding major GAAS deficiencies in a large share of plan audits in areas unrelated to investments, such as contributions, participant data, and benefit payments. SAS 136 responds by replacing the blanket disclaimer with a defined two-part opinion and clearer reporting on what was and was not audited.
The new ERISA Section 103(a)(3)(C) report no longer reads as a disclaimer. Instead it provides an opinion on whether the information not covered by the certification is presented fairly, and an opinion on whether the certified investment information agrees to or is derived from the certification. That is a more useful report for a sponsor reviewing the plan and for the participants who rely on it.
The shift also reframes what the auditor is allowed to say about the work performed. Even when an administrator elects to exclude certified investment information, the auditor still tests the areas outside that certification and reports an opinion on them. A sponsor reading the report can see clearly which balances were audited and which rested on the qualified institution’s certification, rather than facing a single disclaimer that obscured the distinction.
Reportable Findings: What Will Plan Sponsors Now See in Writing?
The most visible change for governance teams is the expanded written communication of reportable findings. SAS 136 requires the auditor to communicate, in writing and on a timely basis, any matter that meets the definition of a reportable finding. This is broader and more formal than the conversations sponsors may have had with auditors in the past.
A reportable finding is a matter that is one or more of the following: an identified instance of noncompliance or suspected noncompliance with laws or regulations; a finding arising from the audit that, in the auditor’s professional judgment, is significant and relevant to those charged with governance in carrying out their oversight of the financial reporting process; or an indication of a deficiency in internal control that has not been communicated by other parties and that the auditor judges important enough to merit management’s attention.
The practical effect is that issues a sponsor might once have heard about informally now arrive in a written communication. Common examples in plan audits include late remittance of participant deferrals, eligibility errors where employees were enrolled too early or too late, incorrect application of the plan’s compensation definition, and missed or miscalculated employer matching contributions. When the auditor concludes one of these rises to a reportable finding, the governance team receives it in writing.
That written record changes the cadence of an audit. Findings no longer surface only in a closing meeting or a phone call; they are documented as the auditor identifies them and delivered on a timely basis, which gives the governance team room to respond during the engagement rather than after it. The timeliness requirement is as much a part of the standard as the written form itself.
This documentation creates a clearer record for plan fiduciaries. Receiving a reportable finding is not an accusation, but it is a signal that the governance team should investigate, correct where needed, and document its response. Many of these issues map directly to IRS and DOL correction programs, so a prompt, organized response can limit exposure. If your firm is reassessing how it handles these communications, our audit and assurance services team can help you build a repeatable process for tracking and resolving findings each cycle.
How Did Plan Sponsor Responsibilities Expand Under SAS 136?
SAS 136 did not only change what auditors do. It formalized what plan management must acknowledge and provide. These responsibilities now appear in the engagement letter and in the written representations management signs at the end of the audit.
Plan management must acknowledge in writing its responsibility to maintain a current plan instrument, including all amendments; to administer the plan and determine that transactions are presented in conformity with the plan’s provisions; to maintain sufficient records of participant accounts, benefits, and plan transactions; and to provide the auditor with a substantially complete draft Form 5500 prior to the dating of the auditor’s report. That last point is a meaningful sequencing change: the audit cannot be finalized until the auditor has reviewed a near-final 5500 for consistency with the audited financial statements.
The Form 5500 requirement deserves particular attention from sponsors who have historically prepared the filing late in the cycle. Because the auditor must read a substantially complete draft before dating the report, a sponsor who treats the 5500 as a last step risks delaying the entire engagement. Aligning the financial statement timeline with the 5500 preparation schedule keeps the two from working against each other.
When a sponsor elects an ERISA Section 103(a)(3)(C) audit, additional written responsibilities apply. Plan management must determine that the election is permissible, that the investment information is prepared and certified by a qualified institution, that the certification meets ERISA requirements, and that the certified information is appropriately measured, presented, and disclosed in the financial statements. The sponsor cannot simply defer this judgment to the auditor; it is management’s call, and management must acknowledge it in writing.
To prepare, governance teams should confirm who at the company is authorized to make the 103(a)(3)(C) election, obtain the certification from the recordkeeper or trustee early, and verify that the certifying party qualifies as a bank, similar institution, or insurance company subject to regulation. Building a clean handoff of plan documents, payroll records, and participant data also shortens the audit and reduces the chance of avoidable findings. Our assurance practice regularly walks sponsors through these acknowledgments before fieldwork begins so there are no surprises at sign-off.
How Should You Get Ready for Your Next Plan Audit?
Start by reviewing your engagement letter and last year’s required communications to confirm you understand the form your auditor uses for reportable findings. Knowing the format in advance helps your team route findings to the right people for correction. It also tells you whether last year’s findings were closed out, which is often the first thing an auditor revisits.
Tighten your internal controls around the areas auditors test most: timely deposit of employee deferrals, accurate eligibility and enrollment, correct compensation definitions, and proper vesting and distributions. Strong documentation in these areas reduces both findings and audit time. Coordinate early with your recordkeeper so the certification and supporting reports are ready when the audit starts.
Treat the certification itself as a control point, not a formality. Confirm each year that the institution providing it still qualifies and that the certification language meets ERISA requirements, because a defective certification can undermine the basis for the 103(a)(3)(C) election. Catching that before fieldwork avoids a scramble once the audit is underway.
Finally, treat any reportable finding as an action item with an owner and a due date. Document the root cause, the correction, and any filing through an IRS or DOL correction program. A disciplined response shows your fiduciary diligence and positions the plan for a cleaner audit the following year.
Frequently Asked Questions
What is a reportable finding under SAS 136?
A reportable finding is a matter the auditor must communicate in writing to those charged with governance. It covers noncompliance or suspected noncompliance with laws or regulations, findings the auditor considers significant and relevant to governance oversight of financial reporting, and internal control deficiencies the auditor believes merit management’s attention.
Did SAS 136 eliminate the limited scope audit?
No. SAS 136 renamed it the ERISA Section 103(a)(3)(C) audit and changed the reporting. Instead of a blanket disclaimer of opinion, the auditor now issues a two-part opinion that addresses both the information not covered by the certification and the certified investment information, giving sponsors and participants a more informative report.
When did SAS 136 become effective?
SAS 136 is effective for audits of ERISA plan financial statements for periods ending on or after December 15, 2021. The AICPA delayed the original date by one year through SAS No. 141, which adjusted the effective dates of SAS Nos. 134 through 140.
What new responsibilities do plan sponsors have under SAS 136?
Plan management must acknowledge in writing its duties to maintain the plan instrument, administer the plan, keep adequate records, and provide a substantially complete Form 5500 before the report is dated. When electing a Section 103(a)(3)(C) audit, management must also confirm in writing that the election is permissible and that the certification comes from a qualified institution and meets ERISA requirements.
