Doug:
From Rea & Associates studio. This is unsuitable, a management financial services podcast for entrepreneurs, tenured business leaders, and others who are ready to look beyond the suit-and-tie culture for meaningful, measurable results. I'm Doug Houser. On this weekly podcast, thought leaders and business professionals break down complicated and mundane topics and give you the tips and insight you actually need to grow as a leader, while helping your organization to grow and thrive. If you haven't already, hit the subscribe button so you don't miss future episodes. And if you want access to even more information, show notes, and exclusive content, please visit our website at www.reacpa.com/podcast and sign up for updates.
If your business manages an employee benefit plan, there are some pretty big changes coming down the pipeline that you need to know about, and they go by the name of SAS 136. Kim Veal, a leader on Rea's ERISA team, is here to walk us through what's changing, how it will impact your business, and how you can avoid complications during the audit process by preparing for SAS 136 today. Welcome back to unsuitable, Kim.
Kim:
Thanks for having me again.
Doug:
Always glad to have you on to talk all things ERISA. We've titled this episode Sassy ERISA Audit Changes.
Kim:
Man.
Doug:
I'm not sure who came up with that - if it was you or.
Kim:
It was not.
Doug:
Maybe it was our wonderful practice growth team, so kudos to them. I like that. But yeah. Speaking of, talk a little bit about an employee benefit plan, in terms of where these changes might impact a company. What are those cutoffs? Are there different tiers or levels? All those kinds of things. To me, it's so complex. So maybe let's start with square one.
Kim:
So SAS 136, the SAS stands for statements on auditing standards. So it isn't necessarily changed that go to a client's process around them. This isn't law-changing, regarding what to do with your plan. But it has to impact those of us who come into audit plans. So most likely, if your plan has 120 participants in it, and it's subject to ERISA, you're going to be subject to this new SAS when your auditors come out to audit you.
Now, originally, we would already be applying that right now, because right now we are working on our main season year-end 2020 plans and their audits. But the loveliness that was the year of 2020 and COVID, we got a little bit of a delay. So that's why you're hearing about it now, because next year, everybody who has one of those audits, 100%, their auditors are going to be applying these new standards. So that's kind of where it came from, at least the regulation itself.
Doug:
Yes.
Kim:
Ultimately what they wanted, the Department of Labor came out back in like 2015 and said, "We want to enhance the quality of these audits. And we want to bring some transparency to some of our reporting and what the scope of our work is like." So that's why this is coming about. That's why auditors are now talking about it, because it changes a lot on our side. That's the biggest thing, like yes. Kind of like, okay, yeah. What am I supposed to do as a plan sponsor? Because my auditors are the ones that have to apply these standards. I don't. But we want to make it clear that although yes, most of that is going to be on our end, our documentation, it's the quality of the audit work that we're performing.
Doug:
Gotcha.
Kim:
There are some things that we are going to be having to ask our clients to do, or at least be prepared for when we come around a year from now and start requesting work.
Doug:
Okay. Now before we get into that, let's take a step back. Now, for an employee benefit plan to need an audit, they have to have 100 or more employees. Correct?
Kim:
Right. So that's the baseline. There are some special rules. You know how the IRS likes to add in a few extra catches there.
Doug:
Always. Yes.
Kim:
So 100% technically, they give that 100 lines. If you're at 120, there are no more catches. So that's the idea. There's this 100 to 120 zone where you may or may not, but at 120, 100%, you're in the audit zone. So.
Doug:
Gotcha.
Kim:
Right.
Doug:
And companies should be aware of that because we're experiencing obviously strong economic growth right now. People are hiring like crazy. So certainly something to pay attention to.
Kim:
Right. And it is at the beginning of the year, too. So if in '21, you finally tripped that line. Because there could be a lot that is coming, your first year that would require an audit would be 2022.
Doug:
Okay.
Kim:
So you would only get to have your audit done under these new requirements. You'd never even know what we used to do before, but.
Doug:
Now that we've got that, let's dig into SAS 136 and its impact. What's changing? What are we required to do additionally now, that perhaps wasn't there before?
Kim:
Right. So for us on the auditing side, it's actually going to hit into our engagement acceptance area, our risk assessment area, how we communicate with management, and ultimately some of the procedures that we perform. So you can think of it. It's kind of a big overhaul, at least for us. And it all comes down to what we're documenting and how we're digging into it and how we approach some of the areas we're going to test. But our clients, when it comes to general information we're going to request from them when it comes to talking about personnel files or payroll records, that stuff's not going to change.
The biggest thing that I can think of for our clients in particular, in the management of these plans that were coming into audit, has to do with this switch in what everyone if they're familiar with what their audit is called, it's a limited scope audit. Normally in the auditing world, when we talk about limiting the scope of our procedures, that's a bad thing. Because it basically means someone is taking something off the table for us to review.
Doug:
Right.
Kim:
So that's what usually causes us to have a lot of caution. Now, the Department of Labor is the one who approved these types of audits. Because they're the ones who are requesting these audits to be part of the 5500 filings that plans have to do every single year. So they kind of get to set the rules. And basically what they've said is, for certain plans who can receive a certification letter over their assets that the plan is holding, of their completeness and accuracy of those reports. Your auditor does not have to test the value of those investments, where the transactions going through those investments, like gain and loss and dividends. And we get to take them completely off the table.
Well, as I said, the limited scope has a bad connotation. People hear that, and they kind of struggle it. So even though it's accepted in the DOL's mind, and it's accepted in the general market, they kind of started to get a little fuzzy about wanting to call it that. So they introduced a rebranding renaming of that type of audit and then added these extra procedures to it. Of course, they don't have a simple name anymore. They're now called Section 103(a)(3)(C) audits, which is just.
Doug:
Could they come up with anything? It sounds horrible, right?
Kim:
I've done a couple of presentations for auditing groups, like auditors. And you had to say it like three times over and over again.
Doug:
Geez.
Kim:
Because it's, yeah. They haven't come up with some, like the 103 audits or something like that. No. They have a [crosstalk 00:08:41].
Doug:
Yeah. We need a better acronym for that, you know?
Kim:
But they're basically coming out and telling management they have to take more responsibility for making that call, that you're going to be allowed to do this type of audit and evaluating that certification letter. So management has always been the one to pick. Yes, I'm going to have this limited scope audit. I've never had one where they've said, no, no, no, don't do the limited audit.
Doug:
Right.
Kim:
Do the full-blown one, when they've had the option. So it's kind of like, they've always selected that, but maybe they haven't spent any time looking at that certification letter and diving into who's issuing it and how it's written. And now they actually have to take responsibility for that. And we as auditors, instead of, hey, we got a copy of a certification letter and yeah, it's good. We have to ask ourselves whether or not management's process and their analysis of that letter is now appropriate.
Doug:
So that's certainly some more risk for a company, of course. So how do they sort of mitigate that risk? What new responsibilities do they have to go through this, say, higher level of evaluation here?
Kim:
So I like to say, they need to get comfortable with the letter as it sits for '20. So for 2020 audits right now, this is not necessarily the case, but the letter probably isn't going to change much. So if they've never looked at that letter in detail or never seen the report that it's attached to, other than maybe to pass it on to your auditing team, they need to pull it out. And they need to get familiar with it and get to know the entity that's associated with it because it could be the one they're used to name. Like hey, this is Velodyne or this is Treasure Mayor who might plan as Hellman. Or it could be some sort of underlying custodian because that parent isn't an allowable entity to issue certification in the first place. So if you've never read it, you need to get it out.
If you're working with auditors right now, because I mean, we are out in the field, we're going on fieldwork, we're available to talk you through some of this to help you get familiar with that and make a plan. Because when we come around to audit next year, the first probably letter that they're going to receive is our engagement letter, which is going to be a little bit different, because it's going to have to address the fact that management is now taking some of these responsibilities. You would hope by the time you got that letter, you had already done your analysis and already had it written up or approved by your governance board or the board of trustees, or your plan administrator has already worked through that. So if you have never done that before, right now is the time to get out and talk to your auditor and start establishing your timeline and your plan. Because those letters in the certification reports are going to come out probably in March or April.
If you've got a December year-end. They come out a few months after your end. They're ready. So you could pull that report, go through a nice little checklist. Your auditor can walk you through like, hey, is this an allowable entity to issue a certification? You know, things like they do. They limit. They are supposed to be like a trust company or an insurance company that's subject to routine examinations like a state or federal agency. So like, going through that and saying, "Oh, it is a trust company." It's not a brokerage firm. Because oftentimes, brokerage firms will make a statement that's similar.
Doug:
Yes.
Kim:
But it's not actually an allowable entity to be able to issue that certification. So if you see something you're like, yep, this is certified. And you tell us you can perform this audit and you haven't actually done that analysis and written it down and figured out that they are in fact just brokerage firms, you could end up on the wrong side of an examination. So your auditor can really be the key source to talk to right now, to help you work through how we look at it. Because we look for things like, does it name the plan? Simple things. Does it have the right timeframe in it?
Does it say the words complete and accurate? So they can help you come up with that checklist of what we would normally look for. So you can have like a one-piece piece of paper that's literally written up. You pull it out, go through that checklist. When you get the letter, attach it, sign it. Plan administrators, the person who signs it or ever takes the most responsibility for the plan at your entity, and just have that sitting there, just ready to go because it's one of the first things we'll ask for. And obviously, it allows you to go ahead and sign that type of engagement letter.
Doug:
Now I assume these changes were implemented to help further protect the employees that are a part of that benefit plan. Correct?
Kim:
Right. So there's part of that. And then it's part of this, again, improving the quality of the audit being performed and what it's going to tell us. So they want management to be cognizant of what audits and what's going on when someone comes out to audit them. So a lot of times, there are clients and management out there who kind of just write it off and say, "This audit has to happen. And yeah, we do the same thing. And yeah, they kind of look at stuff." And they might not even have been told or it's been a while since they thought about, hey, nobody is looking at the investment transactions themselves because of this nice little certification. And we've never asked ourselves, as management, whether or not that's okay. So if there is something wrong or it's not by the right entity, what if the auditor didn't catch it?
Doug:
Yeah.
Kim:
So having that extra check, that like management, hey, you have a responsibility for checking this. We'll come out, and yeah, we're going to follow up and we're going to look at what you did. And a lot of it would be stuff that maybe, as auditors, we would have applied ourselves. But in the end, management holds the bag.
Doug:
Yeah.
Kim:
So they're not performing some of these things to make sure that the audit that is required for the plan is being done in the right manner or under that right scope set.
Doug:
Yeah.
Kim:
Like this isn't as much of an impact as say, adding additional fidelity bond coverage or something to protect from fraud or things like that. But at the same time, it's that little boost in the quality of the audit being formed and some of the stuff that the management is doing on their end. So.
Doug:
Talk a little bit about, under ERISA, what an employee benefit plan audit looks like. For those that aren't familiar, what types of things really are we testing and verifying and all those types of things?
Kim:
Right. So, we have a lot of companies that maybe every year they, have a nice little review done for their corporate folks or even an audit done. And a lot of that has to do with verifying the financial information. When you move into an ERISA audit zone, it's a compliance-based audit. So again, these are being requested by the Department of Labor, and it has to do a lot more with processes and how well is management completing the requests from participants. So when we talked through participant data testing, that can encompass making sure accurate date information is being used or determining somebody's eligibility for the plan and letting them in on the right timeframe. That doesn't necessarily equate to a dollar amount inside the financial statements, but at the same time, if somebody is not being let in when they're allowed, it can be discrimination.
Doug:
Yep.
Kim:
And so, that's a lot more where the testing come from, is what did people want? What deferrals did they want? Are those being calculated correctly? When I asked for distribution, is it because I'm 59 and a half and that's an allowable in-service distribution? Or is it, I'm terminated and I'm taking the distribution? Or am I trying to take a distribution when I shouldn't be able to?
Doug:
Sure.
Kim:
At the same time, do you have the right to federal withholdings? Those are the types of things we're going to look into. It has to do with all of those types of requests, the enrollments, and the deferral rate changes. And what do we want? Am I taking a loan or a distribution?
Doug:
Yeah.
Kim:
It's in that zone. And a lot of that stuff has no direct dollar value on your financial statements, at least in the form of this limited scope now, or 103(a)(3)(C) audits where we don't dive into that investment detail. At the same time, could still have a dollar impact.
Doug:
Yeah.
Kim:
If you're not calculating something correctly. So it could impact this financial statement that way.
Doug:
And certainly, a lot of risk to the company if they're not following those proper processes and procedures.
Kim:
Right.
Doug:
Worst case scenario, right. Then the Department of Labor, say, comes in.
Kim:
Comes in and says, "Oh."
Doug:
Yeah. There's a complaint or something, or somebody catches something and then he could have big trouble there. Right?
Kim:
If you've never had an audit of your retirement plan done before, and you're coming up on having to do that, it's almost like you need to kick your HR department into gear. They tend to be a lot of the place where some of this stuff gets processed through, and maybe they don't have as much role in like a corporate review or a corporate audit. But in our world, that HR and the strengths of those processes and who's doing stuff there is the key to successful processing of our audit. But like a successful operating plan.
Doug:
Yeah, absolutely. So Kim, give us a couple of pointers for our owner-managed businesses out there. What should they be doing to prepare now for these coming changes?
Kim:
Right. The biggest thing, if you have an auditor, talk to them this year while you're going through the audit as it sits. Have them help you set that timeframe or some reminders on your calendar that you're going to be doing this, at least analysis of that certification letter. Talk to them about the entity that currently issues the certifications, that you're comfortable with it. Because again, as the management is going to sign off that you're good, you think this audit is appropriate. Your certification letter is solid, and the whole nine yards. So our biggest thing is to have them talk to us, work with us. It's a big part of probably some of our end of audit communications. When we sit down with management, we'll try and do that too. Because we want the most success, and we don't want it to feel like a bomb for them. Like hey, next year your engagement letter is completely different.
Doug:
Right.
Kim:
And it's telling you you're responsible for 20 new things or something like that. Because we outlined what's their responsibility and what's our responsibility. And when that shifts significantly, we want people to be aware of that before they get in there. So that's our biggest thing, is do that. Set some timeframes, and try and get that analysis done early so that when we start reaching out later in the spring or into the beginning of summer, even late into summer, you've already got it. So when we say, "Hey, how did you make this determination?" You're like, here. And just present us a nice little one-page thing. And here's the certification letter. And this is who signed off on it. This is our main board, or I'm the plan administrator and I did this analysis and took it on ourselves. So.
Doug:
Yeah. That's awesome. Yeah. Again, if I'm a business owner, I want to know. This is very helpful because I want to know where my risks lie, and I want to do, make sure everything I can to have the right processes and procedures in place to mitigate or eliminate those risks. So, best to have an expert like yourself involved for sure.
Kim:
Yeah. Yeah. You don't want to try and go this alone, but at the same time, we can set you up so that this is easy. Because there's a lot that we have to adjust on our end that you'll never see, potentially, as the plan administrator or management, just to get our audit documentation in line. But this is one of those areas that we want to set you up just to be ready. So.
Doug:
Absolutely. Yep. Good stuff. Well, thank you, Kim. And if you want more business tips and insight, or to hear previous episodes of unsuitable, visit our podcast page at www.reacpa.com/podcast. And while you're there, sign up for exclusive content and show notes. Thanks for listening to this week's show. Be sure to subscribe to unsuitable on Apple Podcasts, Google Podcasts, or wherever you're listening to us right now, including YouTube. I'm Doug Houser. Join us next week for another unsuitable interview with an industry professional.
Disclaimer:
The views expressed on unsuitable on Rea Radio are our own and do not necessarily reflect the views of Rea & Associates. The podcast is for informational and educational purposes only and is not intended to replace the professional advice you would receive elsewhere. Consult with a trusted advisor about your unique situation, so they can expertly guide you to the best solution for your specific circumstance.
