Planning for an Employee Benefit Plan Audit

Transcription

1 Planning for an EBP Audit Planning for an Employee Benefit Plan Audit Presented by: Jennifer Amato, CPA Eric Ernest, CPA, FCCA Audit Principal Assurance Director SC&H Group, LLC McConnell & Jones LLP 1 Planning for an EBP Audit Speaker information Jennifer Amato, CPA Audit Principal SC&H Group, LLC With over 13 years of experience as a Certified Public Accountant, Jennifer (Jen) Amato offers a depth of understanding and knowledge that proves invaluable to her clients. Jen s primary focuses are employee benefit plan audits and process improvement. She serves businesses in a diverse set of industries, including retail, distribution, manufacturing, not for profit, and professional services. As the leader of the employee benefit plan audit practice, Jen has been an integral part of expanding the practice over her time at SC&H. Over the past 11 years, the practice has grown from approximately 20 employee benefit plan clients to over 125 plans. Jen takes an active role in both the business and accounting communities. She is an active member of the Maryland Association of Certified Public Accountants (MACPA) and the American Institute of Certified Public Accountants (AICPA).Shecurrentlyservesastreasurerontheboard of directors for the Chesapeake Human Resources Association. A Summa Cum Laude graduate of Stevenson University, Jen holds a B.S. in Computer Accounting and is a Certified Public Accountant licensed to practice in Maryland. Jen was named as a SmartCPA in 2010 by Smart CEO Magazine. 2 1

2 Planning for an EBP Audit Speaker information Eric Ernest, CPA, FCCA Assurance Director McConnell & Jones LLP Eric Ernest is one of our dedicated Employee Benefit Plan Assurance Audit members. With more than 20 years of accounting and financial audit experience in a variety of industries, he has planned, supervised, and managed numerous financial statement and compliance audits of governmental, non profit, and private sector clients and employee benefit plans. Eric mentions how he finds the "ever evolving role of accountants and the possibilities of permeating into every aspect of business and commerce an exciting concept." Eric is committed to taking the time to understand our clients' needs and concerns. He ensures that our team performs effectively with efficiency and provides the highest quality. In addition, Eric ensures continued assistance to our clients in complying with their fiduciary and regulatory responsibilities in filing their financial statements within prescribed timelines. Eric boasts: "We keep clear open lines of communication at every level in the client organization and throughout the process. This ensures that issues, if any, are recognized, communicated and resolved and there are no surprises at the end. We pride ourselves on the ability of the team to respond to situations and issues in a timely manner". 3 Planning for an EBP Audit Agenda Components of an Audit Understanding the Plan and its Environment Fraud Assessment (and real life examples of fraud) Risk Assessment SSAE 16 (formerly SAS70 reports) Sampling Changes in Vendors 4 2

3 Planning for an EBP Audit Components of an Audit Planning Financial/Investment Related Tax Related Compliance Testing Financial Reporting 5 Planning for an EBP Audit Understanding the Plan and its Environment Plan Players Plan Sponsor Plan administrator Custodian Recordkeeper/TPA (third party administrator) Trustee internal or institutional Participants 6 3

4 Planning for an EBP Audit Understanding the Plan and its Environment Definitions of Participants Active participants Any individuals who are currently in employment covered by a plan and who are earning or retaining credited service under a plan; Any individuals who are currently below the integration level in a plan that is integrated with social security, and/or eligible to have the employer make payments to a 401(k) or Section 125 arrangements (participants only have to be eligible for the plan, not necessarily participating in a 401(k) or Section 125 arrangement); Any non-vested individuals who are earning or retaining credited service under a plan. Active participants does not include non-vested former employees who have incurred the break in service period specified in the plan. Inactive participants Any individuals who are retired or separated from employment covered by a plan and who are receiving or entitled to receive benefits. The term inactive participants does not include any individual to whom an insurance company has made an irrevocable commitment to pay all the benefits to which the individual is entitled under the plan. Deceased participants Any deceased individuals who have beneficiaries who are receiving or are entitled to receive benefits under the plan. The term deceased participants does not include any individual to whom an insurance company has made an irrevocable commitment to pay all the benefits to which the beneficiaries of the individual are entitled under the plan. Source Form 5500 Instructions 7 Planning for an EBP Audit Understanding the Plan and its Environment Planning Meetings What to Discuss? Scope of Work to be Performed Current year events industry related (EBSA, DOL, IRS) Current year events plan related Plan amendments Plan merger/divestiture Change in service provider Fraud Discussion Brainstorming (discussion - examples of fraud) Who to interview? What journal entries should we look at? Audit Risks linking to audit procedures Testing procedures sampling techniques Reliance on SSAE 16 (SOC1) reports 8 4

5 Planning for an EBP Audit Understanding the Plan and its Environment Initial Audits New Auditee s Client Acceptance Process Independence DOL vs. AICPA standards Planning Understanding of Internal Control Unique Issues Opening balance considerations Investments Participant data Compile vs. audit of prior year balances 403(b) Plans - no governance in prior years 9 Planning for an EBP Audit Understanding the Plan and its Environment Initial Audits New Clients Client Acceptance Process Independence DOL vs. AICPA standards AU Section 315 Communications Between Predecessor and Successor Auditors Planning Educating the client on your firm s audit approach and procedures Review of permanent file documentation Understanding of internal control Determining the extent of reliance on predecessor auditors 10 5

6 Planning for an EBP Audit Fraud Assessment In accordance with AU 316 (formerly Statement on Auditing Standards No. 99, Consideration of Fraud in a Financial Statement Audit), it is auditor s responsibility to consider the risk of material misstatement due to fraud and to design our audit to provide reasonable assurance of detecting fraud that could result in the financial statements being materially misstated. AU 316 establishes standards and provides guidance in fulfilling that responsibility, as it relates to fraud, in an audit of financial statements conducted in accordance with auditing standards generally accepted in the United States of America (GAAS). AU 316 requires that we gather information necessary to assess the risk of fraud in the engagement. Discussion among engagement personnel regarding the risks of material misstatement due to fraud and inquiring of the Plan s personnel are two required steps in the process. Once the potential risks are identified, we will update the audit procedures as necessary to assist in our detection of fraud. If any indicators come to our attention that would cause us to believe an increased risk of financial statement fraud exists, we will immediately bring these matters to your attention. 11 Planning for an EBP Audit Fraud Assessment Three Conditions Generally Present When Fraud Exists: Incentive/pressure to perpetrate fraud Opportunity to carry out fraud Attitude/rationalization to justify fraudulent action Current Economic Conditions Unexpected losses Employee furloughs and layoffs (plans sponsors and administrators) Financing and liquidity issues Curtailed or suspended benefits Source: AICPA Fraud Risk Factors Specific to Employee Benefit Plans 12 6

7 Planning for an EBP Audit Fraud Assessment Interview Tips Who to interview Plan administrator Third party administrator Trustee Member of the Plan Committee Plan participant How to conduct your interviews Explain the purpose of the interview do not be intimidating or confrontational Do not ask simple yes or no questions; ask the question so that it requires a more in depth answer Think on your feet Observe body language Be a good listener 13 Planning for an EBP Audit Fraud Assessment Eligibility Examples of Fraud in EBP s A person was offered a job but never actually started the job. The plan sponsor entered the person as an employee into the HR system, enrolled the person into the plan and started issuing paychecks with deductions for contributions to the plan. Trustee of a small plan created a fictitious employee in the census data and made employer contributions for the employee. The trustee then took out loans against the balance. An HR director at a participating employer misrepresented dates of hire to the multiemployer pension fund so that employees would qualify for past service for which they were not eligible. A participant faked his own death to get money out of the plan. Contributions An HR employee, who assisted with payroll, diverted both p/r taxes and plan contributions into their personal bank account and then left the country. This employee was also responsible for reconciling the payroll bank accounts. An HR Director made changes to the employer contributions that were to be allocated to the individual participants before submitting the file to the TPA. Source AICPA Employee Benefit Plan Audit Quality Center - Employee Benefit Plan Fraud Examples 14 7

8 Planning for an EBP Audit Fraud Assessment A company failed to remit all employee deferrals for a period of time. The company was having financial difficulties and then went bankrupt. Loans Examples of Fraud in EBP s (cont d) An HR employee figured out how to process loans against participant accounts. To cover it up, she manually prepared participant statements to hide the loans. The plan used a small TPA that sent the participant statements to the sponsor for mailing. An employee in the benefits department who prepared the wire submission diverted loan repayments to their paycheck. An employee requested a loan electronically and falsely stated that they were using the proceeds for the purchase of a home which would entitle them to use a longer amortization period. A controller wrote bogus loan checks on behalf of employees; completed bogus promissory notes, cashed them and used the dollars for his own personal accounts. Source AICPA Employee Benefit Plan Audit Quality Center - Employee Benefit Plan Fraud Examples 15 Planning for an EBP Audit Fraud Assessment Examples of Fraud in EBP s (cont d) Distributions A husband and wife scheme to falsify doctor s records to receive a hardship distribution. An HR manager requested distributions for terminated employees that had been gone for two or more years. The HR manager was successful three times for over $10,000 in funds. A bank custodian employee skimmed money from distributions. The employee was able to cover the shortfall by having the ability to response to client questions and transfer amounts between client accounts. Claim checks for a health and welfare plan were diverted and used to credit a fraudulent check that was used to by a car. Other A plan administrator used forfeitures to pay personal credit card expenses. A DB plan administrator paid himself by setting a fake DBA and approving invoices. Source AICPA Employee Benefit Plan Audit Quality Center - Employee Benefit Plan Fraud Examples 16 8

9 Planning for an EBP Audit Risk Assessment Items to consider when determining risk assessment for employee benefit plan audits: State of the economy State of the Plan Sponsor Plan governance Plan changes; amendments Change in vendors Competence of third party vendors Prior year misstatements 17 Planning for an EBP Audit SSAE 16 Reports What are they? Service Organization Control reports are internal control reports on the services provided by a service organization. Type 1 or Type 2 reports may issued. Type 2 reports are required for use in the EBP audit. What they are not? Certification of a plan s net assets available for benefits Audit report on the user controls Why is such a report needed for an EBP audit? Such reports assist the auditor in reducing the amount of testing necessary on certain controls tested within the SSAE 16 - SOC 1 report 18 9

10 Planning for an EBP Audit SSAE 16 Reports Which vendors need to provide such reports? Payroll providers Third party administrators Claims adjudicators (for self insured h/w plans) Any vendor involved with participant level information and transactions When can I use a bridge letter? A bridge letter is confirmation from the service provider that no changes have occurred within the internal control structure of the organization since the date of the most recent SSAE 16 SOC 1 report. Bridge letters bridge the gap between the plan year end and the year of the most recent service organization audit report. Bridge letters should not cover a period of more than 3 months. 19 Planning for an EBP Audit SSAE 16 Reports SSAE 16 (SOC1) Reports REDUCE but do not ELIMINATE testing!! 20 10

11 Planning for an EBP Audit Sampling Samples to be treated as test of controls/attribute testing Eligibility Employee and employer contributions Participant level investment income Participant level investment allocation Samples to be selected based upon a coverage/sampling approach Rollover contributions Participant loans Distributions, including hardships Claims paid (only applicable for health and welfare plans) 21 Planning for an EBP Audit Sampling Samples should include a combination of all employee groups. This sampling technique will assist with uncovering issues that may be contained within a unique group of employees. Newly eligible to participate Newly participating Continuing to participate Participants employed in specific employee groups or divisions Rehire/transfer between employee groups Terminated in the current plan year 22 11

12 Planning for an EBP Audit Vendor Changes How does the change affect the audit? Transfers in/out plan and participant level testing Fund to fund conversion or re-election by participants? Is the prior service provider responsive? Does the new service provider have a Type II SSAE 16 report? TEST AS EARLY AS POSSIBLE 23 Planning for an EBP Audit Questions QUESTIONS 24 12

13 Planning for an EBP Audit Contact Information Jennifer Amato, CPA SC&H Group, LLC Audit Principal Eric Ernest McConnell & Jones LLP Assurance Director