Timely Remittance of Employee Contributions: 401(k) Audit Prep

Timely remittance of employee contributions to a 401(k) plan means depositing employee elective deferrals into the plan trust on the earliest date they can reasonably be segregated from the employer's general assets (29 CFR 2510.3-102). For most plans the operational deadline runs in days, not weeks — far inside the regulation's outer ceiling.

The bounds are well-defined. The IRS 401(k) Plan Fix-It Guide on timely deposit of employee elective deferrals states the rule cleanly: the DOL provides a 7-business-day safe harbor rule for employee contributions to 401(k) plans with fewer than 100 participants, and in no event can the deposit be later than the 15th business day of the following month. Plans with 100 or more participants have no equivalent safe harbor and live entirely under the "earliest reasonably segregable" standard.

The most consequential misreading of this rule is treating the 15-business-day figure as a permitted standard. It is not a safe harbor; it is the outer ceiling only. A sponsor whose actual prior pattern is 3 days cannot drift to 14 days and call it compliant. The earliest reasonable date is set by what the sponsor's own operations have demonstrated, not by the regulatory ceiling. That distinction is what produces most of the late employee elective deferral deposits findings auditors raise during EBP audit fieldwork.

When a deposit is in fact late, two things happen. The sponsor restores lost earnings to participant accounts for the period of the delay, and the late contribution is corrected through one of two DOL paths: the new VFCP Self-Correction Component (effective March 17, 2025), or a full Voluntary Fiduciary Correction Program application. The mechanics of choosing between those routes are worked through later in the article.

One distinction needs to be drawn before going further. The rule above governs employee elective deferrals — the dollars employees defer from their own pay into the plan, plus participant loan repayments. It does not govern employer matching contributions or profit-sharing contributions, which run on a different deadline (generally the corporate tax-return due date including extensions). Readers who arrived here trying to apply the 7-day or 15-day window to the employer side need to look elsewhere.

The rest of this article is structured around evidence and method rather than around restating the rule. The auditor's question during fieldwork is not "do you know the regulation" — every sponsor says yes — but "can you show, from your own records, that your remittance pattern is the earliest you reasonably could segregate." Answering that requires knowing which dates the auditor will line up, where each one lives in your records, how to set your own earliest reasonable date from prior payroll history, and how to document the variances that will inevitably occur. Those are the next sections.

Which Dates an EBP Auditor Lines Up — and Where Each One Lives

The "payroll date vs deposit date 401(k)" question is really four dates, not two. An EBP auditor testing remittance timing for a sample of pay periods reconstructs the same comparison for each one, drawing each date from a different system of record. Knowing the four artifacts and where they physically live is the difference between producing the schedule from your own records in an afternoon and reconstructing it from bank statements under audit deadline pressure.

The four dates, in the order they occur:

1. Payroll date. The date wages were paid to employees. Source: the payroll register from whichever payroll system runs the plan (the pay-date column, not the period-end date). This is the anchor against which every other date is measured.
2. Withholding / funds-segregated date. The moment elective deferrals come out of the employer's general assets and are identifiable as plan property. In most small plans this is the payroll-funding journal entry posted on or about the payroll date — the entry that moves cash out of the operating account into a payroll clearing or payable-to-trust account. In some operations it is the moment the ACH file for plan contributions is built and handed to the bank.
3. ACH or wire initiation date. The date the employer instructed the bank to send contribution funds to the trust. Source: the ACH origination report from the bank or the plan's payroll-bank portal; for wires, the wire confirmation. This is usually the most operationally meaningful "deposit date" in a sponsor's own records, because it is the last date the sponsor controls before the funds enter the recordkeeper's pipeline.
4. Trust-posted date. The date the recordkeeper actually credited the contribution to participant accounts inside the plan trust. Source: the recordkeeper contribution report, sometimes called a contribution detail report, or the trust-posting statement. Auditors will tie back to this report because it is the recordkeeper's record of what hit the plan.

The gap analysis matters as much as the dates themselves. The bank-debit-vs-trust-posted gap is normally 1 to 2 business days and is benign — auditors expect it because the recordkeeper has its own posting cycle and is not under the sponsor's control. The gap that drives findings is payroll-date to ACH-initiation, because that is the part of the timeline the sponsor does control, and that is the part that maps directly onto "earliest date reasonably segregated." A sponsor who wants to prevent findings concentrates effort on tightening the front of the chain, not the back.

Plan architecture changes how these dates relate. For plans with payroll integration to the recordkeeper — file-based feeds or API integration that pushes contribution data and triggers a corresponding ACH automatically — the funds-segregated date and ACH initiation date can collapse into a single moment. For plans where someone manually keys contribution amounts into a recordkeeper portal each pay period, then separately initiates the ACH, the gap exists by design. That gap is the lever to tighten when remittance timing has been inconsistent.

The schedule the auditor will request is a multi-period table covering the test sample: every payroll date, the deferral and loan-repayment amounts withheld, and the date funds were remitted to the trust. The phrasing in the request will look like the recurring AICPA wording — "payroll date, amounts withheld, date remitted." Sponsors who can produce this from their own records sit in materially different shape than those who have to reconstruct it from bank statements and recordkeeper extracts after the request lands.

Note that this timing review is parallel to, but distinct from, the amount tie-out the auditor performs in the same engagement. The amount tie-out asks whether the right dollars were deposited — the deferrals, the match, eligible compensation as the basis. The timing review asks whether those dollars arrived fast enough. Both are part of EBP audit work, both rely on the same underlying source documents, and a sponsor who has organized the timing schedule has usually also organized the inputs they need to reconcile payroll deferral amounts to the 401(k) recordkeeper report for the amount-side test.

How to Set Your Earliest Reasonably Segregable Date as a Method, Not a Slogan

Once you have the dates from Section 2 in front of you, the next question is the one auditors actually ask: what is the benchmark you will be measured against? The phrase "earliest date reasonably segregated" gets repeated in compliance memos and CPA articles as if it were a number the DOL hands out. It is not. The DOL does not supply the benchmark; it emerges from the plan sponsor's own prior remittance behavior, and the auditor establishes it by examining what the sponsor has actually been doing.

The method an auditor uses — and the one a sponsor should use on themselves before audit fieldwork begins — has four steps:

1. Pull a representative span of recent payroll runs. Six to twelve months of contributions is typical. Exclude obvious outliers from the analysis but keep them on the schedule with notes (a payroll-system migration week, a hurricane closure, a known leave); the goal is to surface the underlying normal-operations cadence, not to conceal disruptions.
2. Record, for each run, the payroll date and the date the contribution actually hit the trust. For sponsors who want to test against the part of the chain they control, the ACH initiation date is the more honest comparison; the trust-posted date adds the recordkeeper's posting cycle, which the sponsor does not control.
3. Identify the shortest gap that recurs under normal operations. Not a one-off compressed run when the office happened to be empty and the controller had time. The pattern that appears repeatedly across normal weeks. That gap is the plan's defensible benchmark.
4. Compare every other deposit in the test period against that benchmark. Deposits materially slower than the established pattern are the rows the auditor will flag and the rows that need a documented reason in the notes column.

The method's most common failure mode is mishandling disruptions. A genuine break in operations — a payroll-system migration, a natural disaster that closes the office, a key-person illness with no named backup, a change of plan recordkeeper — is treated as a temporary deviation, not as a reset of the benchmark to a slower number. Once normal operations resume, the prior fast cadence is the standard again. A sponsor whose normal pattern is 3 days does not get to permanently drift to 7 days because they had two slow weeks during a system cutover. The disruption explains a variance; it does not redefine "reasonable."

This is also where the IRS warning that "15 business days is not a safe harbor" does its real work. A small plan whose own demonstrated pattern is 3 days creates a 3-day expectation against itself. The 15-business-day outer bound has no operational role for that plan — citing it during audit when the historical pattern shows 3 days is exactly the move that turns a manageable conversation into a finding. The same logic limits the small-plan 7-business-day safe harbor 401(k) protection: the safe harbor protects small plans that consistently deposit within 7 business days. It does not authorize a small plan with a faster demonstrated pattern to slow down to the safe-harbor edge. Sponsors who have always been fast cannot cite the 7-day safe harbor to justify newly slower cadences.

The practical consequence is uncomfortable for sponsors who have always been efficient: their own historical performance has set the bar, and the bar is high. If genuine operational change is needed — a new approval workflow, a different banking arrangement, a different recordkeeper integration — that change should be introduced as a documented policy decision with a defensible rationale, with the rationale captured before the new cadence shows up in the data. Quiet drift across pay periods, with no contemporaneous record of why the cadence changed, is exactly the pattern auditors are trained to identify.

Building a Reusable Comparison Schedule You Can Hand the Auditor

The benchmark from Section 3 and the four dates from Section 2 only become an audit defense once they are sitting together in a single table the sponsor maintains as part of normal operations. A 401(k) contribution remittance schedule built into the monthly close is materially different from the same schedule rebuilt under audit pressure — both contain the same dates, but only the contemporaneous version carries the contemporaneous notes that make late deposits explicable.

The column layout that works, in order:

• Pay period or pay-period end date — anchors the row to a specific run.
• Payroll date — the date wages were paid; the start of the timing clock.
• Total elective deferrals withheld — and a separate column for participant loan repayments if the plan has them, since loan repayments are governed by the same timing rule.
• Funds segregated date — the payroll-funding entry that moves cash out of general assets, or the equivalent moment in the sponsor's actual workflow.
• ACH or wire initiated date — the date the bank was instructed to send funds.
• Trust posted date — from the recordkeeper contribution report.
• Days from payroll date to ACH initiation — the sponsor-controlled portion of the timeline.
• Days from payroll date to trust posting — the full cycle the auditor will reconstruct.
• Earliest reasonable benchmark for this plan — the figure established by the Section 3 method, repeated on every row so the comparison is always visible.
• Variance vs benchmark — positive numbers are late, blank or negative are on benchmark or earlier. The auditor reads this column first.
• Notes — any disruption, holiday weekend, system event, or process change that explains a variance. Empty is fine when there is no variance to explain.

The auditor's read pattern is predictable. They scan the variance column. Rows with no variance need no further attention. Rows with positive variance get traced back to source — the bank's ACH origination report and the recordkeeper contribution report — to confirm the dates are right and to check whether the notes column gives a documented reason. A schedule that allows the auditor to clear most rows in a single pass and focus questions on the small number of explained variances is a fundamentally different audit experience than one where every row needs to be reconstructed and re-explained.

The standing-control role of the schedule is the part that gets undervalued. When the schedule is updated each month as part of the close, the deposit dates are accurate because they were entered while the bank confirmation and recordkeeper extract were still fresh, and the notes were written while the disruption was still present in operational memory — the controller still remembers that the system was down on Tuesday morning, which approver was on leave that week, why the bank file was held. When the same schedule is built once a year in audit prep from bank statements and recordkeeper extracts, the dates are still right but the notes are reconstructed. Auditors recognize the difference. Reconstructed notes carry less weight than contemporaneous ones, and a schedule that arrives during fieldwork with notes that read as recently authored is itself a finding signal.

The data-collection reality is mundane: every column in the schedule pulls from a different source — payroll register for the payroll date and amounts, journal entries or the payroll-funding workflow for the segregated date, the bank ACH portal for the initiation date, the recordkeeper extract for the trust-posted date. Most teams build the first version of this schedule in Excel because that is where they can hold all four sources side by side and resolve discrepancies in one workspace. No specialized software is required to start.

This schedule sits inside a broader set of recurring controls a finance team maintains across the close cycle. The same discipline that produces an accurate remittance schedule each month also produces the bank reconciliations, accruals, and cross-system tie-outs that sit alongside it; treating the remittance schedule as part of the monthly payroll reconciliation process and checklist rather than as a standalone audit-prep task is what keeps it from quietly slipping into year-end-only territory.

What to Document When a Remittance Slipped

Documenting late employee contribution deposits is mostly about timing — not the timing of the deposit itself, but the timing of the memo. A note written the same week the slip occurred reads as operational evidence; the same facts captured eleven months later in audit prep read as reconstruction, and auditors weight them accordingly. The work in this section is what to write down at the moment a deposit slips, so the record exists when it matters.

A useful contemporaneous memo for a single late remittance captures five things:

• The payroll date affected and the amounts involved. The pay-period end, the pay date, and the elective-deferral total (with loan repayments separately if relevant). This is the row of the schedule the memo is explaining.
• The benchmark and the actual deposit date. The plan's earliest reasonable benchmark from Section 3, the date the deposit actually hit, and the resulting variance. The memo is documenting a specific gap, not a vague delay.
• The named root cause. The specific event that caused the disruption: a named system outage with the vendor's incident reference, a named person on unplanned leave with their normal role on the deposit workflow, a banking holiday that interacted with a specific ACH cutoff. Generic explanations like "operational delay" or "internal issue" do not help — they read as placeholders for missing information.
• When normal cadence resumed. The date the next deposit returned to the established benchmark, confirming the disruption was bounded rather than the start of a new pattern.
• The process change adopted in response. A named backup approver added, the deposit cutoff moved earlier in the day, an alert added to the payroll close, the recordkeeper portal access expanded. A memo that captures only the cause without capturing the corrective change reads as fatalism; the change is what tells the auditor the issue will not recur.

The kinds of disruptions auditors find credible are concrete and externally verifiable. A documented system outage with a vendor incident report. A payroll-software migration with a cutover date on the project plan. A named primary approver on unplanned medical leave when no backup approver was on file at the time. A change in banking arrangements with a specific cutover date. The common feature is that someone outside the sponsor's finance team can confirm the event happened.

The kinds of explanations that often produce findings on their own, regardless of the late deposit they are meant to explain, are the inverse: "we forgot," "the bank file failed and we did not notice for a week," "the controller was on vacation and no one else handles it," repeated slips with no shared root cause. These read as control failures rather than operational disruptions, and the auditor's response is typically a control-environment finding in addition to the timing finding.

The reason contemporaneous matters comes back to the audit-defense logic. A memo written the same week, sitting in the close-package folder with a creation timestamp on the file, supports the sponsor's narrative because it could not have been engineered to fit a finding raised eleven months later. A memo written in audit prep — even one that captures the same facts accurately — is what auditors expect to see when there is no real contemporaneous record, and it carries that weight in the workpaper. The marginal cost of writing the memo at the time is small; the marginal cost of writing it eleven months later, with imperfect memory, against an auditor who is reading skeptically, is large.

Place these memos inside the broader employer-side audit package. They sit alongside the plan document, adoption agreement, fidelity bond evidence, summary plan description, payroll registers for the test sample, the deferral-amount tie-out workpapers, and the other documents that constitute audit support for late 401(k) remittances and the rest of the engagement. A sponsor who treats the 401(k) audit package checklist for employer-side documents as a standing list rather than a year-end project tends to handle remittance-timing documentation the same way — one item on a longer recurring inventory, captured as it occurs, retrieved as needed, not assembled under deadline.

The 2026 Correction Tree — SCC First, Then Traditional VFCP

The DOL amended the Voluntary Fiduciary Correction Program by final rule effective March 17, 2025, adding a new Self-Correction Component (SCC) for late participant contributions. As of 2026 the correction landscape has two paths, not one: SCC is the streamlined path for the smaller, faster cases that meet specific gates; the traditional VFCP application remains the path for everything else. A sponsor confronting a late 401(k) contribution deposit needs to confirm which path applies before doing any of the corrective work, because the documentation requirements diverge.

SCC eligibility gates. All four must be met to use the VFCP self-correction component for late deposits:

• The transactions are late participant contributions — employee elective deferrals and/or participant loan repayments. SCC is limited to this transaction type; other prohibited transactions still require a traditional VFCP application.
• The full corrective deposit (the late contribution plus all required lost earnings) is made within 180 calendar days of the date the contributions should have been deposited.
• The total lost-earnings amount is no greater than $1,000, calculated using the DOL's online VFCP calculator.
• The plan is not currently under DOL investigation for the issue being corrected.

The procedural side of SCC is light. The sponsor uses the DOL's online VFCP calculator to compute the lost-earnings figure, then submits an SCC notice through the EBSA web portal. No formal application package is filed and no follow-up "no-action" letter is issued — the SCC notice is the entire interaction with EBSA for a qualifying correction.

When the situation falls outside SCC — lost earnings exceed $1,000, the cure window extends past 180 days, the plan is under investigation, or the issue is something other than late participant contributions — the sponsor uses the traditional VFCP application. That track requires the DOL Model Application, the VFCP calculator output, supporting documentation of the original transaction and the corrective deposit, and a wait for the no-action letter that closes the file. A traditional VFCP application is a more substantial package, but for situations the SCC does not cover it remains the only route to fiduciary closure.

The 401(k) lost earnings calculation late deposits requires is the same regardless of which track the sponsor ends up on. The DOL's online VFCP calculator is the accepted tool — it computes the greater of the actual investment results that would have been earned in the plan during the late period or the IRS underpayment rate applied across the same period. Sponsors should run the calculator regardless of which correction track they choose, both because the calculator output is the deposit amount and because the calculator output is the documentation the DOL expects to see in either an SCC notice or a VFCP application.

The reporting and excise-tax obligations attach to the underlying late deposit, not to the correction track. Two filings are typically in scope:

• Form 5500 reporting. The late deposit is reported on Schedule H, Line 4a (or Schedule I, Line 4a, for small plans that file the short form) for every year until the contribution and lost earnings are fully deposited. A late deposit that is corrected within the same plan year is reported in that year and that year only; one corrected over multiple years carries forward.
• Form 5330 excise tax. A prohibited-transaction excise tax applies under Internal Revenue Code Section 4975 on the use of plan assets by the employer during the late period, and it is reported on Form 5330. Filing under the traditional VFCP can provide relief from this excise tax for transactions that meet the program's specific relief conditions; SCC does not by itself eliminate the Form 5330 obligation in every case, so sponsors should confirm their excise-tax handling against the specific facts of their correction rather than assuming SCC clears it.

The 2026 framing point matters in practice. A sponsor reading guidance written before March 2025 — and there is a great deal of it still ranking in search results and still circulating inside CPA firm reference libraries — may not know SCC exists, and may default to a full VFCP application that is no longer required for a situation now covered by SCC. The first move on confirming a late deposit in 2026 is identifying which of the two paths applies, then doing the corrective work that path requires.

Why a Recurring Control Beats Repeat Corrections

The audit risk that produces findings is rarely a single late deposit. It is the pattern of inconsistent timing that emerges when remittance is treated as an ad hoc step at the end of payroll rather than as a fixed item on the close calendar. A sponsor whose deposits land within 1 to 2 business days of the payroll date every pay period, every month, has both a fast benchmark and a clean comparison schedule, and most never face a finding even when an isolated slip happens — because the slip is visibly an exception against a documented pattern of on-time behavior. Sponsors whose timing drifts unpredictably between 2 days and 9 days face a much harder conversation, even when no individual deposit is technically late, because the inconsistency itself is what auditors flag.

The structural moves that produce consistent timing are not complicated. They are operational discipline applied to a small number of decisions:

• A standing same-day or next-business-day remittance step on the payroll calendar. The deposit is treated as part of the payroll run rather than as a separate task that someone might forget. The cleanest configuration is one where running payroll triggers the contribution deposit automatically; the next-cleanest is one where the deposit is a named line item on the payroll close checklist, with a target completion date attached and an owner on the calendar.
• A named primary and a named backup approver for the deposit. Single-person dependence is the most common cause of late remittances in small plans. Naming the backup before the primary needs to be out — and giving the backup actual portal access and authorization, not just notional standing — is what keeps the cycle moving when someone is unexpectedly unavailable.
• The Section 4 comparison schedule maintained as part of the monthly close, not built once a year for audit. The schedule's primary value is as the visible record of the plan's actual remittance cadence, used internally before it is ever shown to an auditor.
• The Section 5 contemporaneous-memo discipline applied at the moment any variance occurs, not at year end. The memo is short — five fields, written the same week — but it is what turns a future timing question into a future timing answer.

Remittance timing does not sit alone. The same finance teams that maintain the comparison schedule also tie out the deferral and match amounts each year, tie the benefit plan census back to payroll and W-3 totals, and produce the same source documents — payroll register, ACH confirmation, recordkeeper contribution report — for multiple downstream uses across the close cycle. The same teams sit alongside the broader payroll compliance audit records and risks that get tested annually for unrelated reasons. Treating remittance timing as one piece of a recurring control set, rather than as a special-purpose project that gets attention when an audit is approaching, is what aligns it with how the rest of the controls are already maintained.

The practitioner-level point worth ending on: the sponsors who do well at audit are not the ones who never have a slip. They are the ones whose schedule, benchmark, and contemporaneous documentation together let them explain any variance in the same hour the auditor asks about it. The structural work is done before the auditor arrives. The audit itself is, at that point, a confirmation exercise rather than a discovery exercise.