Hacked! Is Your Retirement Plan at Risk for a Cyber Attack?

The Challenge Sometimes the most expensive retirement plan mistakes aren't dramatic. They're quiet. A former client of ours changed retirement plan providers following an acquisition several years prior. On the surface, everything appeared to be operating normally after moving to the new provider: employees continued making contributions to the plan, the plan’s investments remained in place, and the business continued its normal operations. Then another merger opportunity came along. As part of their due diligence process, the buyers reviewed the retirement plan. What they found immediately raised concerns. The annual Form 5500 filings required by ERISA law had not been submitted for several years. That also meant that none of the required compliance testing had been completed, and routine administrative responsibilities had also gone undone. What had started as a routine review quickly became a significant obstacle to completing the business sale. The Hidden Risk Many employers assume that once a retirement plan provider is hired, responsibility for the plan’s ongoing administration has effectively been transferred to that provider. But a plan sponsor is never completely relieved of its responsibility to oversee the plan. Even when outside providers are hired to handle filings, testing, recordkeeping, or other administrative functions, the employer still needs to make sure those responsibilities are being fulfilled. At the same time, there is an important difference between a provider that simply waits for the employer to supply information and one that actively works with the employer to make sure the plan stays on track. In this case, some of the missing work may have resulted from information requested by the provider that was never supplied by the employer. Technically, the employer still had a responsibility to provide that information and ensure the work was completed. But years of required administration should not quietly disappear into a communication gap. A proactive administrator follows up. If the usual contact isn’t responding, they escalate the issue. They make sure the appropriate people understand what is outstanding, why it matters, and what could happen if it isn’t addressed. Retirement plans require ongoing attention every year, including government filings, compliance testing, participant administration, documentation, and, when necessary, operational corrections. When those responsibilities are neglected, the consequences may not become obvious immediately. Instead, problems can accumulate quietly in the background until an IRS inquiry, Department of Labor investigation, audit, or—as in this case—a business transaction suddenly exposes years of unresolved issues. The prospective buyer made it clear that the retirement plan issues needed to be addressed before the transaction could move forward. The Rescue Knowing we had previously administered their plan, the current company leadership contacted us. Our first step was to determine the full scope of the problem. The timing made the situation particularly challenging. This wasn’t simply a retirement plan cleanup project. A business transaction was underway, and the company needed answers quickly. We assembled a team to determine the full scope of the problem and begin developing a path forward. Because we have deep experience with taking over neglected plans, we were able to separate perceived problems from actual compliance issues and reconstruct the plan's history. In reviewing the prior documentation, we identified exactly which administrative functions had been completed and which had been missed. We gathered historical payroll and participant data and developed a comprehensive correction strategy. Having access to historical plan records was especially important. Retirement plan problems may not surface until years after the underlying event, making good record retention critical. If you’re curious about how long to hold onto plan documentation, please see our blog post here . The final correction effort proved to be far more manageable than originally feared. Instead of allowing uncertainty around the retirement plan to continue hanging over the transaction, the employer now understood what had actually gone wrong, what needed to be corrected, and what steps were required to move forward. The Outcome With the correction efforts clarified and a clear roadmap in place, the employer was able to begin correcting the plan and continue moving toward its business transaction. More importantly, the company avoided entering the acquisition process with unresolved retirement plan liabilities hanging over or ruining the deal. The experience also reinforced an important lesson: Changing retirement plan providers doesn't eliminate administrative responsibilities. But it also demonstrated why the quality of the administrator matters. A good retirement plan administrator doesn’t simply process the information that arrives. They help make sure the information arrives in the first place. The Lesson: Oversight Is a Shared Process Employers ultimately have a responsibility to oversee their retirement plans, even when they hire professionals to handle much of the day-to-day work. That doesn’t mean the employer should have to become a retirement plan expert or personally track every filing deadline and compliance requirement. That’s one of the reasons experienced administration matters. A proactive provider should help keep the employer informed, identify missing information, follow up when something is outstanding, and escalate issues before a missed request becomes a missed filing—or several years of missed filings. The cost of failing to do so can extend well beyond an annual administration fee: Missed filings and potential penalties Incomplete compliance testing Corrective work Additional professional fees Delayed business transactions Uncertainty during mergers and acquisitions  By the time those costs appear, they can far exceed whatever might have been saved by choosing a lower-cost service model. That’s why retirement plan administration shouldn’t simply be viewed as paperwork. It should be viewed as an ongoing partnership in managing risk.

The Challenge A business owner came to us after receiving confusing news from their retirement plan actuary. Their Defined Benefit (Cash Balance) Plan had performed exceptionally well over several years; strong investment returns seemed to have created what’s called an overfunded Plan. While it seems like a positive name, an overfunded plan can create excessive and unexpected tax liabilities. So, their actuary recommended terminating the Plan by transferring the excess assets into the company's other Plan, a 401(k)/Profit Sharing Plan, before eventually closing both Plans, a lengthy and complicated process.