401(k) Plan Administration Guide: Fiduciary Duties, Compliance, and Common Mistakes

6/5/2026

Most HR professionals inherit a 401(k) plan rather than choosing one, and most discover only later that administering it carries personal fiduciary responsibility. The plan document sits in a drawer, the recordkeeper handles the mechanics, and nobody is entirely sure who is a fiduciary until something goes wrong.

Quick answer: Anyone who exercises discretionary authority over plan management or assets, or who provides investment advice for a fee, is a fiduciary — regardless of title. Fiduciaries owe duties of loyalty, prudence, diversification, and adherence to plan documents, and they can be held personally liable for breaches. HR's operational role centers on eligibility, deferral processing, deposit timing, and following the plan document exactly as written.

Who Is a Fiduciary

Fiduciary status under ERISA is functional, not titular. You are a fiduciary if you:

• Exercise discretionary authority or control over plan management
• Exercise authority or control over plan assets
• Render investment advice for a fee
• Have discretionary authority or responsibility in plan administration

This commonly captures the named plan administrator, members of the retirement or investment committee, executives who select or monitor service providers, and HR professionals who make discretionary decisions about eligibility, hardship distributions, or QDRO determinations.

It generally does not capture staff performing purely ministerial functions under established procedures — entering enrollment data, applying a formula, processing a form. The dividing line is discretion.

The Four Fiduciary Duties

Duty	What It Requires
Loyalty	Act solely in the interest of participants and beneficiaries, for the exclusive purpose of providing benefits and defraying reasonable plan expenses
Prudence	Act with the care, skill, prudence, and diligence of a prudent person familiar with such matters — a standard measured by process, not outcome
Diversification	Diversify plan investments to minimize the risk of large losses, unless clearly prudent not to
Plan document adherence	Follow the terms of the plan document, to the extent consistent with ERISA

The prudence duty is the one HR most often misunderstands. It does not require good investment results. It requires a documented, deliberate process — which is why committee minutes are among the most important documents a plan sponsor maintains.

HR's Operational Responsibilities

1. Eligibility tracking

Apply the plan's eligibility conditions exactly — age, service, hours, and entry dates. Long-term part-time employee rules require tracking part-time employees who would not otherwise qualify under an hours-based condition. Failing to enroll an eligible employee generates a missed-deferral-opportunity correction that the employer funds.

2. Enrollment and deferral elections

Process elections and changes according to the plan's timing rules. If the plan has automatic enrollment, the notice and default deferral mechanics are prescriptive and time-sensitive.

3. Deferral deposit timing — the highest-risk item

Participant deferrals and loan repayments must be deposited as of the earliest date they can reasonably be segregated from the employer's general assets. Small plans have a safe harbor tied to the seventh business day; large plans do not, and the operative standard in practice is the earliest date the employer has demonstrated it can deposit.

This is the most frequently cited operational failure in DOL investigations. The critical trap: if you once deposited in two days, two days becomes your demonstrated capability, and a later seven-day deposit is a late deposit. Late deposits are a prohibited transaction requiring correction, lost earnings, and excise tax reporting.

4. Compensation definition

Apply the plan's definition of compensation exactly. Plans differ on whether bonuses, commissions, overtime, severance, and fringe benefits are included. Using the wrong compensation base is one of the most common and most pervasive operational errors, because it silently affects every contribution calculation.

5. Loans, hardships, and distributions

Verify eligibility against plan terms, apply limits correctly, and document the basis for every discretionary determination. Loans that default or exceed limits become deemed distributions with tax consequences for the participant.

6. Notices and disclosures

Summary Plan Description, Summary Annual Report, participant fee disclosures, safe harbor notices, automatic enrollment notices, and blackout notices each have their own content and timing requirements. Build a compliance calendar rather than tracking them individually.

7. Testing and filings

Coordinate annual nondiscrimination testing (ADP/ACP), top-heavy testing, coverage testing, and the Form 5500 filing. Provide clean census data — most testing failures trace back to bad census data, not plan design.

The Ten Most Common Operational Errors

1. Late deferral deposits. The most cited failure. Establish a documented, consistent deposit timeline and never beat it occasionally.
2. Wrong compensation definition. Bonuses excluded when the plan includes them, or the reverse.
3. Failure to enroll eligible employees. Especially rehires, part-time employees crossing hour thresholds, and employees changing classification.
4. Missed automatic enrollment. Triggers a corrective contribution funded by the employer.
5. Incorrect vesting. Miscounting years of service, particularly across rehires and acquisitions.
6. Exceeding annual limits. Deferral, catch-up, and annual additions limits — especially for employees who changed jobs mid-year and deferred at both employers.
7. Improper hardship approvals. Approving distributions not permitted by the plan document.
8. Loan administration failures. Missed repayments during leave, exceeding limits, or failing to suspend and re-amortize correctly.
9. Failure to follow the plan document. Doing what seems reasonable rather than what the document says is a fiduciary breach even when the outcome is fair.
10. Missing or stale committee documentation. No minutes means no evidence of a prudent process.

Correction Programs

The IRS and DOL both maintain voluntary correction programs, and self-correction is generally far cheaper than agency discovery.

• IRS Employee Plans Compliance Resolution System (EPCRS) — self-correction for many operational failures, with a voluntary correction submission route for others.
• DOL Voluntary Fiduciary Correction Program (VFCP) — used for late deposits and certain other fiduciary breaches, with relief from excise tax in defined circumstances.
• Delinquent Filer Voluntary Compliance Program (DFVCP) — for late Form 5500 filings, at dramatically reduced penalties.

The consistent lesson: self-identify and correct. Errors found in a DOL or IRS examination cost multiples of the same errors corrected voluntarily.

Fiduciary Protection Practices

• Form a retirement plan committee with a written charter, defined membership, and quarterly meetings.
• Keep minutes. Document what was reviewed, what was discussed, and why decisions were made. Minutes are the primary evidence of a prudent process.
• Maintain an investment policy statement and actually follow it.
• Benchmark fees periodically and document the review. Excessive-fee litigation is the dominant category of ERISA claims against plan sponsors.
• Monitor service providers — delegating a function does not delegate the duty to monitor.
• Train committee members on fiduciary responsibilities. Many do not know they are fiduciaries.
• Secure fiduciary liability insurance — distinct from the ERISA fidelity bond, which is required but protects the plan against dishonesty rather than protecting fiduciaries.
• Keep the plan document current with required amendments and restatements.

Frequently Asked Questions

Is HR personally liable for 401(k) errors?

Individuals who exercise discretionary authority can be held personally liable for fiduciary breaches. Staff performing purely ministerial functions under established procedures generally are not fiduciaries.

How quickly must deferrals be deposited?

As of the earliest date they can reasonably be segregated from general assets. Small plans have a seven-business-day safe harbor. The practical standard is your own demonstrated capability — set a consistent timeline and hold to it.

What if we discover an error from three years ago?

Correct it through the applicable IRS or DOL program. Self-correction is generally available for many operational failures and is far less expensive than agency discovery.

Does using a third-party administrator eliminate fiduciary responsibility?

No. The duty to prudently select and monitor service providers remains with the plan sponsor, and most TPAs are not fiduciaries under their service agreements.

Who signs the Form 5500?

The plan administrator, which for most plans is the employer. Signing carries responsibility for the accuracy of the filing.

Build Real Plan Administration Competence

The gap between "we have a 401(k)" and "we administer a 401(k) correctly" is filled by knowing the plan document, the deposit rules, and the correction programs.

The 401(k) Training & Certification Program covers fiduciary duties, eligibility, contributions, testing, distributions, and corrections. Professionals with broader retirement responsibilities should explore the retirement plan certification programs and the Certified TPA designation.

👉 See the 401(k) Training & Certification Program →

Additional resources: 401(k) Plan Administration FAQ | Retirement Plan Administration FAQs | Glossary of Retirement Plan Terms | DOL Employee Benefits Security Administration