Checklist · Employee Benefits

Running a Retirement Plan Committee: An ERISA Fiduciary Compliance Checklist

29 U.S.C. § 1102

Type
Checklist
Jurisdiction
National
Date
2025-04-21
Topic
Employee Benefits

A working compliance checklist for the people who actually run a retirement plan. Phases one through four stand the committee up: the charter, documented appointments and acceptances, the complete plan document stack, and the fiduciary training that establishes the committee knows what it is doing. Phases five through ten are the recurring investment work: the investment policy statement and whether to have one, the quarterly meeting structure and what minutes must record, investment review against appropriate benchmarks, the annual share class eligibility review, the QDIA and target date evaluation, and the advisor engagement including the difference between a Section 3(21) advisor and a Section 3(38) manager. Phases eleven through fifteen cover fees and operations: the recordkeeper benchmarking and RFP cycle, the written fee policy and expense allocation decision, the prohibited transaction screen after Cunningham v. Cornell, participant disclosure compliance, and the deferral deposit timing that is the most common finding in Department of Labor investigations. Phases sixteen through twenty cover cybersecurity diligence, bonding and fiduciary liability insurance and the difference between them, the annual compliance calendar, the correction programs, and extending the discipline to the health plan. A worked example runs a fictional plan through a first-year remediation.

Running a Retirement Plan Committee: An ERISA Fiduciary Compliance Checklist

Employee Benefits > Retirement and Health Plans | Published 21 April 2025 - Updated 2 June 2026 | UpLaw - uplaw.us

ERISA judges fiduciaries on process, not results. A committee that ran a careful, documented, periodic evaluation and picked a fund that lagged has satisfied the duty. A committee that picked a winner by accident has not. Everything in this checklist exists to produce a file that shows the first thing happened. When a complaint arrives, the minutes are the defense — and they are the only defense that can be built in advance.

Keywords: committee charter, IPS, share class review, benchmarking, RFP, revenue sharing, fee policy, QDIA, § 3(38), prohibited transactions, late deposits, fidelity bond, fiduciary liability insurance, EPCRS, VFCP

Work this as a program, not a project. Phases 1–4 are one-time setup. Phases 5–10 run quarterly or annually. Phases 11–20 are the operational and compliance layer.

The doctrinal treatment is in ERISA: A Comprehensive Guide to Plan Governance, Fiduciary Duty, and Benefit Claims. The narrative overview is The Prudence of a Plan Fiduciary: What Hughes v. Northwestern Actually Requires.

Our running example. Verity Instruments, Inc. (fictional): a $310 million 401(k) plan, 2,400 participants, retail share classes on eight funds, a proprietary target date suite from the recordkeeper, recordkeeping funded by revenue sharing at roughly $92 per participant, a committee that meets twice a year, and three-paragraph minutes.

Phase 1 — Stand up the committee

  • [ ] Adopt a written committee charter identifying members by position, not by name.
  • [ ] State the committee's scope of authority — investments, administration, or both — and what is reserved to the board or the sponsor.
  • [ ] Confirm the plan document properly delegates to the committee and that the committee is a named fiduciary or a validly appointed delegate. 29 U.S.C. § 1102.
  • [ ] Obtain a written appointment for each member from the appointing fiduciary.
  • [ ] Obtain a written acceptance from each member acknowledging fiduciary status.
  • [ ] Establish quorum, voting, and recusal rules.
  • [ ] Establish a removal and replacement procedure and use it when people change roles.

Why it matters, and the traps. Fiduciary status is functional under 29 U.S.C. § 1002(21)(A) — anyone exercising discretion is a fiduciary whether appointed or not. The charter does not create exposure; it organizes it and it establishes who was responsible for what.

Name members by position so the charter survives turnover. Committees that name individuals inevitably operate for years with a roster that does not match the document, and the mismatch is the first exhibit in a deposition.

The appointing fiduciary retains a duty to monitor appointees. That duty is discharged by periodic review, documented — not by having made the appointment once.

Phase 2 — Assemble the document stack

  • [ ] Current plan document and every amendment, with adoption evidence showing the amendment procedure was followed.
  • [ ] Current adoption agreement and, for prototype or volume submitter plans, the opinion or advisory letter.
  • [ ] Current summary plan description and every summary of material modifications.
  • [ ] Trust agreement and any custodial agreement.
  • [ ] Service agreements — recordkeeper, trustee, custodian, advisor, auditor, TPA — with fee schedules.
  • [ ] Investment policy statement, if one exists.
  • [ ] Last three years of Form 5500 filings with audit reports.
  • [ ] Fidelity bond and fiduciary liability policy.
  • [ ] Committee minutes for as far back as they exist.
  • [ ] Current 408(b)(2) service provider disclosures from every covered provider.

Why it matters, and the traps. The document reconciliation is unglamorous and it finds real problems: plans operating under a restated document that was never signed, amendments adopted by an officer without authority, and SPDs describing a match formula the plan stopped using in 2019. Operating contrary to the document is an independent breach under § 1104(a)(1)(D) and a qualification failure.

Phase 3 — Train the committee

  • [ ] Deliver fiduciary training at appointment and annually thereafter.
  • [ ] Cover: who is a fiduciary and why title does not matter; the four duties under 29 U.S.C. § 1104; the settlor-fiduciary distinction; prohibited transactions; and personal liability under § 1109.
  • [ ] Cover the settlor line concretely: plan design decisions (match level, eligibility, whether to have a plan) are business decisions; implementing them is fiduciary.
  • [ ] Cover the exclusive benefit rule and what to do when the company's interest and participants' interests diverge.
  • [ ] Record the training in the minutes, with the date, the presenter, and the topics.

Why it matters, and the traps. The prudence standard is the prudent expert standard — measured against a person "familiar with such matters." A plant manager on the committee is judged against that hypothetical person. Training plus qualified advisors is the answer, and the training only helps if it is documented.

Phase 4 — Decide the advisor structure

  • [ ] Determine whether the plan has a § 3(21) advisor (recommends; committee decides) or a § 3(38) investment manager (has discretion; committee selects and monitors). 29 U.S.C. § 1002(38); § 1105(d).
  • [ ] Obtain a written acknowledgment of fiduciary status from the advisor.
  • [ ] Confirm the advisor's registration, insurance, and conflicts disclosures.
  • [ ] Confirm the engagement letter matches what actually happens in meetings.
  • [ ] If § 3(38), confirm the appointment satisfies the statutory definition and is documented — the liability shift depends on it.

Why it matters, and the traps. Committees routinely believe they have a § 3(38) manager and have a § 3(21) advisor, or the reverse. The difference determines who is liable for the investment selection. Read the engagement letter, not the brochure.

A § 3(38) appointment does not eliminate the committee's duty — it narrows it to prudent selection and ongoing monitoring of the manager. That monitoring must still be documented.

Phase 5 — The investment policy statement

  • [ ] Decide whether to have an IPS. It is not required by statute.
  • [ ] If yes, state the asset class structure, selection criteria, monitoring criteria, and the watch list and removal process.
  • [ ] Draft removal criteria as considerations, not automatic triggers, unless the committee will actually follow them.
  • [ ] Review the IPS annually and amend it when practice diverges.
  • [ ] Confirm at every meeting that the committee is following it.

Why it matters, and the traps. An IPS is a standard the committee will be measured against. That is a feature if the committee follows it and the plaintiff's best exhibit if it does not. The classic failure: an IPS requiring removal after eight quarters of underperformance, in a plan that has held a twelve-quarter laggard.

If the committee will not follow hard triggers, write soft ones. Do not write a rule you intend to ignore.

Phase 6 — Meeting cadence and minutes

  • [ ] Meet at least quarterly. Twice a year is not defensible for a plan of any size.
  • [ ] Circulate the agenda and materials in advance, and retain them.
  • [ ] Record in the minutes, for each decision: what data was presented, what alternatives were considered, what the discussion was, and why the decision was made.
  • [ ] Record who attended, including advisors and guests, and any recusals.
  • [ ] Record no-action decisions and the reasons — "no change" without reasons is worse than nothing.
  • [ ] Approve minutes at the next meeting and retain them permanently.
  • [ ] Keep minutes factual. Do not record speculation, characterizations of participants, or informal opinions about vendors.

Why it matters, and the traps. "The committee reviewed performance and no action was taken" is not a defense; it is an admission that nothing happened. Three sentences of reasoning per decision is enough and it converts a losing case into a winning one.

Minutes are discoverable and will be read aloud. Write them accordingly — complete on process, disciplined on tone.

Phase 7 — Investment review

  • [ ] Review each option against an appropriate benchmark and peer group — same strategy, same style.
  • [ ] Review expense ratios against category medians.
  • [ ] Review manager tenure, style drift, capacity, and organizational changes.
  • [ ] Maintain a watch list with entry and exit criteria and a documented rationale for each name on it.
  • [ ] Document the remove-or-retain decision for every watch-list fund at every meeting.
  • [ ] Confirm the menu offers a broad range across asset classes without unnecessary duplication.
  • [ ] Apply the continuing duty to monitor — every fund on the menu is being re-selected by being left there. Tibble v. Edison International, 575 U.S. 523, 529 (2015).

Why it matters, and the traps. Hughes v. Northwestern University, 595 U.S. 170, 176–77 (2022), eliminated the defense that a menu containing cheap index options excuses expensive ones. Each option must independently satisfy the duty.

Benchmark comparability is where these disputes are decided. A complaint comparing an actively managed small-cap fund to a total market index fund is weak; a complaint comparing it to its own category median is strong. Build the comparison the same way the plaintiff will.

Phase 8 — Share class review

  • [ ] Annually, for every fund, determine the lowest-cost share class for which the plan is eligible.
  • [ ] Confirm eligibility thresholds against current plan assets — eligibility changes as the plan grows.
  • [ ] Where a higher-cost class is retained, document why — typically because revenue sharing offsets recordkeeping costs — with the arithmetic.
  • [ ] Evaluate collective investment trusts and separate accounts as lower-cost alternatives where available.
  • [ ] Document the conclusion in the minutes.

Why it matters, and the traps. Share class is the most common and most easily proved claim in fee litigation, because the comparison is exact — the identical portfolio at a lower price.

The revenue sharing offset is a legitimate answer and it must be documented contemporaneously. Reconstructing the economics for a deposition three years later does not work.

Phase 9 — QDIA and target date review

  • [ ] Confirm the QDIA satisfies 29 C.F.R. § 2550.404c-5 and that annual notices are delivered.
  • [ ] Evaluate the target date suite on glidepath, to-versus-through construction, underlying fund quality, and fees — against alternatives.
  • [ ] Confirm the suite was selected through an independent evaluation, not adopted because it came bundled.
  • [ ] Compare the participant demographics to the glidepath assumptions.
  • [ ] Document the evaluation and the alternatives considered.

Why it matters, and the traps. The QDIA is usually the largest single asset concentration in the plan and it is frequently the recordkeeper's proprietary product adopted by default. That combination — largest holding, affiliated product, no documented evaluation — is the highest-exposure item in most plans. It is Verity's.

Selecting the QDIA is a fiduciary act. § 404(c) protection does not extend to the selection of options; it protects only against the consequences of a participant's choice among prudently selected ones.

Phase 10 — Fee benchmarking and the RFP cycle

  • [ ] Determine total plan cost per participant, in dollars, all-in.
  • [ ] Separate investment expenses, recordkeeping and administration, and advisory fees.
  • [ ] Quantify revenue sharing received and how it is applied.
  • [ ] Benchmark recordkeeping against comparable plans by participant count, not by asset size.
  • [ ] Conduct a market check every three years — a full RFP, a benchmarking service report, or a documented advisor analysis.
  • [ ] Document the conclusion, not just the data.
  • [ ] Negotiate a fee cap or per-head fixed fee so cost does not scale with assets when the service does not.

Why it matters, and the traps. Recordkeeping is a per-participant service. Revenue sharing scales with assets. Over a decade of market appreciation, a reasonable arrangement becomes an unreasonable one with no one deciding anything. Verity's $92 per head against a peer median near $40 is the entire fee case.

There is no safe-harbor number. What is defensible is a documented periodic market comparison producing a written conclusion.

Phase 11 — Fee policy and expense allocation

  • [ ] Adopt a written fee policy: what expenses the plan pays, what the employer pays, and how plan-paid expenses are funded.
  • [ ] Decide and document whether administrative fees are allocated per capita or pro rata — this is itself a fiduciary decision affecting participants differently.
  • [ ] If revenue sharing is used, establish an ERISA budget or revenue-sharing account and document how residual amounts are applied.
  • [ ] Confirm settlor expenses (plan design, amendment decisions, corporate transaction analysis) are not paid from plan assets.
  • [ ] Review the policy annually.

Phase 12 — Prohibited transaction screen

  • [ ] Identify every party in interest transacting with the plan. 29 U.S.C. § 1002(14).
  • [ ] For each service arrangement, confirm the § 408(b)(2) conditions: necessary service, reasonable arrangement, reasonable compensation. 29 U.S.C. § 1108.
  • [ ] Confirm receipt of complete 408(b)(2) disclosures, including indirect compensation, from every covered provider.
  • [ ] Screen for self-dealing under § 1106(b) — affiliated products, float, and any compensation the fiduciary or an affiliate receives.
  • [ ] Document the reasonableness determination contemporaneously.
  • [ ] Screen for employer securities and real property limits.

Why it matters, and the traps. Cunningham v. Cornell University, 604 U.S. 88 (2025), held that § 408 exemptions are affirmative defenses. A plaintiff need only allege that the plan paid a service provider. That means every plan has the elements of a prohibited-transaction claim available on the pleadings, and the defense is the reasonableness record built in Phases 10 and 11. Build it before the complaint.

Phase 13 — Participant disclosures

  • [ ] Confirm annual participant fee disclosure under 29 C.F.R. § 2550.404a-5 and quarterly statements of actual charges.
  • [ ] Confirm benefit statements are timely.
  • [ ] Confirm SPD delivery to new participants within 90 days and on the required cycle.
  • [ ] Confirm SMMs for every material modification within 210 days after the plan year of the change.
  • [ ] Confirm QDIA notices, safe harbor notices, and automatic enrollment notices as applicable.
  • [ ] Confirm electronic delivery satisfies a valid safe harbor.
  • [ ] Establish a process for responding to document requests within 30 days — the penalty is up to $110 per day. 29 U.S.C. § 1132(c).

Phase 14 — Deferral deposits and payroll

  • [ ] Confirm elective deferrals and loan repayments are deposited as soon as they can reasonably be segregated from general assets.
  • [ ] Confirm whether the seven-business-day safe harbor applies — it is available only to plans with fewer than 100 participants.
  • [ ] Determine the plan's actual earliest date demonstrated by its own history; that becomes the standard the DOL applies.
  • [ ] Establish monitoring for exceptions and a correction procedure.
  • [ ] Correct late deposits through VFCP with lost earnings, and file Form 5330 excise tax where required.
  • [ ] Confirm compensation definitions in payroll match the plan document — the most common operational failure.

Why it matters, and the traps. Late deposits are the single most common finding in DOL investigations, and they are self-reported on Form 5500. The compensation-definition mismatch — bonuses, commissions, imputed income, or fringe benefits included or excluded inconsistently with the document — is the most common qualification failure and the most expensive to correct because it runs to every participant for every year.

Phase 15 — Cybersecurity diligence

  • [ ] Apply the DOL Employee Benefits Security Administration cybersecurity guidance — best practices for recordkeepers, tips for hiring service providers, and online security tips for participants.
  • [ ] Obtain and review each provider's security program documentation, audit results, and breach history.
  • [ ] Include security obligations, breach notification, audit rights, and liability allocation in service contracts.
  • [ ] Confirm participant authentication controls and account-takeover protections.
  • [ ] Confirm who bears the loss on a fraudulent distribution — this is a contract term and it is frequently unfavorable.
  • [ ] Reassess annually and document.

See Standing Up a Privacy Compliance Program: A Practical Checklist and Responding to a Data Breach: A Notification and Incident Response Checklist.

Phase 16 — Bonding and insurance

  • [ ] Confirm the ERISA fidelity bond covers every person handling plan funds at 10% of plan assets, minimum $1,000, maximum $500,000 — or $1 million if the plan holds employer securities. 29 U.S.C. § 1112.
  • [ ] Adjust the bond amount annually as assets grow.
  • [ ] Confirm separate fiduciary liability insurance exists, with adequate limits.
  • [ ] Review the fiduciary policy's exclusions, its treatment of settlement and defense costs, and whether it covers DOL investigations and correction program costs.
  • [ ] Confirm the sponsor's indemnification of committee members is documented and does not violate § 1110(a)'s bar on exculpatory provisions.

Why it matters, and the traps. The bond protects the plan against dishonesty. It does not protect fiduciaries against liability for breach. Sponsors conflate the two constantly and discover the difference when the demand letter arrives. See Tendering a Claim and Preserving Coverage: A Policyholder's Checklist.

Phase 17 — The annual compliance calendar

  • [ ] Nondiscrimination testing — ADP/ACP, top-heavy, coverage, and § 415 limits — with a plan for correcting failures.
  • [ ] Form 5500 filing with the independent audit for large plans.
  • [ ] Annual notices — safe harbor, QDIA, automatic enrollment, and fee disclosure.
  • [ ] Required minimum distributions and the SECURE 2.0 age changes.
  • [ ] Plan document restatement cycle and interim amendments, including SECURE 2.0 amendments.
  • [ ] Missing participants — apply the DOL's best practices and the PBGC or IRS programs as applicable.
  • [ ] Forfeiture account review: confirm the use matches the plan document and document the committee's consideration.

Why it matters, and the traps. The forfeiture item is new. A litigation wave beginning in 2023 alleges that applying forfeitures to reduce employer contributions rather than pay plan expenses breaches the duty of loyalty, even where the plan document permits it. District courts have divided sharply. Treat it as unsettled: confirm what the document says, confirm practice matches, and record that the committee considered the question.

Phase 18 — Corrections

  • [ ] Screen annually for operational failures — eligibility errors, compensation definition mismatches, missed deferrals, loan defaults, distribution errors.
  • [ ] Use EPCRS self-correction where available; SECURE 2.0 substantially expanded it for eligible inadvertent failures.
  • [ ] Use VCP for failures outside self-correction.
  • [ ] Use VFCP for fiduciary breaches, notably late deposits.
  • [ ] Use DFVCP for delinquent Form 5500s.
  • [ ] Document every correction, including the failure, the method, and the make-whole calculation.

Why it matters, and the traps. Voluntary correction is dramatically cheaper than examination. The programs generally require that correction begin before the plan is under audit, so speed matters.

Phase 19 — Records

  • [ ] Retain permanently: plan documents, amendments, trust agreements, determination and opinion letters, and committee minutes.
  • [ ] Retain for at least six years: Form 5500s and supporting records, participant disclosures, service agreements and fee disclosures, benchmarking and RFP files, and correction documentation.
  • [ ] Retain participant records as long as any benefit may be payable — effectively indefinitely.
  • [ ] Confirm the recordkeeper's retention obligations by contract and what happens to records on termination.

Phase 20 — Extend the discipline to the health plan

  • [ ] Establish a health plan fiduciary committee with the same charter and minute discipline.
  • [ ] Obtain and analyze CAA § 408(b)(2) fee disclosures from the TPA, PBM, and brokers.
  • [ ] Benchmark PBM and TPA arrangements, including rebate treatment and spread pricing.
  • [ ] Confirm the MHPAEA nonquantitative treatment limitation comparative analysis exists and is defensible — a leading DOL audit focus.
  • [ ] Confirm No Surprises Act compliance and machine-readable file publication.
  • [ ] Confirm COBRA notice content and timing — a recurring class action target.
  • [ ] Confirm HIPAA privacy and security compliance for the plan as a covered entity.

See HIPAA Compliance: A Practical Checklist and Healthcare Compliance: A Comprehensive Guide to HIPAA, Stark, and the Anti-Kickback Statute.

Why it matters, and the traps. Health plan committees are, in 2026, roughly where 401(k) committees were in 2008 — the fee disclosure infrastructure now exists and the first fiduciary suits over PBM arrangements have been filed. Sponsors who have professionalized the retirement committee and left the health plan to the broker have the exposure in the wrong place.

Worked example — Verity's first remediation year

Q1. Adopt the charter, appoint members by position, obtain written acceptances, deliver training, and reconcile the document stack. Discover that the 2021 restatement was never signed; correct through VCP.

Q2. Engage an independent advisor with a written § 3(21) acknowledgment. Adopt an IPS with soft removal criteria. Conduct the share class review: six of eight funds are eligible for institutional classes; the revenue sharing offset is documented and the funds are converted with a rebate account established for the recordkeeping shortfall.

Q3. Run a full recordkeeping RFP. Three bids come in between $34 and $41 per participant against the current $92. Move to a hard-dollar per-head fee with a cap. Document the analysis and the conclusion.

Q4. Evaluate the proprietary target date suite against three alternatives on glidepath, underlying fund quality, and cost. Retain or replace — either is defensible; the evaluation is what matters. Complete the cybersecurity diligence, raise the fidelity bond from $250,000 to $500,000, and bind fiduciary liability coverage. Confirm forfeiture use matches the document and record the committee's consideration.

Result. Twelve months of quarterly minutes recording data, alternatives, discussion, and reasons. Verity's exposure has not been eliminated for the prior period — the Tibble duty to monitor makes the retail share classes a live claim for six years back — but the ongoing breach has stopped, the damages period has closed, and the file now shows a functioning process.

Related Documents

Guides

Articles

Checklists

Toolkits