Employee Benefits Compliance (ERISA): Complete Guide

Employee benefits compliance is not limited to making sure a company offers the right benefits. It covers how those plans are designed, managed, documented, communicated, and monitored over time. For employers that sponsor retirement, health, or other benefit plans, small administrative decisions can create compliance obligations that are easy to overlook.

ERISA provides the framework for many of these responsibilities, including reporting and disclosure requirements, fiduciary duties, claims procedures, and rules around plan administration. For HR teams and plan sponsors looking to strengthen their understanding of these responsibilities, the Certified Compliance Management Professional certification can provide a useful foundation. This guide explains employee benefits compliance (ERISA) in practical terms, including the rules employers need to know, common compliance mistakes, and how to build a process that keeps plans on track.

What is employee benefits compliance (ERISA)?

Employee benefits compliance means making sure your retirement, health, and welfare plans follow the federal and state rules that govern them. For private employers in the US, the main rulebook is ERISA, the Employee Retirement Income Security Act of 1974.

What ERISA stands for and why it exists

Congress passed ERISA after pension plans failed and workers lost benefits they had counted on. The law doesn't force an employer to offer a plan. It sets the rules for any employer that chooses to, covering how plans are run, how money is handled, and what participants must be told.

Which plans ERISA covers

ERISA applies to most private-sector plans that provide benefits to employees. Common examples include:

• 401(k) and other defined contribution plans

• Traditional pension plans

• Group health, dental, and vision plans

• Life and disability insurance

• Some severance arrangements

Government plans and most church plans sit outside the law, and so do simple payroll practices like paying sick leave from general company funds. Whether a borderline arrangement counts as an ERISA plan often depends on how involved the employer is, so it's worth a quick legal check before assuming either way.

Why ERISA compliance matters for employers

The cost of getting it wrong is real money. The IRS can charge $250 per day for a late retirement plan return, capped at $150,000 per return. The DOL has its own civil penalties, which are adjusted every year, so check the current figures before budgeting for a cleanup.

Penalties aren't the only exposure. Participants can sue, and fiduciaries who breach their duties can be held personally responsible for restoring plan losses. A plan audit that turns up missing documents is a bad day. A lawsuit from employees is a worse one.

Benefits compliance has also become a technology problem. Plans run on recordkeeping platforms, payroll feeds, and electronic delivery of notices, so the people managing them do better when they understand how those systems work. Building that skill through tech certifications is a practical step for HR and compliance staff who want to stay ahead of the tools.

Core ERISA requirements every plan sponsor must know

ERISA is a paperwork law at heart, with fiduciary rules layered on top. Here is what sponsors answer for.

Reporting and disclosure

Plans report to the government on a fixed schedule and disclose to participants on another. Three documents carry most of the weight.

Form 5500 filing

Most plans file an annual Form 5500 electronically through the EFAST2 system. It's due on the last day of the seventh month after the plan year ends, which means July 31 for a calendar-year plan. Form 5558 buys an extra two and a half months. Small insured or unfunded health plans with fewer than 100 participants are generally exempt.

Summary plan description

The SPD explains in plain language what the plan offers, how to claim benefits, and what rights participants have. New participants get it within 90 days of joining. When the plan changes, a summary of material modifications follows, generally within 210 days after the end of the plan year in which the change was adopted.

Summary annual report

Plans that file a Form 5500 generally owe participants a short summary annual report within nine months after the plan year ends. It's a small document that gets forgotten often.

Fiduciary responsibilities

Anyone with discretion over plan management or plan assets is a fiduciary, and fiduciaries carry the heaviest duties in the law.

The prudent person standard

Fiduciaries must act with the care and skill of a knowledgeable person in the same position. In practice that means:

• Acting solely in the interest of participants and beneficiaries

• Paying only reasonable plan expenses

• Diversifying plan investments

• Following the plan documents, unless they conflict with the law

Who counts as a fiduciary

Fiduciary status comes from what a person does, not from a job title. The group usually includes:

• The employer or plan sponsor

• Trustees

• Members of an investment or benefits committee

• Anyone who picks and monitors service providers such as the recordkeeper

An outside advisor can qualify too. Naming fiduciaries in writing and recording what they decide closes a lot of gaps.

Participation, vesting, and funding standards

ERISA also sets floor rules for how plans treat employees:

• A plan generally can't require more than age 21 and one year of service for eligibility.

• Vesting schedules must meet minimum standards.

• Pension plans must follow minimum funding rules.

• Plan assets belong in a trust, separate from company money.

Claims and appeals procedures

Every plan needs a written process for handling benefit claims. A denial must explain the specific reasons and tell the participant how to appeal. Participants get at least 60 days to appeal in most plans and 180 days in group health plans, and decision deadlines run shorter for urgent medical care.

ERISA and health and welfare plans: where COBRA, HIPAA, and the ACA overlap

Health plans sit at the crossing of several laws. ERISA provides the base rules, COBRA lets employees keep group coverage after certain events (it applies to employers with 20 or more employees), HIPAA governs privacy and certain protections, and the ACA adds coverage standards and reporting. A single plan usually has to satisfy all of them at once.

The notice requirements alone can trip up a busy HR office. A late COBRA election notice can carry daily penalties of its own, on top of whatever ERISA exposure exists.

Notices only work if people read them. Benefits teams that pick up habits from a digital marketing course, like writing for a specific audience, testing subject lines, and checking open rates, can get better enrollment results and fewer missed notices. Clear communication is part of compliance, not decoration.

Common ERISA compliance mistakes (and how to avoid them)

Most violations are boring. They come from habits, not from bad intent.

• Filing Form 5500 late or not at all. Put the deadline on a shared calendar with two reminders and a named backup.

• Letting the SPD go stale. Review it every time the plan changes and reissue on schedule.

• Keeping thin fiduciary records. Take minutes at committee meetings and save investment reviews.

• Missing participant notices. List every required notice with an owner and a date.

• Skipping vendor oversight. Review recordkeeper and advisor fees at least once a year.

• Running the plan differently from the plan document. Either fix the practice or amend the document.

How to build an ERISA compliance program

A program doesn't need to be fancy. It needs to be repeatable.

Create a compliance calendar

List every filing, notice, and review with its due date, owner, and backup owner. Include plan year end, Form 5500 and extension dates, notice windows, and annual fee reviews. A calendar that two people can see beats a reminder that one person set.

Audit your plans and documents regularly

Once a year, go through the basics:

• Plan documents and amendments are signed and current

• SPDs match how the plan really operates

• Fiduciary appointments are in writing

• The ERISA bond is in place and sized correctly

• Service provider contracts and fees were reviewed

Train HR and benefits teams

People who administer plans need to know the deadlines and the reasons behind them. Plan data also moves through payroll systems, employee portals, and third-party administrators. Staff who understand automation and secure record-keeping, the ground covered by deep tech certifications, can set up alerts and audit trails instead of leaning on spreadsheets.

Document everything

If a decision isn't written down, an auditor or a plaintiff's lawyer will assume it wasn't made carefully. Save committee minutes, investment reviews, vendor comparisons, and the reasoning behind plan changes. A short memo written the same week is worth more than a long one reconstructed years later.

Building compliance expertise on your team

Employers that treat benefits compliance as a side task tend to find problems late. Training one or two people properly changes that. A credential such as the Certified Compliance Management Professional certification suits people who oversee compliance programs at the organizational level, which fits benefit plan oversight well. It gives HR leaders, plan administrators, and compliance officers a shared framework for risk, policy, and monitoring.

Conclusion

Employee benefits compliance (ERISA) comes down to a short list of habits. Know which of your plans the law covers. File the Form 5500 on time and keep SPDs and summary annual reports current. Treat fiduciary duties as a daily responsibility, with written appointments and recorded decisions. Watch the overlap between ERISA, COBRA, HIPAA, and the ACA, especially around notices. Avoid the common mistakes by using a shared calendar, annual audits, and vendor reviews. Train your people, and give them tools that automate the repetitive parts.

None of this requires heroics. It requires a process that survives staff turnover, which is exactly what ERISA compliance is meant to protect. Start with the calendar this week, and the rest gets easier.

Frequently asked questions

1. What does ERISA stand for?

ERISA stands for the Employee Retirement Income Security Act, a federal law enacted in 1974.

2. What is the main purpose of ERISA?

It protects participants in private-sector benefit plans by setting standards for reporting, disclosure, fiduciary conduct, and claims.

3. Who must comply with ERISA?

Private-sector employers and organizations that sponsor retirement or welfare plans for employees, along with the fiduciaries and service providers who run those plans.

4. Which employee benefit plans does ERISA cover?

Pension and 401(k) plans, group health, dental and vision plans, life and disability insurance, and some severance and other welfare arrangements.

5. Are small businesses subject to ERISA?

Yes, if they sponsor a covered plan. Size affects some filings but not whether ERISA applies. Plans covering only owners and their spouses are an exception.

6. What is a plan sponsor?

The employer or organization that establishes and maintains the plan. For some union plans, the sponsor is the union or a joint board.

7. What is an ERISA fiduciary?

A person with discretionary control over plan management or assets, or who gives paid investment advice to the plan.

8. What is the prudent person standard?

A fiduciary must act with the care, skill, and diligence of a knowledgeable person in a similar position, putting participants' interests first.

9. What is Form 5500, and who files it?

It's an annual report on a plan's finances, operations, and compliance. The plan administrator files it electronically for most plans.

10. When is Form 5500 due?

On the last day of the seventh month after the plan year ends, so July 31 for calendar-year plans. Form 5558 extends the deadline by two and a half months.

11. What is a Summary Plan Description (SPD)?

A plain-language document that explains a plan's benefits, eligibility rules, claims procedures, and participant rights.

12. How often must an SPD be updated or distributed?

New participants receive it within 90 days of joining. Changes require a summary of material modifications, and a restated SPD is due every five years if the plan changed or every ten years if it didn't.

13. What are the penalties for ERISA non-compliance?

The IRS can charge $250 per day (up to $150,000) for late retirement plan returns. DOL penalties are adjusted yearly, so confirm current amounts. Fiduciaries may also face lawsuits.

14. Does ERISA apply to health insurance plans?

Yes, employer-sponsored group health plans are covered. Individual policies bought without employer involvement generally aren't.

15. How does ERISA relate to COBRA and HIPAA?

COBRA continuation rules and HIPAA protections sit within or alongside ERISA, so a group health plan usually has to meet all three.

16. What is an ERISA bond?

A fidelity bond that protects a plan from losses caused by fraud or dishonesty by people who handle plan funds. It generally equals 10% of the assets handled, with a $1,000 minimum and a $500,000 cap in most cases.

17. Can fiduciaries be personally liable?

Yes. A fiduciary who breaches their duties may have to restore plan losses from personal assets.

18. What is the ERISA claims and appeals process?

Plans must have a written procedure, decide claims within set deadlines, explain denials in writing, and allow an appeal. Participants usually must complete the appeal before suing.

19. Are government and church plans exempt from ERISA?

Government plans are exempt. Church plans are exempt unless the organization elects to be covered.

20. How can employers stay ERISA compliant year-round?

Keep a shared compliance calendar, audit plans and documents annually, record fiduciary decisions, review vendors, and train the people who run the plans.