If you sponsor a 401(k) plan for your small business, you've probably assumed that a Department of Labor audit is mostly about paperwork: Did you file the Form 5500 on time? Did you deposit employee contributions promptly? Those things still matter, but the DOL just told its own investigators to stop treating every process misstep the same way. In April 2026, the Employee Benefits Security Administration (EBSA) issued Field Assistance Bulletin 2026-01, and it quietly rewrote the playbook for how retirement plan investigations get opened, prioritized, and closed.
For a solo practice with a SIMPLE IRA, a 12-person shop with a safe harbor 401(k), or a growing company that just crossed the threshold into ERISA fiduciary territory, this bulletin is worth five minutes of your attention. It tells you what EBSA is now hunting for — and, just as usefully, what it says it will stop second-guessing.
What FAB 2026-01 Actually Changes
EBSA enforces ERISA, the federal law governing employer-sponsored retirement and welfare plans. Historically, its investigators could scrutinize almost any fiduciary decision a plan sponsor made, including the quality of the process behind a reasonable-looking outcome. FAB 2026-01 narrows that lens in two concrete ways:
- A declared priority for duty-of-loyalty cases over duty-of-prudence cases. EBSA says a significant share of its enforcement resources must now go toward investigations involving loyalty breaches or clear-cut prohibited transactions — not toward relitigating whether a fiduciary's decision-making process was optimal.
- Hard clocks on investigations. Routine investigations are now expected to close within 18 months; complex investigations within 30 months. Both allow extensions for "exigent circumstances," but regional directors must now review any investigation that blows past those windows and report the delay up the chain.
Neither of these changes the underlying law. ERISA's fiduciary duties are unchanged. What's changed is where EBSA's limited investigative attention goes first, and how long a plan sponsor can be left in limbo once an inquiry opens.
Duty of Loyalty vs. Duty of Prudence: Why the Distinction Now Matters More
ERISA has always imposed two overlapping — but legally distinct — obligations on anyone who exercises discretion over a retirement plan:
- Duty of loyalty requires a fiduciary to act solely in the interest of participants and beneficiaries, for the exclusive purpose of providing benefits and paying reasonable plan expenses. This is a duty about whose interest you served.
- Duty of prudence requires the care, skill, and diligence a knowledgeable person would apply to the same task. This is a duty about how carefully you decided, judged largely by the process, not just the outcome.
Under the new bulletin, EBSA has explicitly said it will not "unfairly second-guess process-based fiduciary judgments." In practice, that means an investigator is less likely to open a file purely because a plan's investment lineup underperformed a benchmark, if the sponsor can show a documented, reasonable selection and monitoring process. But the bulletin is equally explicit that loyalty violations remain a top target, including:
- Self-dealing — a fiduciary or a related party profiting from plan decisions
- Selecting a service provider primarily because they bundle in other business perks, without evaluating whether the plan's fees are reasonable
- Letting objectives unrelated to participants' financial interests (the bulletin specifically calls out ESG-driven investment or proxy-voting decisions not tied to financial analysis) influence plan management
- Misappropriating plan assets or using them for anything other than participant benefit and reasonable expenses
The upshot for a small business owner: a good-faith, well-documented process buys you real protection under this bulletin. A shortcut that benefits you, a friend, or a vendor at participants' expense does not — and is now more likely to draw scrutiny, not less.
Who Actually Counts as a Fiduciary at a Small Business
Owners often assume "fiduciary" is a title reserved for a dedicated HR department or an outside financial advisor. It isn't. Under ERISA, fiduciary status follows function, not job description. If you have discretionary authority over the plan's management or its assets — or you give investment advice for a fee — you're a fiduciary, whether or not your business card says so. In practice, that usually includes:
- The business owner or officer who signed the plan document and adoption agreement
- Whoever selects and monitors the recordkeeper, third-party administrator, and investment lineup
- Anyone who sits on an informal "committee" that reviews plan fees or fund performance, even if that committee is really just you and a co-owner talking over coffee once a year
- A payroll or HR staffer with authority to approve which employee deferrals get transmitted and when
At a five-person business, the owner is very often the plan's sole fiduciary by default, simply because no one else has been formally assigned the role. That's exactly the setup FAB 2026-01 is most relevant to: a single decision-maker, wearing every hat, with no compliance staff to catch a conflict of interest before it becomes a loyalty breach.
A Quick Example
Say you run a 15-person marketing agency and your 401(k) recordkeeper also happens to be the payroll vendor you already use — a common, entirely legitimate setup. If you chose that recordkeeper after comparing its plan fees to two competitors and documenting why the bundled pricing was actually cheaper for your employees, that's a duty-of-prudence story with a clean process behind it, and FAB 2026-01 says EBSA shouldn't be second-guessing it. But if you chose it purely because your payroll rep offered you a personal discount on unrelated services and you never looked at whether the plan's fees were competitive, that's a duty-of-loyalty problem — the kind the bulletin says gets priority attention regardless of how the investment lineup performed.
The difference between those two stories isn't the outcome. It's whether you can produce, on request, a record of how and why the decision was made.
What the 18-Month Clock Does (and Doesn't) Mean for You
If EBSA opens an investigation into your plan, the bulletin's timelines work in your favor procedurally: routine matters — things like delinquent employee contributions or disclosure failures, which are the most common findings against small plans — are supposed to be resolved within a year and a half, with leadership review triggered if that slips. That's a meaningful improvement over investigations that can otherwise drag for years while a plan sponsor sits in uncertainty.
But don't read the clock as a shrinking of consequences. A finding of delinquent contributions still carries the same exposure it always has: those late deposits are treated as a prohibited transaction under ERISA Section 406, which means a 15% excise tax on the amount involved for every year the violation continues, a Form 5330 filing with the IRS, and personal fiduciary liability for the person responsible for the delay. The bulletin changes the calendar EBSA works on, not the penalties.
Practical Steps for Small Business Plan Sponsors
You don't need a compliance department to act on this. A few habits go a long way toward staying on the right side of both duties:
- Deposit employee deferrals as soon as administratively feasible. For small plans, the DOL's safe harbor is the earliest date you could reasonably segregate the money from general assets — typically within a few business days of payroll, not the outer 15-business-day limit. Late deposits remain the single most common finding in small-plan audits.
- Document why you chose your recordkeeper and investment lineup, and revisit it periodically. A short annual memo — who you compared, what fees you found, why you picked what you picked — is often the difference between "sound process" and "no process" in an investigator's eyes.
- Review your 408(b)(2) fee disclosures. Every plan service provider is required to disclose its compensation. If you've never actually read that disclosure or can't locate it, that's a gap worth closing before anyone asks.
- Separate personal or business relationships from plan decisions. If a vendor, TPA, or advisor is a friend, family member, or gets other business from you, be extra deliberate about documenting that the arrangement was chosen on the merits.
- Keep the paper trail somewhere you can actually find it. Committee meeting notes, fee benchmarking, provider comparisons — none of it protects you if it's scattered across old email threads nobody can search.
That last point is where clean financial recordkeeping habits pay off well beyond the plan itself. If your business's books are already organized, auditable, and easy to hand to an advisor or investigator on short notice, extending that same discipline to your retirement plan's documentation is a much smaller lift.
Keep Your Financial Records Audit-Ready
Whether it's a DOL inquiry into your 401(k) or an ordinary tax season, the businesses that handle scrutiny calmly are the ones whose records were organized before anyone came asking. Beancount.io offers plain-text accounting that gives you a transparent, version-controlled ledger of every transaction — no black box, no vendor lock-in, and a full history you can hand to anyone who needs it. Get started for free and build the kind of financial record-keeping habit that makes any audit less stressful.