The Rosenbaum Law Firm P.C. Blog

One of the biggest misconceptions among plan sponsors is that once a 401(k) plan is established, it somehow goes on autopilot. After all, payroll deductions are happening automatically, participant statements arrive every quarter, and the recordkeeper has an attractive website. Everything appears to be working.

The problem is that appearances can be deceiving.

A retirement plan is much like a commercial airplane. Most of the flight is uneventful because professionals are constantly monitoring systems, making adjustments, and following checklists. The passengers don’t see the work that goes into making the trip safe. Likewise, employees only see their account balances. They don’t see the fiduciary meetings, fee reviews, investment monitoring, cybersecurity discussions, or compliance testing that should be taking place behind the scenes.

Too many employers assume that their advisor, recordkeeper, or third-party administrator is handling everything. While those providers perform important services, none of them automatically assume all of the fiduciary responsibilities imposed by ERISA. Unless those duties have been specifically delegated, the plan sponsor remains responsible for making sure the plan is operated prudently.

That means reviewing service providers, documenting important decisions, monitoring investments, ensuring participant disclosures are delivered, and correcting operational mistakes when they occur. Ignoring those responsibilities because “everything seems fine” is an invitation for problems that may not surface until an IRS audit, Department of Labor investigation, or participant lawsuit.

The best plan sponsors understand that a successful retirement plan requires ongoing governance, not occasional attention. They ask questions, schedule regular fiduciary meetings, review reports, and treat their retirement plan like any other important business function.

Your 401(k) plan may appear to run itself, but it doesn’t. Behind every well-run plan is a sponsor who understands that fiduciary responsibility is an ongoing commitment—not a one-time project completed the day the plan was adopted.

Nobody climbs onto their roof every weekend looking for loose shingles. Yet responsible homeowners know that small leaks have a nasty habit of becoming expensive disasters if they’re ignored.

Retirement plans work much the same way.

Most fiduciary failures don’t begin with fraud or intentional misconduct. They start with small issues that seem insignificant at the time. A late payroll deposit. An outdated investment policy statement. A missed participant notice. A committee meeting that gets postponed because everyone is busy. An eligibility error that affects one employee. Individually, each issue may appear manageable. Collectively, they can become an expensive compliance problem.

I’ve seen employers spend thousands of dollars correcting mistakes that could have been resolved in minutes if someone had simply identified the issue earlier. Like a roof leak, retirement plan problems rarely improve with age. They usually become larger, more complicated, and more expensive.

That’s why preventive maintenance matters. Conduct annual fiduciary reviews. Benchmark fees. Review investment performance. Confirm payroll procedures are working properly. Test eligibility and contribution calculations. Evaluate cybersecurity practices. Most importantly, document what you’ve done. A well-maintained fiduciary file is often just as valuable as correcting the problem itself.

ERISA doesn’t expect perfection. It expects prudence. Courts and regulators understand that mistakes happen. What they want to see is a process for identifying problems, correcting them promptly, and taking reasonable steps to prevent them from happening again.

Homeowners don’t replace an entire roof because of one missing shingle—they replace it because they ignored the warning signs for too long.

The same is true with retirement plans. Address the small problems today, and you’ll avoid much bigger headaches tomorrow. Preventive maintenance isn’t exciting, but it’s almost always less expensive than emergency repairs.

Technology has transformed the retirement plan industry. We have sophisticated recordkeeping platforms, participant websites, mobile apps, artificial intelligence, and automated workflows that would have seemed impossible twenty years ago. Yet despite all of those advances, the retirement plan business remains remarkably simple at its core.

It’s a relationship business.

Every plan sponsor is different. Some want detailed quarterly meetings and lengthy discussions about investments and fiduciary governance. Others want a quick phone call when something important arises and trust you to handle the day-to-day details. Neither approach is right or wrong. The key is understanding your client’s expectations and adapting your service model to fit their needs rather than forcing every client into the same mold.

That’s where many providers fall short. They develop a standardized service model because it’s operationally efficient, but they forget that people don’t all think alike. The owner of a 15-person business has different concerns than the HR director of a company with 500 employees. Treating them identically is rarely a recipe for a lasting relationship.

Clients also know when they’re just another account number. They can tell the difference between someone who calls because the calendar says it’s time and someone who calls because they genuinely want to know how the business is doing. Authentic concern can’t be automated.

If you truly care about your clients, listen to them, respond to their concerns, and make their problems your problems, you’ve already won half the battle. Expertise, technology, and competitive pricing certainly matter, but those are often what get you in the door. Relationships are what keep you there.

At the end of the day, people don’t stay with retirement plan providers because of software alone. They stay because they trust the people behind it. In this business, trust is still the most valuable service you can provide.

One of the questions I’m asked most often is whether I recommend retirement plan providers to clients. The answer is yes—but probably not for the reasons many providers think.

The first thing I look for isn’t price. It isn’t technology. It isn’t even the size of the organization. I want to know whether the provider makes my client’s life easier or more complicated.

A good provider understands that every retirement plan is different. They know when to pick up the phone instead of sending another automated email. They recognize unusual compliance issues and aren’t afraid to ask questions before making assumptions.

Communication matters. If I have to chase someone for an answer, I begin to wonder how they treat their clients. If they respond thoughtfully, explain their reasoning, and admit when they need additional research, they earn credibility.

I also pay attention to whether they educate or simply sell. Providers who consistently publish useful content, speak at industry conferences, and share practical compliance guidance demonstrate that they care about improving the industry—not just increasing revenue.

Perhaps most importantly, I value providers who own their mistakes. Every organization makes them. The difference is whether the provider immediately develops a solution or spends time looking for someone else to blame.

ERISA attorneys remember experiences, both good and bad. We remember who returned calls during a crisis, who solved difficult operational problems, and who remained calm when deadlines became stressful.

If you want more referrals from attorneys, don’t spend your time telling us how great your company is. Show us through competence, communication, integrity, and consistent execution. Those qualities are remembered long after the sales presentation ends.

Whenever a retirement plan provider tells me they need a better CRM to generate more business, I usually ask one simple question: “How many prospects from six months ago have you called this month?” The answer is almost always silence.

The truth is that most CRMs don’t fail because of technology. They fail because of discipline. Every major CRM on the market can track prospects, schedule reminders, store notes, and automate emails. Yet opportunities continue to fall through the cracks because people stop following up once the excitement of the initial meeting wears off.

The retirement plan business is rarely built on one conversation. Plan sponsors are busy running companies, dealing with employees, and solving problems that seem far more urgent than changing their retirement plan provider. That doesn’t mean they aren’t interested. It simply means your timing wasn’t right.

I’ve seen providers lose business because they assumed “I’ll think about it” meant “no.” Six months later another provider earns the engagement simply because they stayed in touch. Not with relentless sales calls, but with useful articles, regulatory updates, and an occasional phone call asking how business is going.

Your CRM should remind you to build relationships, not just pursue transactions. Every note entered should answer the question, “How can I provide value the next time I reach out?” If every communication is another sales pitch, your CRM becomes nothing more than a digital phone book.

Technology is important, but consistency wins every time. The provider who follows up professionally for a year will usually outperform the provider who makes one impressive presentation and disappears.

The problem isn’t your software. The problem is forgetting that retirement plan sales are built on trust, and trust is built through consistent follow-up.

Most retirement plan providers pride themselves on providing great service. They answer emails quickly, return phone calls promptly, and resolve issues efficiently. Those are all good qualities, but they describe a provider who is responsive—not necessarily one who is proactive.

A responsive provider waits for the phone to ring. A proactive provider calls before there’s a problem.

Plan sponsors don’t always know what questions to ask. They may not know that SECURE Act changes are coming, that their plan document needs to be restated, or that participant fees have drifted above market. If you only respond after the client discovers the issue, you’ve missed an opportunity to demonstrate real value.

The best providers anticipate concerns before they become emergencies. They schedule regular plan reviews, discuss fiduciary governance, remind sponsors about required notices, and identify operational problems before they appear on an auditor’s desk or in an IRS examination.

Being proactive also strengthens client relationships. When a sponsor receives an unexpected call saying, “I noticed something we should discuss,” they begin to see you as part of their management team instead of just another vendor.

Anyone can answer an email within an hour. That’s expected today. The providers who separate themselves are the ones who identify issues their clients didn’t even realize existed.

Responsiveness earns satisfaction. Proactivity earns loyalty.

If your goal is to reduce client turnover and increase referrals, stop measuring how quickly you answer questions. Start measuring how often you’re asking the questions first.

The Treasury Department and IRS have officially begun the rulemaking process for the Saver’s Match program, which takes effect for the 2027 tax year. While many of the details will be finalized through the regulatory process, one thing is already clear: this represents one of the most significant changes to retirement savings incentives since the passage of SECURE 2.0.

Unlike the Saver’s Credit, which reduced a taxpayer’s tax liability, the Saver’s Match will provide an eligible individual with a federal matching contribution of up to $1,000 deposited directly into the participant’s retirement account. The goal is straightforward—encourage low- and moderate-income workers to save for retirement by rewarding contributions with an actual retirement plan deposit instead of a tax credit that many workers never fully appreciated.

For plan sponsors, this isn’t something to ignore simply because the federal government is administering the program. Employees will inevitably have questions about eligibility, contribution limits, and how the match works. Employers don’t need to become experts overnight, but they should understand the basics well enough to direct participants to reliable information and explain how contributing to the plan may unlock an additional federal retirement benefit.

Retirement plan providers should also begin preparing educational materials for clients. Whenever Congress changes the retirement savings landscape, confusion follows. The providers that simplify complicated rules and communicate them effectively will distinguish themselves from competitors that simply wait for questions to arrive.

The proposed regulations are just the first step, and additional guidance will undoubtedly follow. Nevertheless, the direction is clear. The Saver’s Match is moving from legislation to implementation, and plan sponsors should begin familiarizing themselves with the program now rather than scrambling when employees begin asking questions in 2027.

There was a time when cybersecurity was viewed as the responsibility of the IT department. If the network was protected and the antivirus software was up to date, management considered the job done. Those days are over—especially when it comes to retirement plans.

Today’s retirement plans hold sensitive participant information, account balances, Social Security numbers, banking details, and beneficiary data. A cybersecurity breach doesn’t just create technical problems; it creates fiduciary, financial, and reputational risks.

The Department of Labor has made it clear that cybersecurity is part of prudent plan administration. While the guidance isn’t a formal regulation, it sends a strong message that plan sponsors are expected to understand how participant data is protected and to ask meaningful questions of their service providers.

That doesn’t mean fiduciaries need to become cybersecurity experts. It does mean they should know who has access to participant information, how that information is protected, whether service providers maintain cybersecurity insurance, how incidents are reported, and what procedures are in place if a breach occurs.

Cybersecurity should also become a regular agenda item during retirement committee meetings. Ask your recordkeeper about multi-factor authentication, encryption, employee training, independent security audits, and disaster recovery planning. Document those discussions. Good fiduciary governance isn’t about having every answer—it’s about asking the right questions and maintaining a prudent process.

Unfortunately, many organizations still assume that because they hired reputable providers, cybersecurity is someone else’s responsibility. It isn’t. While service providers perform many important functions, the responsibility for selecting and monitoring them remains with the plan sponsor.

The greatest cybersecurity risk isn’t necessarily sophisticated hackers. It’s complacency. Assuming everything is fine because nothing has happened yet is rarely a winning strategy.

Protecting retirement plan assets today means protecting participant data as well. Cybersecurity is no longer simply an IT concern. It has become an essential part of fiduciary responsibility, and every plan sponsor should treat it that way.

One of the simplest pieces of advice I give plan sponsors is also one of the most important: document everything.

Good decisions that aren’t documented can be difficult to prove years later. Committee meetings, investment reviews, fee discussions, vendor evaluations, cybersecurity conversations, and decisions regarding plan administration should all leave a paper trail. Memories fade. Employees retire. Committee members change. Written records remain.

I’ve worked with plan sponsors that made thoughtful fiduciary decisions but kept almost no documentation supporting them. When questions later arose—from auditors, regulators, or even participants—they were forced to rely on recollections instead of records. That’s never a position you want to be in.

Documentation isn’t about creating paperwork for the sake of paperwork. It’s about demonstrating a prudent process. Fiduciaries aren’t expected to make perfect decisions every time. They are expected to make informed decisions through a reasonable process. Meeting minutes, emails, written analyses, service provider reports, and committee materials all help tell that story.

The same principle applies to day-to-day administration. Written procedures help ensure that new hires are enrolled timely, payroll changes are communicated, distributions are processed consistently, and responsibilities are clearly assigned. They also make training new employees significantly easier and reduce the likelihood that important tasks are overlooked when someone leaves the organization.

If your retirement plan depends on one person’s memory, it is operating with unnecessary risk.

The strongest retirement plans aren’t necessarily the ones with the most sophisticated investments or the lowest fees. They’re often the ones with disciplined governance and consistent documentation. Years from now, you may not remember every discussion your committee had. Fortunately, your records can. That’s why good documentation isn’t just good administration—it’s one of the best fiduciary protections you can have.

One of the most common questions I receive from plan sponsors is how to fix a retirement plan mistake after it has already happened. An employee was left out of the plan. Deferrals weren’t deposited on time. Compensation was calculated incorrectly. Eligibility was misunderstood. The good news is that many of these errors can be corrected. The bad news is that every correction costs time, money, and unnecessary stress.

The better approach is to prevent the problem from happening in the first place.

Retirement plans are operational documents. They require payroll, human resources, finance, and outside service providers to work together consistently. When communication breaks down or responsibilities become unclear, mistakes become much more likely. That’s why routine reviews are so important. Confirm that payroll is using the correct compensation definition. Verify that new hires are entering the plan on time. Make sure loan repayments, hardship distributions, and employer contributions are being handled according to the plan document.

Too many plan sponsors view compliance as something to think about only when the annual audit or Form 5500 is due. By then, you’re often looking backward instead of forward. A simple quarterly review can identify small issues before they become expensive correction projects.

I’ve found that the organizations with the fewest retirement plan problems aren’t necessarily the ones with the largest HR departments or the biggest budgets. They’re the ones that ask questions early, document their procedures, and make compliance part of their normal business operations rather than an annual exercise.

No retirement plan is perfect, and no sponsor catches every issue immediately. But the sponsors who invest a little time in prevention almost always spend far less time dealing with corrections. In retirement plan administration, the cheapest problem to fix is the one that never occurs.