Every retirement plan sponsor has procedures. The question is whether those procedures exist only in someone’s head or are documented in writing.
Written policies help create consistency, improve accountability, and demonstrate prudent fiduciary oversight. While every plan is different, three policies deserve consideration by virtually every retirement plan sponsor.
The first is an Investment Policy Statement (IPS). Although not required by ERISA, an IPS provides a framework for selecting, monitoring, and replacing investment options. It helps fiduciaries make decisions based on established criteria rather than reacting to short-term market events.
The second is a contribution deposit policy. Employee deferrals must be deposited timely. Unfortunately, many late deposit failures occur because responsibilities are unclear. A written policy identifying who is responsible, how deposits are processed, and what timelines must be followed can help reduce operational risk.
The third is a cybersecurity policy. Retirement plans contain sensitive participant information and valuable assets. Plan sponsors should establish procedures for vendor oversight, data protection, access controls, and incident response. Cybersecurity is no longer just an IT concern—it is a fiduciary concern.
These policies do more than provide guidance. They help demonstrate that fiduciaries have established processes for addressing key areas of risk.
When problems occur, regulators often ask what procedures were in place and whether those procedures were followed. Written policies provide evidence that fiduciaries considered these issues and implemented a structured approach to managing them.
Good governance begins with good documentation.
Retirement plan sponsors do not need hundreds of pages of policies and procedures. They simply need thoughtful, practical documents that help ensure important responsibilities are handled consistently and prudently.