The Rosenbaum Law Firm P.C. Blog

Ask most retirement plan providers why they lost a client and you’ll often hear the same answer: “We were undercut on fees.” While price certainly plays a role, I don’t think it’s the reason most relationships end. More often than not, clients leave because they were surprised.

No plan sponsor enjoys finding out about a missed compliance deadline after the fact. They don’t want to discover an operational failure when the auditor does. They certainly don’t appreciate learning that an employee wasn’t enrolled properly six months after payroll made the mistake. The surprise isn’t just the error itself—it’s realizing that no one warned them before it became a bigger problem.

Good providers understand that difficult conversations are part of the job. If a plan sponsor is headed toward trouble, tell them early. If a payroll process is creating unnecessary risk, explain it. If a correction is going to be expensive, don’t sugarcoat it. Clients may not like the news, but they will appreciate the honesty.

Transparency builds trust. Surprises destroy it.

I’ve seen providers keep quiet because they hoped an issue would resolve itself or because they didn’t want to have an uncomfortable conversation. That’s almost always a mistake. Small issues have a way of becoming large ones, and by the time they’re discovered, the client is no longer upset about the error—they’re upset that no one told them.

The providers who retain clients for years aren’t necessarily the cheapest. They’re the ones who communicate consistently, explain problems before they become crises, and never leave a client wondering what’s happening.

Clients can budget for higher fees. It’s much harder to budget for unexpected problems that could have been avoided with a simple phone call.

Plan sponsors spend a surprising amount of time preparing participant communications. Notices are drafted, emails are reviewed, attachments are added, and everything is sent on schedule.

Then… nothing.

Employees delete the email without opening it, promise themselves they’ll read it later, or assume it doesn’t apply to them.

Can you blame them?

Think about the average workday. Employees are flooded with emails about projects, meetings, deadlines, software updates, mandatory training, and company announcements. Somewhere in the middle is another message about the 401(k). It’s easy to understand why it gets overlooked.

The problem is that many benefits emails read like legal documents instead of conversations. They explain what participants are required to receive but rarely explain why they should care.

Instead of leading with regulations, lead with relevance.

Don’t tell employees they’re receiving an annual notice. Tell them how increasing their deferral by one percent could make a meaningful difference over time. Don’t simply announce enrollment dates. Explain what happens if they miss them. Give participants a reason to keep reading.

Communication also shouldn’t be limited to email. Short videos, webinars, payroll reminders, manager talking points, and in-person meetings all reinforce the message. People learn differently, and repetition increases the chances they’ll actually pay attention.

ERISA requires many notices, but compliance should be the floor—not the ceiling.

The goal isn’t merely proving that an email was sent. The goal is helping employees understand and appreciate one of the most valuable benefits their employer provides.

If your benefits communication strategy is measured only by whether the email went out, you’re measuring the wrong thing.

Success isn’t hitting “Send.”

Success is when employees actually open the email, understand the message, and take action.

One of the biggest misconceptions among plan sponsors is that hiring a recordkeeper means someone else is now responsible for everything.

It doesn’t work that way.

A recordkeeper can process payroll files, maintain participant accounts, generate notices, and provide reports. What a recordkeeper cannot do is guess what you meant to do.

They don’t know you hired a new employee unless someone tells them. They don’t know an employee was rehired. They don’t know compensation was coded incorrectly in payroll. They don’t know ownership changed, a payroll vendor was replaced, or an acquisition brought in dozens of new employees.

Garbage in, garbage out still applies.

I’ve seen sponsors blame recordkeepers for operational failures that started with missing or inaccurate information. In reality, the recordkeeper processed exactly what it received.

That’s why communication matters.

Whenever something significant changes—payroll systems, eligibility rules, ownership, acquisitions, compensation practices, even office locations—your retirement plan providers should know about it. What seems unrelated to the business can have enormous retirement plan implications.

The best relationships between plan sponsors and recordkeepers aren’t transactional. They’re collaborative. Sponsors share information early, and providers ask questions before small issues become expensive corrections.

Don’t assume your providers know what’s happening inside your company. They don’t attend management meetings. They aren’t copied on HR emails. They aren’t sitting in payroll discussions.

They’re relying on you.

Think of your recordkeeper as a GPS. It can get you where you’re going, but only if you enter the correct destination.

The more complete and timely the information you provide, the more effective your providers can be. Communication isn’t just good customer service—it’s an essential part of keeping your retirement plan compliant.

Because no matter how sophisticated the technology becomes, your recordkeeper still can’t read your mind.

One of the first lessons I learned practicing ERISA law is that memories fade, people leave, and years later everyone swears something happened—until they’re asked to prove it.

That’s when documentation becomes priceless.

I’ve heard plan sponsors tell me they reviewed investments every quarter, approved fee disclosures, discussed cybersecurity, and monitored their service providers. My next question is always the same: “Do you have meeting minutes?”

Silence.

Under ERISA, good fiduciary decisions matter. But being able to demonstrate the process behind those decisions matters just as much. If the Department of Labor comes calling three years from now, they’re not going to rely on someone’s recollection of a meeting. They’re going to ask for documentation.

Minutes don’t have to read like a Supreme Court opinion. They simply need to reflect who attended, what was discussed, what information was reviewed, and what decisions were made. A concise, accurate record is far better than no record at all.

The same goes for committee charters, investment reviews, fee benchmarking, cybersecurity discussions, and service provider evaluations. These aren’t documents you prepare because you expect litigation. You prepare them because they’re evidence that the fiduciaries took their responsibilities seriously.

Documentation also protects against turnover. Committee members retire. HR directors move on. CFOs change jobs. Institutional knowledge walks out the door every day. Written records ensure the next group understands what decisions were made and why.

Good fiduciaries don’t just make prudent decisions. They create a record showing how those decisions were reached.

When I tell clients, “If it isn’t documented, it didn’t happen,” I’m not suggesting their work has no value. I’m reminding them that in the ERISA world, good intentions aren’t evidence.

A few pages of meeting minutes today can save thousands of dollars—and countless headaches—years from now.

Cybersecurity can seem overwhelming for plan sponsors. Data breaches, phishing attacks, ransomware, account takeovers—the list of threats keeps growing. It’s easy to assume protecting a retirement plan requires expensive software, outside consultants, and a six-figure technology budget.

It doesn’t.

One of the simplest and least expensive cybersecurity decisions you can make is requiring multi-factor authentication (MFA).

Think about what’s sitting in your retirement plan. Social Security numbers, dates of birth, payroll information, beneficiary designations, and participant account balances. To a cybercriminal, that’s a treasure chest.

For years, a username and password were considered enough. They aren’t anymore. Passwords are stolen every day through phishing emails, data breaches, and reused credentials from other websites. Once someone has your password, they’re halfway through the front door.

MFA adds another lock.

Whether it’s a text message, an authentication app, or a biometric scan, that second step makes it dramatically harder for someone to gain unauthorized access. Is it foolproof? No. But it is one of the most effective ways to reduce the risk of account compromise.

The Department of Labor has repeatedly emphasized cybersecurity as part of a fiduciary’s responsibility. While ERISA doesn’t specifically require multi-factor authentication, ignoring readily available security measures becomes increasingly difficult to justify as industry standards evolve.

The good news is that most recordkeepers already offer MFA for plan sponsors and participants. The challenge isn’t availability—it’s making sure everyone actually uses it.

If you’re a plan sponsor, ask your recordkeeper whether MFA is available, whether it’s mandatory, and what percentage of participants have enabled it. If the answer is “I don’t know,” that’s a conversation worth having.

Sometimes fiduciary decisions involve complicated legal analysis or difficult business judgment.

This isn’t one of them.

Turning on multi-factor authentication may take only a few minutes, cost little or nothing, and significantly reduce the risk of a cybersecurity incident.

For a fiduciary, that’s about as easy a decision as you’ll ever make.

Cybersecurity can seem overwhelming for plan sponsors. Data breaches, phishing attacks, ransomware, account takeovers—the list of threats keeps growing. It’s easy to assume protecting a retirement plan requires expensive software, outside consultants, and a six-figure technology budget.

It doesn’t.

One of the simplest and least expensive cybersecurity decisions you can make is requiring multi-factor authentication (MFA).

Think about what’s sitting in your retirement plan. Social Security numbers, dates of birth, payroll information, beneficiary designations, and participant account balances. To a cybercriminal, that’s a treasure chest.

For years, a username and password were considered enough. They aren’t anymore. Passwords are stolen every day through phishing emails, data breaches, and reused credentials from other websites. Once someone has your password, they’re halfway through the front door.

MFA adds another lock.

Whether it’s a text message, an authentication app, or a biometric scan, that second step makes it dramatically harder for someone to gain unauthorized access. Is it foolproof? No. But it is one of the most effective ways to reduce the risk of account compromise.

The Department of Labor has repeatedly emphasized cybersecurity as part of a fiduciary’s responsibility. While ERISA doesn’t specifically require multi-factor authentication, ignoring readily available security measures becomes increasingly difficult to justify as industry standards evolve.

The good news is that most recordkeepers already offer MFA for plan sponsors and participants. The challenge isn’t availability—it’s making sure everyone actually uses it.

If you’re a plan sponsor, ask your recordkeeper whether MFA is available, whether it’s mandatory, and what percentage of participants have enabled it. If the answer is “I don’t know,” that’s a conversation worth having.

Sometimes fiduciary decisions involve complicated legal analysis or difficult business judgment.

This isn’t one of them.

Turning on multi-factor authentication may take only a few minutes, cost little or nothing, and significantly reduce the risk of a cybersecurity incident.

For a fiduciary, that’s about as easy a decision as you’ll ever make.

A recent Vanguard report found that a record 6% of eligible 401(k) participants took hardship withdrawals during 2025, up from 5% the year before and roughly three times the pre-pandemic rate. While the numbers are concerning, they shouldn’t surprise anyone.

People aren’t tapping their retirement accounts because they suddenly forgot the importance of saving for retirement.

They’re doing it because life got expensive.

Medical bills. Housing costs. Inflation. Unexpected emergencies. For many workers, the 401(k) has become the only meaningful savings account they have.

I’ve seen some commentators suggest that employers should tighten hardship withdrawal procedures or make it more difficult to access retirement savings. I think that’s the wrong approach.

Congress has spent the last several years expanding access to retirement plans through legislation like SECURE and SECURE 2.0. Automatic enrollment is bringing millions of new participants into 401(k) plans, many of whom have lower incomes and fewer financial resources. It stands to reason that hardship withdrawals will increase as participation increases.

The real issue isn’t the hardship withdrawal.

The real issue is financial insecurity.

A hardship withdrawal is often the last stop after someone has exhausted other options. If an employee is facing eviction, overwhelming medical expenses, or another immediate financial need, preserving retirement savings becomes secondary to solving today’s crisis.

That doesn’t mean plan sponsors should ignore the trend.

Instead, they should ask better questions.

Do employees have access to emergency savings programs?

Are they receiving financial wellness education?

Do they understand the long-term cost of withdrawing retirement assets?

Has the employer considered the new emergency savings features authorized under SECURE 2.0?

Those conversations will do far more to improve retirement outcomes than simply adding administrative hurdles.

As an ERISA attorney, I spend much of my time helping employers keep retirement plans compliant. But compliance alone doesn’t solve financial stress.

Hardship withdrawals are a symptom, not the disease.

If we want fewer participants raiding their 401(k)s, we shouldn’t start by making hardship withdrawals more difficult.

We should start by helping employees avoid the hardship in the first place.

Years ago, I worked at a law firm that wasn’t a good fit for me. While I was there, I introduced a financial advisor to the firm’s most successful partner, who had a thriving tax certiorari practice. The partner hired him, and I also referred one of my defined benefit plan clients to the advisor. It was a relationship that benefited everyone.

After I left the firm, I later learned the advisor had asked the partner why I was gone. The partner—who, ironically, lives in the same village I do—described me as a “loose cannon.” Based on that one conversation, the advisor instructed his staff to stop working with me.

He never called me.

He never asked for my side of the story.

He simply accepted one person’s version of events and acted on it.

Life has a funny way of playing out. Not long afterward, the advisor lost the very defined benefit client I had referred to him when one of his advisors left for another brokerage firm and took the relationship along.

I’m not telling this story because I’m bitter. That was a long time ago. I’m telling it because it taught me one of the most valuable lessons I’ve learned in both life and business.

There are always two sides to a story.

I’ve learned that the hard way.

It’s why I stay out of disputes that don’t involve me. If two memorabilia dealers are feuding, I have no interest in picking a side. I tell my son the same thing. You rarely know the whole story, and once you insert yourself into someone else’s conflict, you’ve made it your conflict too.

I’ve seen friendships ruined, business relationships destroyed, and reputations damaged because people were too quick to believe the first version they heard. Sometimes the truth is somewhere in the middle. Sometimes it’s completely different from what you’ve been told.

One of the best pieces of business advice I can give is this: don’t become a judge in a case where you haven’t heard all the evidence.

Stay out of other people’s battles unless you have a compelling reason to be involved. You’ll save yourself a lot of unnecessary grief.

That’s a lesson I wish I had learned earlier.

Remember those old Roach Motel commercials?

“Roaches check in…but they don’t check out.”

For some employers, that’s exactly what it feels like with a PEO.

Don’t get me wrong. I understand why businesses use Professional Employer Organizations (PEOs). They can simplify payroll, HR, benefits administration, workers’ compensation, and other employment-related functions. For a growing business without a dedicated HR department, a PEO can make a lot of sense.

The problem isn’t getting into a PEO.

It’s getting out.

When an employer decides to switch from one PEO to another—or leave the PEO model altogether—that’s when the retirement plan issues begin.

Who sponsored the 401(k) plan?

Who adopted it?

Do participants need to be spun off into a new plan?

Is there a plan termination?

Is there a merger?

What happens to outstanding participant loans?

Who files the final Form 5500?

What happens if the employer has changed EINs during the process?

I’ve seen situations where everyone assumed someone else was handling these issues. Months later, the employer learns that Form 5500s weren’t filed, participant accounts weren’t transferred properly, or the IRS still thinks they’re sponsoring a plan they thought ended years ago.

None of these problems are impossible to fix. But they’re much easier—and much less expensive—to address before leaving the PEO than after.

Too often, employers focus on negotiating the new payroll arrangement while treating the retirement plan as an afterthought. That’s backwards. The retirement plan has its own legal and

operational requirements under ERISA and the Internal Revenue Code that don’t disappear just because you’re changing HR providers.

The lesson is simple.

Before you check out of a PEO, make sure you know exactly how your retirement plan is checking out too.

Otherwise, like those old Roach Motel commercials, you may discover that leaving isn’t nearly as easy as getting in.

Every retirement plan should have an annual meeting. Not the participant education meeting. Not the investment review. I’m talking about a meeting where the people responsible for administering the plan sit down and ask one simple question: “How are we doing?”

Too many plan sponsors treat their 401(k) like an appliance. As long as it turns on, they assume everything is fine. Unfortunately, ERISA doesn’t work that way.

An annual fiduciary meeting gives plan sponsors the opportunity to review service providers, discuss participant issues, examine operational errors, review cybersecurity practices, evaluate plan design, and make sure everyone understands their responsibilities. It’s also the perfect time to document decisions that may later be questioned by the IRS, DOL, or plan participants.

I’ve seen plenty of clients who have excellent service providers but no process. When something goes wrong, nobody remembers why a decision was made or who approved it. Good meeting minutes won’t prevent mistakes, but they can demonstrate that fiduciaries acted prudently.

This meeting doesn’t have to last all day. An hour or two with your advisor, TPA, ERISA counsel, and other key providers can identify issues before they become expensive problems.

Think of it as preventive maintenance. You wouldn’t skip servicing your car for five years and expect everything to run perfectly. Your retirement plan deserves the same attention.

If you’re not having an annual fiduciary meeting, you’re missing one of the easiest opportunities to improve plan governance and reduce fiduciary risk.

The best time to schedule your annual meeting was last year.

The second-best time is today.