Hidden Gaps: What Busy Plan Sponsors Tend to Miss

Most fiduciary problems at small and mid-size businesses don’t start with bad intentions. Business owners sponsor retirement plans for good reasons: to help employees build their futures, to compete for talent, and to save for their own retirement too. Trouble usually starts on an ordinary Tuesday, when something small slips through the cracks and stays there. Meanwhile, business carries on. There’s payroll to run, customers to serve, a new hire to train, and that leaky roof. The retirement plan hums along in the background, and it’s easy to assume everyone involved has it handled. That assumption is where the risk begins. Under ERISA, you as the plan sponsor are still a fiduciary, even with great professionals handling the plan.

As A Plan Sponsor, You Are A Fiduciary—Every Day

Sponsoring a plan makes you an ERISA fiduciary, a role that carries some of the highest standards in American law. According to the Department of Labor’s guide Meeting Your Fiduciary Responsibilities, fiduciaries must act solely in the interest of participants, carry out their duties prudently, follow the plan documents, diversify investments, and make sure the plan pays only reasonable expenses. Monitoring the cybersecurity protocols of every third party involved in the plan? Yes, that’s your duty too, as attorneys at Foley & Lardner underscore: “The DOL views cybersecurity as an ERISA fiduciary responsibility. Plan fiduciaries must ensure proper mitigation of cybersecurity risks as part of their duty of prudence, including prudently selecting and monitoring service providers who handle participant data and plan assets…”

Hiring a recordkeeper, third-party administrator, or advisor is smart. But choosing them is itself a fiduciary decision, and you remain responsible for monitoring them. You can hand off the work. You can’t hand off the responsibility.

Bottom line: Fiduciaries who fall short on any of their obligations can be held personally liable to restore losses to the plan. Guard against mistakes by attending to gaps that are common among busy business owners. For example, here are six gaps worth checking this quarter:

1. The Investment Policy Statement in the drawer. An IPS spells out how plan investments are chosen, monitored, and replaced. Sage View Advisory warns that the only thing worse than lacking an IPS is having one and not following it. Pull yours out, confirm it reflects how decisions are actually made, and document the review.
2. Fees you haven’t benchmarked lately. Plan services and pricing change quickly, and Sage View recommends benchmarking your plan’s features, services, and costs every three to five years. When fees are never compared against the market, participants may be quietly overpaying, and that can turn into an ERISA lawsuit, with  very costly out-of -pocket defense costs. Get specific tips on how plan sponsors can tackle fee increases with our related blog: 401k Fee Increase?
3. A default investment nobody has revisited. Writing for the National Association of Plan Advisors, ERISA experts Nevin Adams and Fred Reish flag target-date glide paths as something that can sneak up on even attentive sponsors. Does your default fund manage “to” retirement or “through” it? Does that fit your workforce?
4. Cybersecurity at your providers. Retirement accounts are attractive targets for fraudsters. The DOL’s cybersecurity guidance, which the agency confirmed in 2024, includes tips for selecting and monitoring service providers with strong security practices. Ask your providers how they protect participant data, and keep their answers on file.
5. Late deposits of employee contributions. Money withheld from paychecks becomes a plan asset as soon as it can reasonably be separated from company funds, and delayed deposits are among the most common compliance problems the DOL sees. Set a firm deposit routine and check it regularly. For more help, review Timely Remittance.
6. Former employees who left their accounts behind. Your fiduciary duties don’t end when someone leaves the company. The DOL’s Missing Participants Best Practices directs sponsors to ensure contact data is current, follow up on returned mail and uncashed checks, and document search efforts.

Small Slips Can Have Big Consequences

ERISA litigation isn’t just a problem for major corporations anymore.

In a unanimous 2025 ruling (Cunningham v. Cornell University), The Supreme Court made it much easier for participants to sue retirement plans of any size.As attorneys at Ropes & Gray explain, because routine payments to service providers technically fall under ERISA’s prohibited transaction rules, the ruling makes it easier for claims against plans of all sizes to survive early dismissal. 

Under the old standard, someone suing a plan had to prove upfront that vendor fees were unreasonable. Now, the burden of proof is flipped: plaintiffs only have to point out that the plan paid a service provider. The plan fiduciaries then have to prove in court that the fees were fair and exempt from ERISA’s prohibited transaction rules. Even if you did nothing wrong and ultimately win, defending a plan against an ERISA claim drains time, money and focus from fiduciaries and their businesses. 

Good To Do: Find and Fix Problems

Discovering a mistake within your plan isn’t the end of the world; ignoring one can be. The DOL’s Voluntary Fiduciary Correction Program lets plan officials correct eligible transactions and avoid potential civil enforcement and penalties. A 2025 update added a self-correction tool for late participant contributions and loan repayments, available when lost earnings are $1,000 or less and other conditions are met. Your plan professional can help you choose the right path.

It’s also a smart choice to protect yourself as a fiduciary. Remember: Protecting the plan isn’t the same as protecting you.

Many sponsors believe their ERISA fidelity bond has them covered. The bond is legally required, and it matters, but it protects the plan from losses caused by fraud or dishonesty. It doesn’t defend you in the event of oversights and claims that you breached your fiduciary duties, and traditional business insurance typically doesn’t either.

That protection comes only from fiduciary liability insurance.

Colonial Surety Company’s Fiduciary+Cyber Liability Insurance package is made specifically for retirement plan sponsors like you, and includes:

• Defense costs and penalty limits up to $1,000,000 if you face alleged or actual breaches of duty connected to your retirement plan
• Cyber liability coverage included at no extra cost, with expert breach response services for the plan and your company
• Easy to add to your ERISA fidelity bond, all for a few dollars a day

You started the plan to take care of your people. Take care of yourself, too.

Get your Fiduciary+Cyber Liability quote in minutes →

Serving customers since 1930, Colonial Surety Company is rated “A” Excellent by A.M. Best, U.S. Treasury listed, and trusted nationwide for ERISA bonds, fiduciary liability insurance, and cyber liability insurance.