Small Plan, Big Liability: Why Size Doesn't Reduce Your ERISA Exposure

What every small business owner sponsoring a retirement plan needs to know about personal risk

If you run a small business and sponsor a 401(k) for your employees, you may assume that your modest plan size keeps you under the radar — that the serious legal scrutiny of ERISA is reserved for large corporations with sprawling retirement programs and dedicated HR departments.

That assumption is wrong. And it can be an expensive one.

The Employee Retirement Income Security Act of 1974 (ERISA) does not grade on a curve. Whether your plan holds $200,000 or $200,000,000, the fiduciary obligations imposed on you as a plan sponsor are essentially the same — and so is your personal exposure if something goes wrong.

Here is what small business owners need to understand.

ERISA Doesn’t Have a “Small Business” Exemption

ERISA’s fiduciary standards apply to anyone who exercises discretionary authority or control over a retirement plan — regardless of how many participants are enrolled or how much money is in the plan. As a plan sponsor, you are a fiduciary by definition. That means you are personally bound by ERISA’s strict standards of conduct, including:

• Acting solely in the interest of plan participants and beneficiaries
• Selecting and monitoring plan investments prudently
• Ensuring that plan fees are reasonable
• Following the terms of the plan document
• Complying with applicable federal regulations

These are not suggestions. They are legal obligations — mistakes and oversights are breaches; they can result in personal liability, even if your plan has only 10 participants and a few hundred thousand dollars in assets. 

“Personal Liability” Means What It Says

One of ERISA’s most sobering aspects is that fiduciary liability is not just a corporate issue. Under ERISA Section 409, plan fiduciaries can be held personally liable to restore any losses to the plan resulting from a breach of duty. The Department of Labor makes this very clear: “Fiduciaries who do not follow these principles of conduct may be personally liable to restore any losses to the plan….”

Courts have consistently held that individual fiduciaries — including business owners, partners, and executives at small companies — can be held personally responsible for losses caused by fiduciary breaches. What does personal liability look like in practice? It means that if your plan participants sue over excessive fees, poor investment options, or administrative errors, the legal and financial consequences can reach your personal assets — not just your business. It means that if the Department of Labor investigates your plan and finds violations, penalties and restoration of losses can be assessed against you individually.

For a small business owner, that kind of exposure can be genuinely devastating.

The Risks Small Plan Sponsors Face Every Day

It doesn’t take fraud or malicious intent to trigger an ERISA fiduciary claim. The vast majority of fiduciary liability cases stem from ordinary oversights — the kind that happen when a busy small business owner is managing a retirement plan alongside everything else that running a company demands. Common examples include:

• Failing to monitor plan investments. Did you set up your 401(k)’s investment menu years ago and never revisit it? ERISA requires ongoing, prudent monitoring of all plan investment options. Stale lineups, consistently underperforming funds, or options with excessive expense ratios can all form the basis of a claim.
• Not benchmarking plan fees. Are the fees your plan pays to its recordkeeper, advisor, and other service providers reasonable? Under ERISA, it is your responsibility to find out — and to act if they aren’t. Many small business owners have never conducted a fee benchmarking review, which is precisely the kind of omission that draws scrutiny.
• Administrative errors. Failing to enroll an eligible employee on time. Processing a distribution incorrectly. Missing a required minimum distribution. These procedural mistakes happen, especially in small businesses where plan administration is handled by someone wearing multiple hats. Under ERISA, they can still result in claims against the plan sponsor.
• Choosing the wrong advisor or service providers. You have a fiduciary obligation not just to select qualified service providers, but to continue monitoring them. If your plan advisor turns out to be giving poor advice, or your recordkeeper has a data breach, your decision to hire them — and your ongoing failure to evaluate their performance — may come back to you.

Small Plans Draw DOL Attention Too

It is a common belief that the Department of Labor focuses its enforcement resources on large plans. While it is true that large plans face mandatory independent audits, small plans are far from invisible to regulators.

The DOL’s Employee Benefits Security Administration (EBSA) conducts investigations of plans of all sizes, often triggered by participant complaints, Form 5500 anomalies, or routine enforcement initiatives. In fact, protecting participants in small plans is important to the governement— precisely because those participants often have fewer resources to pursue claims on their own.

According to accountants at Anders CPA, even a missing or inadequate ERISA Fidelity Bond on a Form 5500 filing, is considered a compliance violation, and can “trigger additional scrutiny during an audit or regulatory review.”

The Coverage Gap Most Small Business Owners Don’t Know They Have

Here is the critical point that many small business owners miss: the ERISA Fidelity Bond that federal law requires you to carry does not protect you personally. It protects the plan’s assets from theft and fraud. Full stop.

For protection against the far more common risks plan sponsors face — fiduciary errors, administrative mistakes, lawsuits from participants, regulatory actions — you need fiduciary liability insurance, as accounting professionals at Adams Brown confirm: “A fidelity bond protects against loss from fraud or dishonesty by an individual or individuals involved in managing the plan. Fiduciary liability coverage protects against loss that stems from the way the plan is run.” 

Fiduciary liability insurance is a separate coverage that most small plan sponsors simply do not have, often because no one has ever explained the distinction to them.

Only fiduciary liability insurance covers costs such as:

• Legal defense if participants sue over investment choices or excessive fees
• Penalties and settlements arising from administrative errors
• Costs associated with DOL investigations and regulatory actions
• Claims related to the improper enrollment, termination, or management of plan participants

For a small business owner, the cost of even a single ERISA lawsuit — just the legal defense, before any settlement or judgment — can run into tens of thousands of dollars. Fiduciary liability insurance exists precisely to prevent that kind of exposure from becoming a personal financial catastrophe for retirement plan sponsors. 

Rising to the Top: Cybersecurity Is Now EBSA’s #1 Enforcement Priority

If the personal responsibility considerations above haven’t prompted a hard look at your plan’s cybersecurity practices, this should: the DOL’s Employee Benefits Security Administration recently updated its enforcement priorities — and  cybersecurity sits at the very top of the list, with this explanation: “This project addresses the growing risks cyberattacks pose to employee benefit plans and participants. It promotes best cybersecurity practices for plans and service providers to protect sensitive information and reduce the risk of fraud and financial loss. As part of its investigations, EBSA reviews how plans and service providers protect their systems and data from cyber threats.”

EBSA’s cybersecurity guidance — which plan sponsors are expected to follow as part of their fiduciary obligations — has three components:

1. Best practices for plan sponsors— addresses cybersecurity oversight related to governance, access controls, incident response planning, and more
2. Strong security protocols for service providers — because your vendors’ security gaps are your fiduciary problem too
3. Online security tips — helping participants protect their own accounts from fraud is another plan sponsor responsibility

Importantly, for retirement plan sponsors, cybersecurity obligations extend beyond your own business systems. Thoroughly vetting and continuously monitoring the data security practices of every third-party service provider connected to your plan — your recordkeeper, TPA, advisor, and payroll provider — is now a core fiduciary responsibility. 

Failure to adequately address cybersecurity can itself be treated as a fiduciary breach — which means it carries the same personal liability exposure as any other fiduciary failure. For retirement plan sponsors at businesses without dedicated IT or compliance staff, cybersecurity is a significant and growing risk.

One Affordable Solution That Covers Everything

Colonial Surety Company has built a protection package specifically designed for retirement plan sponsors — including small businesses that need comprehensive, affordable coverage without the complexity of working with multiple providers and tagged on fees.

The Colonial Surety Company ERISA Bundle combines three essential protections in one seamless package:

• ERISA Fidelity Bond — Fulfills your federal mandate to protect plan assets from fraud and dishonesty
• Fiduciary Liability Insurance — Provides up to $1,000,000 in coverage for legal defense costs and penalties arising from fiduciary errors, administrative oversights, and participant claims
• Complimentary $50,000 Cyber Liability Insurance — Protects your plan and company against regulatory actions following a data breach, addressing the DOL’s cybersecurity guidance directly by including expert response services.

Colonial Surety is Treasury-Listed, rated “A” (Excellent) by AM Best, and has been in business since 1930. As a direct carrier — not a broker — there are no agent markups or unnecessary fees. You can quote, purchase, and download proof of coverage entirely online in minutes.

For a small business owner sponsoring a retirement plan, this bundle is not a luxury. It is the practical, affordable answer to a very real set of risks that most small plan sponsors are carrying unknowingly every single day.

The Bottom Line

Running a small retirement plan does not make you a small target. ERISA applies to you with the same force it applies to Fortune 500 companies. Your fiduciary obligations are personal. Your exposure is real. And the gap between the coverage you’re required to carry and the coverage you actually need is one that Fiduciary Liability Insurance was designed to fill.

Don’t wait for a participant complaint, DOL inquiry, or cyber threat to find out what you’re missing. Get an instant quote on Colonial Surety’s ERISA Bundle today — and protect your plan, your business, and your personal assets in one smart move.

👉Get Your Instant Quote & Download Proof of Coverage In Minutes