Division VI

Corrections, Audits, and Disputes

The four Parts in this Division cover what happens when something goes wrong: correcting plan failures, responding to government audits and investigations, litigating benefit and fiduciary disputes, and handling cybersecurity incidents.

Correction programs. Part 21 covers the IRS Employee Plans Compliance Resolution System, including the SECURE 2.0 expansion of self-correction, the DOL Voluntary Fiduciary Correction Program, and the Delinquent Filer Voluntary Compliance Program for late Forms 5500.
Government audits and investigations. Part 22 covers DOL/EBSA civil investigations, IRS employee plans examinations, PBGC audits and compliance reviews, and HHS Office for Civil Rights HIPAA investigations.
Disputes and preemption. Part 23 covers civil actions under ERISA §502, standing and remedies, ERISA preemption of State law, and the defense of claims and investigations.
Cybersecurity and data incidents. Part 24 covers the DOL's cybersecurity guidance and the fiduciary process it expects, fraudulent distributions and the allocation of losses, incident response, and service-provider diligence, contracts, and insurance.

The rules that a correction or a dispute is measured against are stated in the earlier Divisions, and the cross-references in each chapter point to them.

Part 21. Plan Corrections: EPCRS, VFCP, and DFVCP

This Part covers SCP, VCP, Audit CAP, SECURE 2.0 EIFs, VFCP, VFCP SCC, DFVC, Form 5330, loan failures, late deposits, RMD failures, and testing failures.

Part 22. Government Audits and Investigations

This Part covers the procedural mechanics of a government audit, examination, or investigation: DOL/EBSA civil investigations (§504 authority, document requests, interviews, Voluntary Compliance letters, §502(l) penalties, criminal referral), IRS Employee Plans examinations (IDRs, the Audit CAP exam-side process, standalone closing agreements/EP VCAP, appeal rights), PBGC premium and standard-termination audits and compliance monitoring (reportable events, §4010, §4062(e), the Early Warning Program), and HHS OCR HIPAA investigations (complaints, compliance reviews, corrective action plans, resolution agreements, civil monetary penalties, criminal referral). Process and response posture only — correction substance and litigation strategy are routed elsewhere.

Part 23. ERISA Disputes, Enforcement, Preemption, and Remedies

This Part covers §502 causes of action, standing, pleading standards, remedies and equitable relief, attorney's fees, limitations, exhaustion, standard of review, the administrative record and discovery (including the fiduciary exception to privilege), §514 preemption analysis (the Supreme Court canon, savings/deemer, complete preemption/removal), state PBM laws post-Rutledge, state auto-IRA mandates, the litigation-facing overview of DOL/EBSA investigations, litigation holds and preservation, and insurer-versus-plan allocation. Doctrine and risk analysis only — litigation strategy is reserved for litigation counsel.

Part 24. Benefits Cybersecurity and Data Incidents

This Part covers benefit-plan cybersecurity and data incidents across retirement and health and welfare plans: DOL/EBSA's cybersecurity guidance (the April 2021 Best Practices / Tips for Hiring a Service Provider / Online Security Tips package, confirmed by Compliance Assistance Release No. 2024-01 (Sept. 6, 2024) to apply to all ERISA plans including health and welfare plans) and its sub-regulatory authority level; cybersecurity fiduciary process and committee governance; service-provider cyber diligence, SOC 2 review, and contract allocation of security obligations and loss; fraudulent distributions and account takeover (theories, the district-court case law, and who bears the loss); loss allocation, recordkeeper customer guarantees, and restorative payments under Rev. Rul. 2002-45; plan incident response; the notification analysis (no ERISA breach-notification rule; state law including A.R.S. §18-552; HIPAA for health plans); participant-data use and monetization; and the fidelity bond / fiduciary liability / cyber / crime insurance stack.