"DOL may be acting in response to a targeted program or to a review of a Form 5500 that seems in error," Medina explained. For example, if a company had 500 employees in 2015, then 1,500 employees in 2016, DOL may want to confirm whether there was an acquisition or whether the number is just a typographical error. "An audit or investigation by another agency might also be a trigger," she added, "for example, an Internal Revenue Service audit often sparks audits in other areas."

"Another common trigger," King pointed out, "can be when the 5500 shows a 401(k) plan but no health and welfare plan. In that situation, DOL will ask the company to provide all applicable plan documents."

Medina and King both stressed complaints from disgruntled employees are often the impetus for DOL investigations—even when the complaints may be groundless. Another favorite technique of unhappy employees is to discard old plan documents so it's more complicated to show continuity of plan changes and amendments, King added.

In one case, Medina said, an investigator went to a spa for a massage and saw an unusual poster on the wall about employee benefits, which piqued her interest. In another case, an investigator was in a sandwich line at a deli listening to a group of nurses in front of him discussing proposed changes to their pension plan from a local hospital that didn't seem right to them; he followed up with the hospital, launching a full audit.

Third parties can affect confidentiality

Most employers rely on third-party vendors to administer their benefit plans or on consultants to help design the plans. It can be tempting to contact the vendors or third-party administrators (TPAs) to provide information as part of the audit, but be careful when communicating with them, Medina advised. Conversations with the company's attorney preserves any attorney/client privilege, but the privilege may be waived, depending on how the communications with the third-party vendors takes place.

King reminded the audience there might also be an inherent conflict of interest between the employer and the third parties if the audit finds that the vendor or consultant was at fault. Even though the employer may be entitled to indemnification, the vendor is likely to be taking care of its own issues with DOL first.

Both speakers agreed high-profile organizations can affect the results of an audit — or even whether the audits go beyond an investigation letter in the first place.

"Facts and circumstances are very influential," Medina said. "If a company has a well-known name — even if it's a small company — it has a high risk of being audited."

"The employer is always responsible for any violations," King emphasized, "even when the third party caused the violation. The employer has to write the check, and DOL is a money-making agency." Many departments within DOL are evaluated on how much they collect in fines and penalties as part of the enforcement process, Medina explained.

You can survive a DOL audit without panicking. Remember to provide only the information requested — after consulting your attorney, of course.