Short answer: An employer can prepare by running a structured self-audit of its health and retirement plans, documenting every answer, assigning an owner to each gap, and repeating the review at least annually. Starting with high-risk areas such as mental health parity, cybersecurity and timely deposit of contributions helps show a prudent, documented process.
Why does audit readiness matter for faith-driven employers?
Christian employers often go beyond the minimum for their people. They offer health coverage, retirement plans and other benefits as an expression of stewardship. Those same plans are subject to federal rules, and the Department of Labor (DOL) has authority to review whether plans follow them.
Preparation is also an act of good stewardship. An employer that can show organized records, clear ownership and regular review is better placed to answer questions calmly, whatever their source. A self-audit does not guarantee any outcome in a government review. It does help an employer understand where it stands.
What does a self-audit actually cover?
A useful self-audit looks at the whole benefits operation, not just one plan document. CEA’s DOL Audit Readiness Tool, available to CEA Employer members, organizes the work into 15 focus areas and 55 readiness items (as of 2026-11-02). The focus areas include:
- Mental health parity and non-quantitative treatment limitations
- Cybersecurity
- Surprise billing under the No Surprises Act
- Benefit distributions and claims
- Retirement asset management
- Timely deposit of contributions
- Governance and documentation
- Transparency and filings under the Consolidated Appropriations Act
- Plan foundation
- HIPAA and privacy
- ACA compliance
- Pharmacy benefit manager oversight
- Financial controls
- COBRA
- Stop-loss oversight
You do not need to be an expert in each area to begin. The goal of the first pass is an honest picture of what is documented, what is partly done and what is missing.
How should an employer score its readiness?
The tool asks you to answer each item as Yes, Partial, No or N/A. Each item carries a risk level and a weight, and the tool calculates points earned against the maximum available, then shows readiness by focus area. This makes it easier to compare areas and decide where to spend limited time.
Be candid. A “Partial” answer that leads to a dated action item is more valuable than a “Yes” that no one can support with a document. Where possible, note where the supporting record lives.
Which areas should come first?
The tool’s own guidance says to watch the high-weight areas first, specifically parity, cybersecurity and deposit timing. A practical order of work looks like this:
- Start with the high-weight items. Address gaps in parity documentation, cybersecurity practices and the timing of contribution deposits.
- Collect the core documents. Gather plan documents, vendor agreements and filings in one organized inventory. The tool includes separate document inventories for health and retirement plans.
- Assign an owner and a target date to every gap. A gap with no name beside it tends to remain open.
- Review vendors. Third-party administrators, pharmacy benefit managers and stop-loss carriers each affect your obligations. Ask for the records you need and keep a log of the requests.
What is a fire drill, and why run one?
A fire drill is a practice response to a records request. Someone on your team is asked to produce a defined set of documents within a set time, and the results are logged. The tool includes a Fire Drill Log for this purpose. The point is not to predict what a reviewer would ask. It is to learn where your records are hard to find before it matters.
How often should the self-audit be repeated?
CEA’s guidance in the tool is to re-run the self-audit and a fire drill at least annually, and after any major vendor, plan-design or personnel change. Keep the dated results. They serve as evidence of a prudent process, though they do not promise any particular result with a regulator.
How does this connect to religious liberty?
Faith-driven plan design raises its own questions, such as how coverage decisions align with conscience and which legal protections apply. Those questions sit alongside ordinary compliance, not in place of it. CEA’s Five Freedoms framework places operational and healthcare freedom among the areas where employers need both clarity and a voice. Strong compliance habits make it easier to defend your convictions with a clean record. To see how CEA has defended employers in court, review the Legal Wins page.
Frequently asked questions
Is a self-audit a substitute for legal advice? No. It is an internal management tool. Employers should consult qualified counsel about specific questions or any government inquiry.
Do I need to finish all 55 items at once? No. Begin with the high-weight areas, save your progress and return. The tool auto-saves and can export results to CSV.
What if my score is low the first time? That is common and useful. A low first score identifies where to focus. Record the date, assign owners and measure again at your next review.
Next step
CEA Employer members get DOL and IRS audit-readiness fire drills, a full HR compliance library and policy templates, along with CEA’s core legal protections for qualifying members. Join CEA to put protection, preparation and a voice behind your organization.
Last reviewed 2026-11-02. This article is general information, not legal advice.