Which of the following is NOT listed as a deficiency type in the 2014 DOL audit quality study?

• A. Internal Plan Processes
• B. Regulatory requirements
• C. Outside Service Providers
• D. Data Security Controls

Answer: (D)

The question checks which deficiency areas the DOL identified in its 2014 audit quality study. That study grouped deficiencies into three main areas: Internal Plan Processes (how the plan is operated, including recordkeeping and processing), Regulatory requirements (compliance with ERISA rules, notices, filings, and fiduciary duties), and Outside Service Providers (issues in oversight of third-party vendors). Data Security Controls, while crucial in today’s environment, was not listed as a deficiency type in that particular study. The study focused on governance and administrative/operational practices rather than IT security control categories, so data security concerns aren’t part of the deficiency types it enumerated. Therefore, Data Security Controls is the option that doesn’t fit.