PLANSPONSOR - August/September 2021 - 26

2021 PLANSPONSOR NATIONAL CONFERENCE
$210 million to $250 million and an increase in participants'
deferral rates, from 7.8% to 8.7%.
The success that Crate and Barrel experienced in its QDIA
upgrade underscores the fact that plan sponsors looking to take
on such a challenge " need a communication strategy, " said
Jennifer Doss, senior director, DC practice leader, at CAPTRUST.
Plan sponsors intrigued by Crate and Barrel's approach
should take up the conversation at the retirement committee
level when there is a catalyst, such as a change in recordkeepers
or other key providers, Doss said. " That's an excellent time " to
make such a bold change, she said.
But sponsors might be overwhelmed with all of the new
retirement income products now coming to market due to the
Setting Every Community Up for Retirement Enhancement
(SECURE) Act and the Coronavirus Aid, Relief and Economic
Security (CARES) Act, said Robert W. Crothers, retirement
group head of product and strategy at BlackRock.
" We aren't trying to make your lives more difficult, " Crothers
said. " While there's no silver bullet for any one plan sponsor, " a
rule of thumb for all sponsors is: Try to find the right solution for
the most people in your plan, he said. -Lee Barney
'Fiduciary Mistakes to Avoid'
Four attorneys and a financial adviser had much to say on the
subject of " Fiduciary Mistakes to Avoid. " Faced with the steady
stream of new regulations and legislation, even the most diligent
plan sponsors can lose sight of some necessary tasks or make a
mistake, the panelists agreed.
" Compliance issues are often interrelated, " observed Percy
Lee, an associate attorney with Ivins, Phillips & Barker.
Along those lines, plan sponsor fiduciaries need to follow
more than just the Employee Retirement Income Security Act
(ERISA) and guidance from the Department of Labor (DOL), he
said. They also need to comply with IRS rules, Health Insurance
Portability and Accountability Act (HIPAA) regulations and state
laws, along with the General Data Protection Regulation (GDPR)
if the firm has a presence in the European Union.
Additionally, plan sponsors need to tell their committees to
document fiduciary discussions and integrate those key points
into their requests for proposals (RFPs).
Sponsors can get help with all of this from their ERISA
attorney, retirement plan adviser/consultant or benefits broker,
Lee said. Important to keep in mind is that not everything is
a " commandment or regulation, " which is why the insights of
fiduciary partners can be so helpful, he said.
One issue in the spotlight right now is the restricted use of
plan participant data, as spelled out in the recent Northwestern
University and Shell lawsuits, Lee said. This should prompt
sponsors and their advisers to hold conversations on data security
and privacy, he continued.
Recent DOL guidance on cybersecurity should make sponsors
aware that they need to increase participants' " online 'street
26 PLANSPONSOR.COM August - September 2021
Moderator W. Michael Montgomery, managing principal
of Montgomery Retirement Plan Advisors, said he sees an
increasing number of plan sponsors going through these simulations,
but because the security findings are so sensitive, most
companies keep those and the discussions at the retirementcommittee
and/or board-of-directors level.
This is where the " use of appropriate experts can help [sponsors]
make the appropriate decisions " with respect to their cybersecurity
protocols, said Michael Rosenbaum, a partner in Faegre
Drinker Biddle & Reath LLP. " There are secrets that they want to
protect. Generally, we see sponsors talk about this in committee
meetings only. "
Another fiduciary duty, said Summer Conley, also a partner
in Faegre Drinker, is to regularly benchmark or conduct due diligence
on plan providers.
But sponsors must also ask themselves, " 'Who else should
I benchmark? What else is overlooked?' " Conley said. " They
should consider anyone providing services that is being paid
for [them] including trustees, auditors, investment consultants,
actuaries and others. They need to benchmark these providers
and select one for a reasonable fee-and there's a range of
'reasonableness.' That's the key point, not that they should pick
smarts' " as to protecting their accounts and personal data, Lee
said. " The DOL guidance affirms the importance of cybersecurity
measures when selecting recordkeepers and other vendors
with access to plan information, " he said. " Sponsors must
conduct due diligence on policies, procedures and track records,
and formalize these commitments into their service agreements.
They must then continue to evaluate them and document that. "
This can be done simply, through educating participants, he
suggested. " The end user has a critical role in reducing harm
from cyberattacks. "
Forward-thinking retirement plan advisers are also using
" red team/blue team exercises " in their cybersecurity efforts, said
Michael Kane, managing director of Plan Sponsor Consultants.
In these exercises, the red team is a group that plays the role
of an enemy or competitor attacking a company's cybersecurity
defenses and provides security feedback from that perspective;
the blue team fights back against the simulated intrusion.
Forward-thinking retirement
plan advisers are also
using " red team/blue
team exercises " in their
cybersecurity efforts.
-MICHAEL KANE
http://www.PLANSPONSOR.COM
PLANSPONSOR - August/September 2021

Table of Contents for the Digital Edition of PLANSPONSOR - August/September 2021
