With American businesses slowly moving back to normal—and new plan services and useful technologies emerging regularly—it may be prudent to help your clients revisit the recordkeeper marketplace.

“It’s a good best practice to take a plan out to bid every three to five years,” says Kristen Deevy, managing director of retirement plans at Pensionmark Financial Group in Denver. “It’s worth going through the process of doing an RFI [request for information] because, even though the sponsor could be happy as a clam with its current provider, other providers may offer services that the plan sponsor is unaware of. Plan fiduciaries need to make sure they document that they’re looking at fees and services in the marketplace,” she adds.

An RFI is far from just a static list of topics, because new issues have likely cropped up since a sponsor last shopped for a recordkeeper. Here are five such issues to consider:

1) Cybersecurity specifics. Deevy says Pensionmark asks recordkeepers to provide an overview of their proactive cybersecurity measures and to supply details as to, for example: their cybersecurity risk-assessment process, steps they take to do data encryption, and processes they have for ongoing training and monitoring of staff who have access to participant data. “Many recordkeepers now have white papers or documents on what they’re doing,” she says.

In an RFI, Morgan Stanley now asks recordkeepers whether they have a cybersecurity policy statement, says Julie Braun, financial adviser and corporate retirement director at The Dubie Group at Morgan Stanley, in Colchester, Vermont. “We’ve already seen sponsors do investment policy statements [IPSs] and education policy statements,” she says. “Now, we’re going down the road of asking recordkeepers for a cybersecurity policy statement.” She says the policy should offer details such as how the recordkeeper authenticates the identity of a participant trying to access a participant account, which of its employees get access to participants’ account data, and what security procedures it has to protect data transfers between itself and payroll providers.

It also helps to ask recordkeepers whether they have had an outside audit of their cybersecurity processes, says Nicole Corning, managing partner at Buckman & Corning Financial Strategies Group in Scottsdale, Arizona. Some have only an internal policy, but hiring a third-party cybersecurity company can more objectively assess whether the recordkeeper’s cybersecurity measures are adequate, she says. “These outside companies will sign off on how rigorous the protocols are, instead of the recordkeeper’s self-certification, and that’s important.” Using an outside firm confirms it follows strict industry standards, Corning says.

2) The use of participant data for ancillary-service promotion. Whether and how recordkeepers use a participant’s data to market their products and services to him is increasingly being scrutinized in lawsuits; several recent excessive-fee cases have also addressed who owns this data and whether plan sponsors have a fiduciary duty to protect it. “The issue is that there’s an opportunity for the recordkeeper, with its captive audience of participants, to use that data to sell participants something at a higher fee than they would pay otherwise,” says Michael Duckett, a retirement consultant at Lockton Companies in Washington, D.C. “We’ll ask recordkeepers in an RFI, ‘Do you use participant data for any purpose other than running the 401(k) plan?’”

Invariably, the answer is “yes,” Duckett says. “So we help the plan sponsor understand how the recordkeeper uses that data: We want to make sure the sponsor understands, ‘Here’s what they’re doing with the data, and here’s what you can and can’t opt out of,’” he says. If a recordkeeper uses participants’ data to call and try to sell them its wealth management services, for example, he says, sponsors may feel concerned about it. “There are many ways this data could be used—not just the obvious ones. It’s an area where things are developing quickly, so it’s important that we ask that question every time we do an RFI.”

Most committees Corning works with have had no issue with it so far, because much of the contact has been to offer financial wellness services that can give their participants meaningful help. “The committees view it more as a matter of, ‘Are you seeing what our participants need and helping them meet those needs?’” she says. “As an adviser, I don’t like to see the commoditization of participants, but there’s a fine line between commoditization of participants and actually giving them services that are helpful to them.”

It can be useful for an adviser to talk with client committees about where they would like to draw the line on the recordkeeper’s use of participant data. “I think the line will shift depending on who’s on a committee,” Corning says. “But it’s important for an adviser to understand what level of commoditization is happening with participants—what kinds of things a plan’s participants will be solicited for—and bring it to the committee’s attention.”

3) Integration of ancillary savings programs. Student loan repayment programs and emergency savings programs have become the No. 1 and No. 2 most urgent issues Corning hears about from her employer clients. “Right now, every business owner I know is trying to recruit and retain employees. I don’t think any is fully staffed right now,” she says. “So employers are desperate for ways to give benefits to people that some other companies may not be offering.” Plan sponsors and human resources (HR) professionals also hear from employees about their financial stress concerning these issues, she says.

Many recordkeepers are just now trying to integrate ancillary savings programs, Deevy says. “More than anything, employers wonder, ‘If we add one of these, how will this impact us administratively? Will it mean more work?’ So anything a recordkeeper can do to streamline that process is helpful.”

Every recordkeeper’s ancillary savings program setup is different right now, says Mark Beaton, a Denver-based vice president at OneDigital Retirement & Wealth. “Often they work with only certain vendors. Personally, I’d love to see more integration between recordkeepers and the vendors they don’t already work with,” he says, because that would present a more holistic picture of participants’ financial lives. “On the other hand, my concern is bundling and having all your eggs in one basket: There’s always risk when a plan utilizes one recordkeeper for all of its services.” The participants may not receive best-in-class products or services for everything.

The ability to integrate these programs differs among recordkeepers, and in some cases that is by design, Duckett says. “Some providers have strategic relationships with particular student debt repayment or emergency savings vendors. Maybe they’ve built a ‘bridge’ with two or three or four vendors, and they don’t plan to build one with the others at this point,” he says. “So in an RFI, we always ask the recordkeepers: ‘Which providers are you integrated with? And what does that integration feel like: How does a participant access the ancillary program from your website?’ Also, does the recordkeeper get paid a commission if a participant uses the ancillary program?” And does the employer platform allow for participants to direct employer match dollars into the recordkeeper’s student loan debt repayment program or emergency savings program?

4) Financial wellness program user-friendliness. “Having financial wellness tools is table stakes for recordkeepers,” says Braun. “The differentiators now are things such as whether they have a mobile app that’s fully functional for participants.” Such apps would let a participant initiate changes such as an investment trade or deferral amount increase.

RFIs can also give a sense of how much a recordkeeper personalizes its financial wellness communications for different employee demographics, Braun says. Many recordkeepers now have a huge quantity of financial wellness information and tools. “How does the recordkeeper try to streamline its financial wellness content?” she says. “How does it funnel the right content to the right person, at the right time? You don’t want to talk to a 20-year-old about Social Security.”

How participants can access personalized financial wellness advice—whether through a call center or online—is a topic Duckett says is worth exploring in an RFI. “How easy is it for participants to get the financial wellness advice they need, wherever they are and when they need that advice? Can the participant get that advice in 15 minutes instead of two hours?” he says. “Also, how easy is it to make changes [such as a deferral increase] in response to that advice?”

5) Who will supply financial wellness advice. These days, Duckett says, a recordkeeper can distinguish itself by taking on fiduciary responsibility for the one-on-one financial wellness advice it gives. He says most do not, so it should be asked about in the RFI. He also suggests asking how the recordkeeper’s staff members who give the advice are compensated. At some recordkeepers, these staffers earn a commission based on investment choices made by a program participant they have advised, he says. At others, he notes, the staffer receives a salary plus a bonus based on survey feedback from the participants.

At least one large recordkeeper has utilized registered representatives to have financial wellness conversations with program participants, during which they sold them the recordkeeper’s proprietary investment products, says Barbara Delaney, principal and founder of StoneStreet/Renaissance (SSRBA), a part of Hub International, in Pearl River, New York. She and her advisory colleagues prefer to be the ones offering the one-on-one advice. “The recordkeepers know we’re fiduciaries for the plan and they’re not,” she says. “As the adviser, we have the fiduciary processes in place, and it’s a natural extension for the sponsors to trust us to give that advice to participants.”

But Delaney sees differences in recordkeepers’ willingness to integrate an advisory firm’s financial wellness services with their financial wellness program, so it is good to ask about it in an RFI. “They have to collaborate with us,” she says. “We want to make sure we’re controlling the participant experience and that we’re co-fiduciaries on it.” That is becoming an even more urgent issue to resolve, she says, adding, “I can’t tell you the number of employees at our clients who are thinking about retiring, and there is such a demand for being able to talk to someone about it.”