If your company sponsors a 401(k), you are almost certainly a plan fiduciary. Nobody may have ever said that word to you. It's true anyway.
And it isn't a formality. It's a legal duty to run the plan in your employees' best interest, keep the costs reasonable, and be able to show you're doing it. When that duty isn't met, the liability can reach you personally - not just the company. That's the part that surprises business owners: it's your name on it, not just the business's.
Here's how most of these plans got where they are. Someone set it up years ago, and then nobody revisited it.
The fees quietly compounded. The fund lineup drifted. The reviews that are supposed to happen didn't, and nobody wrote down the ones that did. None of it ever felt like a problem, because the exposure doesn't announce itself. It just sits there until an audit, a complaint, or a departing employee's lawyer forces a look.
The fixes aren't exotic. They're mostly about process and documentation:
That last one matters more than it might seem. An advisor who accepts fiduciary responsibility in writing, such as a 3(21) investment fiduciary, is held to a fiduciary standard for every recommendation, not just offering opinions. You keep final authority over the plan, but the investment advice you act on comes with documented accountability behind it.