Now with EPCRS, we are told, being on the verge of release, and with 403(b) audits beginning to enter a new, what I would call “normalized,” stage, the 2007 regs will truly be put to the test. I have long been critical of those regs as being far more complex than necessary, and as being based-in part-on a basic misconception that 401(a) plans and 403(b) plans are similar in too many respects.  This second point has been implicitly recognized by the good work of  both the DOL and the IRS in their efforts subsequent to the issuance of the regs to address some of the more glaring problems which the regs brought into play.
At the heart of the problem is the statute itself: Code Section 403(b) is still more like an IRA in many ways than a qualified plan. The tax impact and benefits are fully directed at the individual not the employer. 
Where this will have its impact is when you have to drill down and attempt to apply the regs in detail to any particular fact circumstance, as we are now attempting to do. Take, for example, any attempted application of the plan document “form and operation” rule (which is, at is heart, a 401(a) rule). Assume  a case where either the employer or the IRS discovers that elective  deferrals to an individual contract violated the manner in which the 15 year catch-up and the age 50 catch should have been coordinated for the past 3 years, and that $9,000 needs to be disgorged from the plan. If the individual contract gives the employer no right to order a corrective distribution from the contract, and the participant refuses to take a distribution, the plan has clearly violated the plan document “form and operation” rule  (and VCP has failed because  a corrective distribution was not made), and the plan would not qualify for 403(b) treatment.  What is the sanction then, where, legally, the employer has no tax liability for a failed 403(b) plan? Is the employer assessed for the tax on the $9,000;  or is the base for the sanction the tax on all amounts in the 403(b) plan-but what is the legal basis for either of these actions?  At least under the VCP portion of EPCRS, it could be imposed as a condition for the favorable treatment under the program, but what happens under audit/audit CAP? 
There is actually a whole host of issues like this. As a practical matter, IRS 403(b) audits have been,  well, practical, up to now. But as “institutionalization” seeps in, with more 403(b) agents, with EPCRS finalizing, formality will begin to impose itself. And I would expect technical application of the questionable portions of the regs to begin to run into rough sailing.