Audit Reporting Standards for ICHRAs: 2026 Compliance Guide

TL;DR

Audit reporting standards in the HRA and ICHRA context refer to the federal rules under the ACA, ERISA, HIPAA, and the Internal Revenue Code that dictate what documentation employers must create, file, retain, and produce during a government audit. Employers offering an ICHRA must file specific IRS forms, maintain plan documents for at least seven years, and track affordability calculations. Failing to meet these standards can trigger penalties exceeding $300 per form, with aggregate caps reaching into the millions.

Employers offering an Individual Coverage HRA need to understand exactly which rules apply to them and what records to keep. This glossary entry breaks down every major requirement, form, deadline, and penalty so you can stay audit-ready without guesswork.

See how SimplyHRA helps employers maintain audit-ready documentation from day one.

Why Audit Reporting Standards Matter for HRA Employers

HRAs are classified as self-funded group health plans under the Internal Revenue Code, ERISA, and the Public Health Service Act. That classification pulls them into the orbit of multiple overlapping federal reporting regimes. There is no single “HRA audit reporting standard.” Instead, employers face a patchwork of requirements from the IRS, the Department of Labor (DOL), and the Centers for Medicare & Medicaid Services (CMS), each with its own forms, deadlines, and penalties.

The financial stakes are real. For the 2025 reporting year, penalties for failing to file Form 1095-C with the IRS range from $60 per form (if corrected within 30 days) to $340 per form if left uncorrected before August 1. Large employers can face aggregate caps exceeding $4 million. The 2026 ACA employer mandate penalties climb to $3,340 per full-time employee under Section 4980H(a) and $5,010 per employee under Section 4980H(b), according to IRS Revenue Procedure 2025-26. These are not theoretical numbers. Information reporting errors tend to be systemic, meaning a single mistake in your process can multiply across every employee, every year.

For a deeper breakdown of penalty amounts and avoidance strategies, see this ACA employer penalty guide.

Key Regulatory Frameworks Behind Audit Reporting Standards

Understanding which laws create which obligations is the first step toward compliance. Here are the six frameworks that matter most.

ACA Sections 6055 and 6056 Reporting

The Affordable Care Act requires employers offering ICHRAs to report that they provided minimum essential coverage and, for Applicable Large Employers (ALEs), that the offer met affordability requirements. The specific forms depend on employer size:

• Non-ALEs (fewer than 50 FTEs) file Forms 1094-B and 1095-B to report that MEC was offered.
• ALEs (50 or more FTEs) file Forms 1094-C and 1095-C to report the offer of coverage, affordability details, and enrollment status.

A critical update: the IRS finalized regulations requiring electronic filing beginning in 2025. Any business filing 10 or more returns of any type must now file electronically. This means paper filing is effectively gone for almost every employer with an ICHRA.

If you need help understanding the specific line codes on these forms, this guide on ICHRA-specific 1095-C codes walks through the details.

ERISA Plan Document and Disclosure Requirements

ERISA treats HRAs as group health plans, which triggers several obligations. Employers must maintain a formal written plan document that defines eligibility rules, reimbursement processes, and fiduciary duties. They must also furnish a Summary Plan Description (SPD) to participants within 120 days of plan adoption.

For plans with 100 or more participants, Form 5500 must be filed annually with the DOL. Plans with fewer than 100 participants that are unfunded or fully insured generally qualify for the small plan exemption. Missing this filing can cost up to $1,100 per day the report is late.

HIPAA Privacy Rules

Because HRAs are self-funded health plans, they handle protected health information. Any entity processing HRA claims, whether the employer or a third-party administrator, must comply with HIPAA Privacy Rules. Violations carry significant financial and criminal penalties. This is one area where using an ICHRA platform with built-in compliance features reduces exposure considerably.

PCORI Fee (Form 720)

The Patient-Centered Outcomes Research Institute fee applies to most HRAs, including ICHRAs. Employers report and pay this fee using IRS Form 720, due July 31 each year. For plan years ending on or after October 1, 2025, the fee is $3.84 per covered life, up from $3.47 for earlier plan years.

Form 5500 (ERISA Annual Reporting)

As noted above, this filing applies to plans that don’t qualify for the small plan exemption. Calendar-year plans must file by July 31. It is one of the most commonly overlooked audit reporting standards for employers who assume their HRA is too small to trigger ERISA filing.

Medicare Secondary Payer (Section 111) Reporting

Employers with 20 or more employees offering an ICHRA with an annual allowance of $5,000 or more must report quarterly whether the ICHRA serves as the primary payer for employees enrolled in Medicare. HRAs with an annual benefit under $5,000 are exempt from Section 111 reporting.

Forms, Deadlines, and Filing Standards at a Glance

This table consolidates every major form connected to HRA audit reporting standards.

Virtually all of these filings must now be submitted electronically under the 2025 IRS mandate for businesses filing 10 or more returns.

For employers trying to understand whether they need 1095-B or 1095-C, this comparison of Form 1095-A vs. 1095-C clarifies the distinctions.

ALE vs. Non-ALE: How Reporting Obligations Differ

Employer size determines which audit reporting standards apply. The table below summarizes the key differences.

A common source of confusion: ICHRA benefits do not need to be reported on employees’ W-2s, regardless of employer size. This is different from QSEHRAs, where the total benefit must appear in Box 12 using code FF. Getting this wrong can create unnecessary panic during audit prep.

Record Retention Requirements

Multiple federal rules govern how long employers must keep ICHRA documentation. They don’t all agree on the timeline, so the safest approach is to use the longest period as your baseline.

• IRS recommendation: Seven years for all HRA-related records, including allowance amounts, claim documentation, and approval/denial decisions.
• ERISA Section 107: Six years for records related to disclosures required under the act.
• IRS employment tax records (26 CFR § 31.6001-1): Four years minimum.

The practical answer: keep everything for seven years. This satisfies the IRS recommendation, exceeds ERISA’s six-year rule, and provides a buffer against extended statutes of limitation. “Everything” includes plan documents, SPDs, employee notices, MEC verification records, affordability calculations, reimbursement records, and all IRS filing copies.

Common Mistakes That Trigger Audit Risk

Practitioners and compliance advisors consistently flag the same errors when it comes to ICHRA audit reporting standards.

Misclassifying Employee Classes

Setting up employee benefit classes incorrectly is one of the fastest ways to invite compliance trouble. Misclassification can create gaps in coverage or violate nondiscrimination rules. Employers sometimes group employees in ways that seem logical operationally but don’t align with the permissible class categories under ICHRA regulations. For guidance on getting this right, see this article on designing compliant employee classes.

Failing Affordability Calculations

ALEs must prove that their ICHRA offer meets ACA affordability standards, typically using the lowest-cost silver plan (LCSP) safe harbor. Practitioners on Reddit and in compliance forums report that managing LCSP premium data is one of the trickiest parts of ICHRA administration. The challenge is especially acute in states that don’t use the federally facilitated exchange, where this data is harder to access. LCSP premiums are age-banded by zip code or FIPS code, making the calculation complex for employers with workers in multiple locations.

For a full walkthrough of these calculations, this 2026 ICHRA affordability guide covers the specifics.

Skipping MEC Verification Before Reimbursements

Employers must verify that an employee has minimum essential coverage before issuing the first ICHRA reimbursement. Skipping this step, or not documenting it, creates a compliance gap that auditors will catch. Learn more about MEC verification requirements and why they matter.

Not Furnishing Forms to Employees

Filing Forms 1095-B or 1095-C with the IRS is only half the obligation. Employers must also furnish copies to employees. Missing the employee distribution deadline is a separate violation with its own penalties.

Overlooking Deadlines

Late filings are among the most common and most preventable audit triggers. With the electronic filing mandate now in effect, employers who previously relied on paper filing and its later deadlines need to adjust their calendars.

If you want a second opinion on your compliance setup, book a free consultation to review your current processes.

Audit Reporting Standards vs. Financial Audit Standards

A quick disambiguation, because this causes confusion. In accounting, “audit reporting standards” typically refers to Generally Accepted Auditing Standards (GAAS) issued by the AICPA, or the standards set by the Public Company Accounting Oversight Board (PCAOB) for public companies. Those are about how auditors conduct and report on financial statement audits.

In the HRA and ICHRA context, audit reporting standards refers to something entirely different: the body of IRS, DOL, ERISA, ACA, and HIPAA rules that govern what documentation employers must create, file, retain, and produce during a federal compliance audit. This glossary entry covers the latter.

How to Stay Audit-Ready

Audit readiness is not a one-time project. It requires ongoing systems and habits. Here is what keeps employers on the right side of audit reporting standards:

Maintain foundational documents. Every ICHRA plan needs a written plan document (required by ERISA before the plan starts), an SPD (within 120 days of adoption), and a Summary of Benefits and Coverage distributed before enrollment.

Send required notices on time. The 90-day advance ICHRA notice to employees is a hard deadline. Creditable coverage notices to CMS must go out before October 15 each year.

Track and document everything. Allowance amounts, claims submitted, approval or denial decisions, MEC verification records, and affordability calculations all need to be documented and retained for seven years.

Automate where possible. Manual tracking in spreadsheets works until it doesn’t. Practitioners in small business forums consistently mention that the complexity of ICHRA compliance, particularly around affordability calculations and 1095 form generation, pushes them toward using a dedicated TPA or platform.

Run periodic self-audits. Don’t wait for an IRS or DOL letter. Review your filings, records, and employee notices at least once a year. This guide on running benefit audit reports quickly can help streamline that process.

Consider a third-party administrator. For most employers, especially those offering an ICHRA for the first time, working with a platform that handles compliance documentation, form generation, and record retention removes the biggest points of failure.

Schedule a demo to see how SimplyHRA’s audit-ready reporting works in practice.

Frequently Asked Questions

What are audit reporting standards for ICHRA employers?

Audit reporting standards in the ICHRA context are the combined federal rules under the ACA, ERISA, HIPAA, and the Internal Revenue Code that specify which documents employers must create, which forms they must file, how long records must be retained, and what must be produced during an IRS or DOL audit.

How long should I keep ICHRA records?

The IRS recommends seven years for HRA-related records. ERISA Section 107 requires six years for disclosure-related records. The safest approach is to retain all ICHRA documentation, including claims, plan documents, and filing copies, for a full seven years.

Do I need to report ICHRA benefits on employee W-2s?

No. Unlike QSEHRAs (which require W-2 reporting in Box 12, code FF), ICHRA benefits do not need to appear on employees’ W-2 forms. This applies regardless of whether you are an ALE or a non-ALE.

What triggers an ICHRA compliance audit?

Common triggers include late or missing IRS filings (Forms 1095-B/C), inconsistencies in affordability reporting, employee complaints, and data mismatches between what you file and what employees report on their tax returns. Systemic errors that affect filings for every employee are particularly likely to draw attention.

What is the difference between ALE and non-ALE reporting requirements?

ALEs (50 or more full-time equivalent employees) must file Forms 1094-C and 1095-C, demonstrate affordability using the LCSP safe harbor, and comply with the employer mandate. Non-ALEs file Forms 1094-B and 1095-B and are not subject to affordability testing or mandate penalties.

What happens if I miss the Form 5500 filing deadline?

The DOL can impose penalties of up to $1,100 per day for late or missing Form 5500 filings. However, many small ICHRA plans (fewer than 100 unfunded participants) qualify for an exemption from this requirement.

Is electronic filing now required for all employers?

Effectively, yes. Starting in 2025, any business filing 10 or more returns of any type must file electronically. Since most employers with an ICHRA also file payroll tax returns, W-2s, and other forms, the 10-return threshold captures virtually everyone.

How much is the PCORI fee for ICHRA plans?

For plan years ending on or after October 1, 2025, the PCORI fee is $3.84 per covered life. It is reported and paid using IRS Form 720, due by July 31 each year.

Explore more terms in the full ICHRA glossary.