How to Get Audit Ready HRA Reports for Treasury (2026)

TLDR

Audit-ready HRA reports are traceable records that connect every allowance, coverage verification, reimbursement decision, and payment back to source documentation. “Treasury” can mean your internal finance team (who needs clean payroll and ledger data) or the U.S. Department of the Treasury/IRS (who needs proof that reimbursements qualify for tax-free treatment). Getting audit-ready HRA reports for treasury requires seven core reports covering plan governance, eligibility, coverage substantiation, claim substantiation, payroll reconciliation, ACA/PCORI support, and exception tracking.

What Are Audit-Ready HRA Reports for Treasury?

An audit-ready HRA report is not a single form you download once a year. It is a package of organized, source-backed records showing how an employer’s Health Reimbursement Arrangement was designed, who qualified, what coverage was verified, which expenses were reimbursed, how payments were made, and how all of that ties to payroll, tax filings, and compliance obligations.

The word “treasury” in this context means two different things, and both matter.

Internal treasury or finance function. This is the employer’s accounting, payroll, and cash management team. They need reports that reconcile approved reimbursements to ACH batches, payroll periods, GL entries, and bank activity. Their question is straightforward: did the right amount move at the right time?

U.S. Department of the Treasury and the IRS. The IRS, Treasury, DOL, and HHS issued final rules in 2019 allowing Individual Coverage HRAs to integrate with individual health insurance or Medicare when specific conditions are met. For federal compliance, audit-ready reports must prove that reimbursements were for substantiated medical care expenses and that required coverage was in place each month.

A report is audit-ready only when someone (an auditor, a controller, an IRS examiner) can follow the trail from plan design to employee eligibility to substantiated claim to payment to annual filing. Anything less is just a spreadsheet.

Explore ICHRA for employers to see how plan setup, employee classes, and reporting connect in practice.

Why Audit-Ready HRA Reports Matter

There are five practical reasons to care about getting audit-ready HRA reports for treasury, whether you are in HR, finance, or a broker advising a client.

They protect tax-free treatment. HRAs are funded solely through employer contributions and cannot be funded by employee salary reductions under a cafeteria plan. Reimbursements for qualified medical expenses are excludable from income. But that favorable treatment depends on proper substantiation. If your records cannot prove a reimbursement was for a qualifying expense, the amount could be reclassified as taxable compensation.

They support ACA reporting. An ICHRA is generally treated as a self-insured group health plan. That means applicable large employers need to file Forms 1094-C and 1095-C, and smaller self-insured employers typically use Forms 1094-B and 1095-B. Reconstructing monthly eligibility, offer codes, and affordability data in January is painful if you did not track it all year.

They help finance reconcile cash and payroll. Practitioners on LinkedIn identify payroll integration as a major scaling bottleneck for ICHRA, pointing to stale eligibility data, lagging termination events, and manual reconciliation labor as downstream consequences of poor data flow. Treasury-ready reports close that gap.

They reduce year-end scrambling. PCORI fees, Form 5500 eligibility checks, Medicare Section 111 screening, and ACA form coding all have specific data requirements. Building those reports incrementally throughout the year is far easier than reverse-engineering them under deadline pressure.

They limit unnecessary PHI exposure. HIPAA controls when a group health plan can share protected health information with the employer or plan sponsor for administration. Role-based reporting keeps finance teams focused on amounts and dates, not medical details they should not be seeing.

The 7 Reports Every Audit-Ready HRA Package Should Include

Most competing guides list filing obligations and deadlines. That is useful but incomplete. What finance, HR, and compliance teams actually need is a defined set of reports they can produce on demand. Here is the framework.

1. Plan Governance Report

This report proves the HRA exists as a formal arrangement and shows what rules apply. It should include the plan name, plan sponsor, administrator, plan year dates, current plan document version, SPD version, any summaries of material modifications, eligible employee classes, allowance rules, permitted expense categories, runout period details, and the claims and appeals process.

DOL guidance requires plan administrators to provide participants with important plan information through SPDs, generally within 90 days of enrollment. If someone asks “what were the plan rules for 2025?” and you cannot answer with a document, your reports are not audit-ready.

2. Eligibility and Employee Class Report

This report shows who was eligible, when, and under what class rules. It should capture employee ID, employment status, hire and termination dates, waiting period status, ICHRA class assignment, allowance amount (including proration if applicable), dependent eligibility, opt-in or opt-out status, and effective dates.

ICHRA rules require same-terms treatment within a class. Employers cannot offer both an ICHRA and a traditional group health plan to the same class. If your eligibility data cannot demonstrate compliance with class rules, you have a gap.

For guidance on structuring classes correctly, see designing eligibility criteria for benefit classes.

3. Coverage Substantiation Report

This is the report most often missing from self-administered HRAs. It shows that every reimbursed month had qualifying individual health insurance or Medicare coverage in place.

The ICHRA final rules require both annual and ongoing substantiation. The employer can accept a participant attestation stating enrollment, coverage start date, and carrier name, or rely on third-party documentation from an issuer or Exchange. But the employer cannot reimburse a month where coverage is not substantiated, unless it has no actual knowledge of a gap.

The report should include: employee and dependent IDs, coverage month, coverage type, carrier name, proof source (issuer document, attestation, insurance card), attestation date, and any exceptions or missing proof.

4. Claim and Reimbursement Substantiation Report

Each reimbursement needs a traceable paper trail. The IRS requires that HRA reimbursements be for medical care expenses that have been substantiated before payment, and each claim generally needs certification that the expense was not reimbursed elsewhere.

The report should include claim ID, employee ID, service or premium month, date incurred, date submitted, expense category, requested amount, approved amount, denied amount with reason, supporting document type, employee double-reimbursement certification, approval timestamp, and reimbursement method.

For a deeper walkthrough of this process, see approving and paying reimbursement claims.

5. Payroll, ACH, and Ledger Reconciliation Report

This is where internal treasury teams spend the most time. The report ties approved reimbursements to actual cash movement.

It should include: approved reimbursement amount, payment date, payroll period and batch ID, ACH batch ID, employee premium deduction (if the employee’s premium exceeds the allowance), employer reimbursement amount, debit card transaction ID if applicable, GL account and cost center, journal entry ID, unpaid approved amounts, voids and reversals, and any variance between approved and paid amounts.

A Reddit user in r/QuickBooks described struggling to record ICHRA reimbursements, deductions, and payroll items correctly, saying they were “failing at administering” the arrangement. This is common. Self-administered plans often break down exactly here because payroll, reimbursement, and ledger records live in separate systems with no automated tie-out.

When allowances only partially cover premiums, the reconciliation gets more complex. See handling partial HRA reimbursements for practical guidance.

6. ACA, IRS, and PCORI Reporting Support Report

This report feeds your annual compliance filings.

For ACA reporting, it should include ALE status, full-time employee month count, offer-of-coverage indicators by month, ICHRA-specific Form 1095-C line 14 codes, employee required contribution, affordability method and safe harbor used, ZIP or rating area source, and lowest-cost self-only silver plan amount. For a detailed breakdown, see Forms 1094-C and 1095-C reporting.

For PCORI, it should include average covered lives and the applicable fee rate. Plan sponsors of applicable self-insured health plans report and pay the PCORI fee on Form 720, due July 31 of the calendar year after the plan year ends. For plan years ending after September 30, 2025, and before October 1, 2026, the fee is $3.84 per average covered life.

Deadlines shift by tax year and weekend rules. Always verify the current IRS instructions rather than relying on last year’s calendar.

7. Medicare, HIPAA, and Exception Report

This report captures the edge cases that create real audit risk. It should include Medicare-eligible participant flags, annual HRA benefit value, Section 111 threshold screening (CMS says HRA coverage with an annual benefit of $5,000 or more is reportable), COBRA and continuation status, PHI access logs and user roles, denied claims, terminated employee access cutoffs, late reimbursement exceptions, and policy override notes.

One update worth noting: CMS’s Contract Year 2027 final rule exempts account-based plans like HRAs from Medicare Part D creditable coverage disclosure requirements. Competitors that still list “Medicare Part D notice by October 15” without this update are stale. Verify how this applies to your plan year.

How to Get Audit-Ready HRA Reports: Step by Step

Knowing which reports you need is the first half. Producing them is the second. Here is the process.

Step 1: Start with your plan document, not your reimbursement spreadsheet. The entire report package should anchor to the written plan terms. Who is eligible? What is reimbursable? What documentation is required? When are reimbursements paid? How does the plan handle runout, termination, COBRA, and appeals? If your plan document is vague or outdated, your reports will inherit those gaps.

Step 2: Capture coverage proof before reimbursement. For ICHRAs, do not reimburse a premium or medical expense unless the month of coverage is substantiated. The final rules allow written attestations or third-party documents and require substantiation both annually and with each reimbursement request. One Reddit user in r/HealthInsurance described having to upload the same monthly premium bill every month to get reimbursed, even though bills were on autopay. That kind of friction signals poor workflow design and creates substantiation gaps when employees stop uploading.

Step 3: Tie each reimbursement to source documentation. Every approved claim should have a claim ID, proof of eligible expense, employee certification against double reimbursement, approval timestamp, and payment record. No shortcuts.

Step 4: Reconcile HRA approvals to payroll and bank activity. For internal treasury, this is the critical tie-out. Approved reimbursements must match paid reimbursements, which must match posted payroll or ACH entries, which must match GL. If any of these numbers disagree, you have either a timing issue or a data integrity problem. Both need resolution before the reports qualify as audit-ready.

Wondering whether your current setup can handle this? Talk through your reporting setup with a benefits specialist.

Step 5: Build annual reporting support before year-end. Do not wait until January to reconstruct employee classes, monthly eligibility, ICHRA offer codes, affordability support, or covered lives. IRS instructions for 2025 coverage reported in 2026 required Forms 1094-B/1095-B and 1094-C/1095-C by early March for paper and late March for electronic filing. Reconstructing this data months later is error-prone and expensive.

Step 6: Review Medicare and PCORI triggers. Flag whether your plan needs PCORI support and whether Medicare Secondary Payer or Section 111 reporting applies. These are easy to miss and awkward to discover mid-audit.

Step 7: Restrict PHI access. Finance teams need amounts, dates, employee IDs, payroll batches, and GL codes. They do not need EOB details, diagnosis information, or medical receipts. Keep PHI-bearing documents in controlled systems with role-based access and give treasury a de-identified or limited report wherever possible.

Treasury-Ready vs. IRS-Ready HRA Reports

These two audiences want different things from the same data. The table below clarifies the split.

When someone asks how to get audit-ready HRA reports for treasury, clarify which “treasury” they mean. The answer shapes the report package.

Common Mistakes That Make HRA Reports Not Audit-Ready

1. Keeping reimbursements but not proof of coverage. ICHRAs require substantiation of individual coverage or Medicare enrollment for each covered month. A reimbursement ledger without monthly coverage verification is not audit-ready.

2. Treating employee deductions as HRA funding. HRAs must be employer-funded. Employee payroll deductions may cover a premium shortfall (the portion exceeding the allowance), but that is separate from HRA funding. Mixing these up in reports creates confusion and potential compliance issues.

3. Not tying reimbursements to payroll. An ICHRA infrastructure discussion on LinkedIn noted that front-end enrollment has improved across the industry, but back-end data flow remains manual for many employers, with stale eligibility, lagging terminations, and monthly reconciliation labor as persistent problems.

4. Ignoring ACA affordability support for ALEs. Applicable large employers offering ICHRAs must support affordability determinations and use the correct Form 1095-C codes. For 2026, the ACA affordability percentage is 9.96% of household income. An employee offered an ICHRA generally cannot claim a Marketplace premium tax credit unless the ICHRA is unaffordable and the employee opts out.

5. Forgetting PCORI. PCORI fees apply to self-insured health plans, including many HRA arrangements. Missing the July 31 Form 720 deadline is an avoidable error that shows up in audits.

6. Giving finance unnecessary PHI. Treasury needs payment data, not medical records. Sending EOBs or receipts to the accounting team without proper controls creates HIPAA risk.

7. Assuming Medicare reporting never applies. CMS says HRAs with annual benefits of $5,000 or more are subject to Section 111 reporting. If your plan covers Medicare-eligible employees or dependents at that benefit level, someone needs to determine whether reporting applies and who the responsible reporting entity is.

8. Waiting until tax season to explain PTC consequences. One Reddit user in r/tax discovered an ICHRA late through a 1095-C and ended up owing more than $1,000 related to advance premium tax credit treatment. Audit-ready reporting should include opt-out status, affordability data, and notice delivery records so employees are not blindsided.

If you are hitting several of these issues, it may be time to evaluate whether a third-party HRA administrator can close the gaps.

Example: What an Audit-Ready HRA Report Should Prove

A full-time employee receives a $500 monthly ICHRA allowance. She buys an individual major medical plan for $650 per month. The employer reimburses $500, and the employee pays the remaining $150.

Here is what the audit-ready report package should show for a single month:

• The employee belongs to an eligible ICHRA class with a $500 monthly allowance.
• The employee had qualifying individual health coverage for that month, verified by an attestation or carrier document.
• A premium invoice or proof of payment supports the $650 premium.
• The employee certified the expense was not reimbursed through another arrangement.
• $500 was approved, with a claim ID and approval timestamp.
• $500 was paid through payroll or ACH, with a batch ID and payment date.
• The $150 employee share was handled through the correct payroll or deduction workflow.
• The transaction posted to the correct GL account and cost center.
• The month is reflected accurately in ACA reporting support (offer code, affordability data, coverage month).
• Source documents and timestamps are retained.

If any step in that chain is missing or cannot be reconstructed, the report is not audit-ready. It is just data.

Audit-Ready HRA Report Checklist

How Long Should HRA Reports Be Retained?

Take a conservative approach. IRS ACA information return support should generally be retained (or reconstructible) for at least three years from the due date. ERISA filing support may require at least six years from the filing date under ERISA section 107. Plan documents, SPDs, and notices should be kept even longer, because claims, audits, litigation, COBRA disputes, and participant questions can surface years after a plan year ends. Confirm your retention policy with counsel or a tax adviser.

Frequently Asked Questions

Are audit-ready HRA reports required by law?

No single report called an “audit-ready HRA report” is required by that name. The phrase describes a set of records that support required compliance obligations: coverage substantiation, claim substantiation, ACA information reporting, PCORI fee support, ERISA documents, and payroll reconciliation. ICHRA rules require reasonable procedures for substantiation, and HRA reimbursements must be for substantiated medical care expenses.

What should finance or treasury ask HR for?

Finance should ask for a report tying approved reimbursements to payroll or ACH payments, GL coding, unpaid accruals, employee premium deductions, reversals, and exceptions. Finance generally does not need medical receipts or EOB details. Those should stay in restricted systems because HIPAA limits how group health plan PHI can be shared with plan sponsors.

Which ACA forms apply to ICHRA reporting?

It depends on employer size. A non-ALE (fewer than 50 full-time equivalent employees) self-insured employer generally uses Forms 1094-B and 1095-B for minimum essential coverage reporting. An applicable large employer generally uses Forms 1094-C and 1095-C. An ICHRA is treated as a self-insured group health plan for these purposes.

Can an ICHRA reimburse Medicare premiums?

Yes, if the ICHRA is properly integrated with Medicare and applicable conditions are met. The final rules allow ICHRAs to integrate with Medicare Parts A and B together or Medicare Part C. An ICHRA integrated with Medicare may reimburse Medicare Parts A, B, C, or D premiums and Medigap premiums.

Does Section 111 reporting apply to ICHRAs?

It can. CMS says HRAs are group health plans subject to Medicare Secondary Payer provisions and Section 111 reporting, but only HRA coverage with an annual benefit of $5,000 or more triggers the reporting obligation. HRAs below that threshold are exempt. Employers should identify who the responsible reporting entity is and whether reporting applies.

What makes an HRA reimbursement report audit-ready?

At minimum, it should show who was eligible, what allowance applied, what coverage was verified, what expense was submitted, what documentation supports the claim, what amount was approved or denied, who or what approved it, when payment occurred, and how the payment tied to payroll, ACH, and the general ledger.

Do I need software to produce audit-ready HRA reports for treasury?

Not technically, but self-administration is where audit readiness tends to fail first. When payroll, reimbursement tracking, substantiation, and ledger records live in separate spreadsheets, reconciliation becomes manual and error-prone. A benefits practitioner on LinkedIn put it well: ICHRA administration requires direct connections to carriers, brokers, CMS, and people who can solve issues that do not show up in a demo. The report is only as good as the workflows feeding it.

How often should HRA reports be reviewed?

Coverage substantiation and claim substantiation should be reviewed per occurrence. Payroll reconciliation should happen every pay period. ACA and PCORI support data should be built quarterly and finalized annually. Medicare and HIPAA exception reports benefit from at least quarterly review.

Getting Started

Audit-ready HRA reports for treasury help an employer prove four things: the plan was designed correctly, the employee was eligible, the reimbursement was substantiated, and the payment was reconciled. For treasury teams, that means clean cash and payroll records. For IRS compliance, it means support for tax-free reimbursements, ACA reporting, and related filings.

The best time to build these reports is not during an audit. It is every month, as reimbursements are approved and paid.

Schedule a demo to see how SimplyHRA organizes reimbursements, payroll-triggered payments, and audit-ready reporting in one platform.