How to Prepare for an ACA Compliance Audit: 2026 Checklist

How to Prepare for an ACA Compliance Audit

TLDR

An ACA compliance audit tests whether your records prove you correctly identified full-time employees, offered affordable coverage, and filed accurate Forms 1094-C and 1095-C. The most common federal enforcement action is IRS Letter 226J, which proposes Employer Shared Responsibility Payments based on your filings and employee tax return data. Preparation means building a month-by-month evidence file before the IRS asks for one. Employers offering an ICHRA have additional documentation requirements around substantiation, affordability ZIP codes, and reporting codes that most generic audit guides ignore.

What Is an ACA Compliance Audit?

An ACA compliance audit is a review of whether an employer met Affordable Care Act requirements for offering, documenting, and reporting health coverage. It can take several forms: an internal self-audit, a third-party review by a broker or consultant, or a response to an IRS enforcement notice.

For most Applicable Large Employers, the federal enforcement event that matters most is IRS Letter 226J. This letter is not a final bill. It is the IRS’s initial proposal that an employer may owe an Employer Shared Responsibility Payment. The IRS bases it on the employer’s filed Forms 1094-C and 1095-C, cross-referenced against employees’ individual income tax returns, specifically whether full-time employees claimed premium tax credits for Marketplace coverage.

Think of ACA audit preparation as assembling the proof you would need if the IRS questioned your reporting two or more years after the fact. Annual summaries are not enough. You need month-by-month records.

Who Should Prepare for an ACA Compliance Audit?

An employer is generally an Applicable Large Employer (ALE) if it averaged at least 50 full-time employees, including full-time equivalent employees, during the prior calendar year. ALEs are subject to employer shared responsibility provisions and ACA information reporting duties. For a deeper breakdown of how ALE status works, see this guide on applicable large employer rules.

Full-time means 30 hours of service per week or 130 hours per month for ACA purposes. Getting this classification wrong is one of the fastest ways to create audit exposure.

The federal employer mandate generally does not apply below the ALE threshold. But employers that sponsor self-insured coverage or individual coverage HRAs still have reporting obligations. Even if you are not an ALE, keep HRA and coverage records because self-insured arrangements and state rules may still create documentation duties.

Schedule a free consultation if you are unsure whether your current benefits structure triggers ACA reporting requirements.

What the IRS Is Trying to Verify

The IRS’s enforcement logic is mostly a data match. For each month, the IRS wants to confirm:

1. Was the employer an ALE?
2. Did the ALE offer minimum essential coverage to at least 95% of full-time employees and their dependents?
3. Was the offer affordable?
4. Did the coverage provide minimum value (generally, paying at least 60% of costs for a standard population)?
5. Did any full-time employee receive a premium tax credit?
6. Do Forms 1094-C and 1095-C support the employer’s position?

For 2026, the adjusted ESRP amounts are $3,340 per full-time employee under the 4980H(a) penalty and $5,010 under 4980H(b). Separate information return penalties apply for late, incorrect, or missing forms, ranging from $60 to $680 per return. For more on penalty mechanics, read this ACA employer penalty guide.

The 5-Proof ACA Audit File

The heart of how to prepare for an ACA compliance audit is organizing records into five categories. Each one maps to a question the IRS will ask.

1. ALE Status Records

Keep monthly full-time employee counts, full-time equivalent calculations, controlled group analysis, seasonal worker notes, and acquisition or divestiture documentation.

2. Eligibility Records

Document hours of service, the measurement method you use (monthly or look-back), stability periods, waiting periods, variable-hour determinations, and leave-of-absence classifications.

3. Coverage Offer Records

Retain offer notices, enrollment confirmations, waivers and declinations, dependent offer documentation, effective dates, and carrier or plan confirmations. The 95% offer rule applies to actual full-time employees, not FTEs.

4. Affordability and Minimum Value Records

Track the lowest-cost self-only coverage amount, employee contributions by month, and the safe harbor you selected (W-2, rate of pay, or federal poverty line). Practitioners on LinkedIn emphasize that safe harbors are most useful when chosen and documented before a penalty notice arrives, not calculated after the fact. For a walkthrough of the FPL method, see this ACA affordability safe harbor guide.

The affordability percentage changes annually. For 2025 plan years it is 9.02%; for 2026 it rises to 9.96%. Using last year’s number is a common and avoidable mistake.

5. Filing and Correction Records

Keep filed Forms 1094-C and 1095-C, AIR transmission receipts, acceptance or rejection records, corrected forms, and employee request logs. IRS instructions say employers should be able to reconstruct filed data for at least three years from the due date. Employment tax records should be kept for at least four years.

If you use the alternative furnishing method (posting a website notice instead of automatically mailing 1095-C forms), save screenshots of the notice, posting dates, request logs, and response dates. This option is relatively new, and one compliance practitioner on LinkedIn noted that it cuts mailing costs but creates its own documentation burden. For more on how these forms work together, see this 1094-C vs 1095-C guide.

Year-Round ACA Audit Preparation Calendar

Preparing for an ACA compliance audit should not be a January scramble. A year-round approach prevents the data gaps that trigger penalties.

January through March: Finalize prior-year forms. File corrections quickly. The current electronic filing threshold is 10 or more information returns in aggregate, not the old 250-return threshold that many older guides still reference.

Quarterly: Reconcile payroll, HRIS, benefits enrollment, terminations, leaves of absence, and coverage offers. Practitioners on Reddit consistently describe ACA reporting as painful because data lives across multiple systems. One HR professional shared that their payroll provider notified them close to filing season that the ACA module had never been activated, leaving zero 1095-C forms generated.

Midyear: Test affordability using the correct plan-year percentage and your chosen safe harbor. Review contribution changes and wage adjustments.

October through November: Run a mock 1095-C file. Check Line 14 (offer code), Line 15 (employee required contribution), Line 16 (safe harbor code), and for ICHRAs, Line 17 (ZIP code). A LinkedIn practitioner recommended pre-year-end mock generation and cross-functional review among HR, payroll, compliance, and IT.

December: Lock plan-year data, confirm measurement and stability periods, validate employee counts, and document safe harbors.

What to Do If You Receive Letter 226J

Letter 226J is usually a data problem before it is a legal argument. The response is generally due within 30 days of the letter date, so speed matters.

1. Calendar the response deadline immediately and assign an owner.
2. Identify the tax year and affected months.
3. Review the ESRP summary table and the Form 14765 employee premium tax credit list.
4. Compare the IRS’s employee list to your payroll, coverage, and 1095-C data.
5. Check whether your Line 14, 15, and 16 codes were correct. For help understanding offer codes, see this explanation of 1095-C Line 14 codes.
6. Complete Form 14764. If you disagree, provide an explanation and corrected data.
7. Keep copies of the letter and everything you submit.

A practitioner on Reddit described a situation where roughly 1,000 employees had been coded with 1F (coverage not providing minimum value) even though the employer believed it had offered appropriate coverage. That kind of coding error is exactly what triggers a 226J, and exactly what a pre-filing review would have caught.

ICHRA-Specific Audit Readiness

Employers offering an individual coverage HRA face additional ACA compliance audit preparation requirements that most generic guides skip entirely. An ICHRA is classified as a self-insured group health plan, and an affordable ICHRA is treated as providing minimum value under IRS rules.

To build an audit-ready ICHRA file, keep:

• ICHRA plan document and annual notice
• Employee class rules and allowance schedule
• Proof of employee opt-out rights (employees must be able to opt out at least annually)
• MEC substantiation records confirming employees are enrolled in individual coverage or Medicare
• Lowest-cost silver plan affordability data by ZIP code
• 1095-C ICHRA offer codes (1L, 1M, 1N, 1T for primary residence ZIP; 1O, 1P, 1Q, 1U for employment site ZIP)
• Line 17 ZIP code documentation
• Reimbursement approvals, denials, and supporting documentation

Department of Labor guidance requires ICHRA employers to provide a written notice explaining the HRA and its premium tax credit interaction, maintain reasonable substantiation procedures, and permit annual opt-outs. For a complete framework, read this ICHRA audit and reporting guide.

Schedule a demo to see how SimplyHRA helps employers maintain audit-ready ICHRA records, manage reimbursements, verify eligibility, and integrate with payroll systems.

Common ACA Audit Mistakes

Assuming payroll handles filing automatically. Community threads on Reddit show that ACA modules and filing support are often add-on services, not defaults. Verify that someone owns the filing process.

Using outdated thresholds. The e-filing requirement now applies if you file 10 or more information returns in a year, applied in aggregate. The old 250-form threshold no longer applies.

Applying the wrong affordability percentage. The IRS updates this number annually. Using 2024 numbers for a 2025 plan year creates a false sense of compliance.

Not correcting bad codes. IRS instructions say corrected returns should be filed as soon as possible. Waiting until a penalty notice arrives makes the correction look reactive.

Ignoring state reporting. California requires MEC reporting to the Franchise Tax Board by March 31 (with an automatic extension to May 31) and can assess a $50 per individual penalty. New Jersey has its own separate deadlines and rules.

Skipping ICHRA documentation. ICHRA employers need substantiation, opt-out records, notices, affordability data, and specific 1095-C codes that go beyond what traditional group plan employers maintain.

Frequently Asked Questions

Is an ACA compliance audit the same as IRS Letter 226J?

Not exactly. An ACA compliance audit can be an internal review or a third-party assessment. Letter 226J is the IRS’s specific enforcement notice proposing that an ALE owes an Employer Shared Responsibility Payment. Most employers searching for how to prepare for an ACA compliance audit are really preparing for the possibility of receiving Letter 226J.

How long should employers keep ACA reporting records?

IRS instructions say employers should keep copies of filed information returns, or be able to reconstruct the data, for at least three years from the due date. Employment tax records should be kept for at least four years. Keeping records longer than the minimum is a reasonable precaution given how far behind the IRS can run on enforcement.

What is the biggest risk in an ACA compliance audit?

Inconsistent data. If payroll hours, benefit eligibility records, coverage offers, employee contributions, and 1095-C codes do not match each other, the employer will struggle to defend its filing. Your audit file is only as good as your data feeds.

What documents prove ACA affordability?

Keep the lowest-cost self-only premium (or ICHRA required contribution), the affordability percentage for that plan year, the safe harbor you selected, payroll or wage records supporting the calculation, and copies of the 1095-C data reported to the IRS.

Do small businesses need to prepare for ACA audits?

Employers below the ALE threshold are generally not subject to the federal Employer Shared Responsibility Payment. However, they may still need records for HRA administration, self-insured plan reporting, state health coverage mandates, or future growth into ALE status.

What should I do first if I receive Letter 226J?

Calendar the response deadline (usually 30 days from the letter date), assign an owner, review the ESRP summary table and Form 14765 employee list, compare the IRS data to your records, and prepare Form 14764 with your agreement or disagreement. If the proposed amount is material, involve benefits counsel, a tax advisor, or an ACA reporting vendor immediately.

ACA penalties and reporting rules change annually. Confirm current IRS instructions or consult tax and benefits counsel before making compliance decisions.

If your team offers an ICHRA and wants audit-ready reporting with payroll integration, eligibility verification, and licensed broker support, schedule a demo to see how SimplyHRA works.