ICHRA Audit Readiness Checklist 2026: 20 Essentials

Offering an Individual Coverage HRA (ICHRA) is a fantastic way to give your team flexible, personalized health benefits. It puts you in control of costs and gives employees the power to choose their own insurance. But with that flexibility comes a set of compliance rules you need to follow. Getting them right is key to keeping your plan tax free and avoiding hefty penalties.

Think of it like this: you wouldn't build a house without a blueprint. Similarly, you shouldn't run an ICHRA without a plan to stay compliant. That's where an audit readiness checklist comes in. It's not about expecting an audit tomorrow; it's about building good habits and systems today so you're always prepared. This guide walks you through 20 essential items for your ICHRA audit readiness checklist, turning complex rules into simple, actionable steps.

Part 1: Setting a Strong Foundation

Before you can reimburse a single dollar, you need to establish the legal and structural framework for your ICHRA. Getting these foundational pieces right is the first step on your audit readiness checklist.

Plan Document and Summary Plan Description (SPD)

Every ICHRA is governed by ERISA, a federal law that requires you to have two core documents. The Plan Document is the formal legal text that establishes your plan, detailing all the rules. The Summary Plan Description (SPD) is the user friendly version you give to employees. It explains the plan in plain language, covering eligibility, benefits, and their rights. You must give new participants an SPD within 90 days of them joining the plan. Neglecting these documents can lead to penalties of over $190 per day if an employee requests one and you can't provide it.

Required Employee Notice Timing

You have to give employees a heads up about the ICHRA. Regulations require a written notice at least 90 days before the start of each plan year. This gives your team time to shop for an individual health plan. For new hires who become eligible mid year, you can provide the notice on or before their HRA coverage starts. This notice is detailed and must include the HRA allowance amount, its potential impact on premium tax credits, and the employee's right to opt out. The government even provides a model notice to make it easier. For a step‑by‑step employer checklist, see our ICHRA onboarding checklist.

Class Structure Review

ICHRAs allow you to offer different benefit amounts to different groups of employees using up to 11 permissible classes (like full time, part time, or salaried vs hourly). This gives you great flexibility, but you need to apply the rules consistently. Periodically review your class structure to make sure employees are in the correct category. For instance, if a part time employee becomes full time, they should be moved to the full time class. Proper classification is a key part of your compliance and audit readiness checklist.

Part 2: Managing Day to Day Operations

Once your plan is set up, ongoing administration is where compliance really happens. These daily and monthly tasks form the core of your audit readiness checklist, ensuring every transaction is handled correctly.

Monthly Coverage Verification

This is a non negotiable rule: an employee must have qualifying individual health insurance, known as minimum essential coverage (MEC), for any month they receive an ICHRA reimbursement. Before you pay out any funds, you must verify they had active coverage. The rules allow for a simple employee attestation. Each time they submit a claim, they can check a box confirming they had MEC for that month. Keeping this process consistent protects the tax advantaged status of your plan.

Ongoing Reimbursement Substantiation Process

Every single expense submitted for reimbursement must be “substantiated”. This means you or your administrator must review documentation (like a receipt or an explanation of benefits) to confirm it's an eligible medical expense under IRS rules. This ongoing review ensures that only qualified expenses are paid with tax free HRA funds. It's a critical internal control and a central piece of a strong audit readiness checklist. For examples of eligible vs. ineligible items, see our guide to reimbursement types and tax rules.

Reimbursement and Contribution Reconciliation

Think of this as balancing the HRA checkbook. On a regular basis, you should reconcile the HRA allowances you've offered with the reimbursements you've actually paid out. This ensures no one is paid more than their allowance and helps you track utilization. This process also provides valuable data for budgeting in future years and confirms your plan's financials are in order.

Payroll and Tax Record Review

ICHRA reimbursements are not taxable wages. A regular review of your payroll records ensures they are being processed correctly as non taxable payments. This means no income tax or FICA taxes should be withheld. A periodic check confirms that these payments are excluded from gross wages on payroll registers and quarterly 941 tax filings, preserving the tax savings for both you and your employees. Using an ICHRA that integrates to payroll can make reconciliation and reporting more reliable.

Receipt and Documentation Retention

What happens if the IRS or Department of Labor asks questions years from now? You'll need your records. It is a best practice to retain all HRA related documentation, including receipts, claims, coverage attestations, and employee notices, for at least seven years. Storing these records electronically in an organized way creates a clear audit trail and is a simple but powerful part of your audit readiness checklist.

Part 3: Navigating Major Federal Regulations

Federal laws like the Affordable Care Act (ACA) and ERISA have specific reporting and testing requirements. Staying on top of these major compliance pillars is essential for any employer offering an ICHRA.

ACA Employer Mandate Affordability Test

If you’re an applicable large employer with at least 50 full-time-equivalent employees, an ICHRA used to satisfy the employer mandate must be affordable. For 2026, the employee’s required contribution generally cannot exceed 9.96% of household income under the applicable test. The annualized 2026 IRC §4980H penalty amounts are $3,340 under subsection (a) and $5,010 under subsection (b). Applying an IRS affordability safe harbor consistently and retaining supporting records improves the audit readiness checklist.

Select Correct ACA Form Version by Employer Size

The ACA reporting forms you use depend on your size.

Using the right form is crucial, as the IRS systems are designed to match employer size with the expected form type.

ACA Form 1094 and 1095 Filing and Deadlines

These are the forms you use to report health coverage information to the IRS and your employees. You must provide 1095 statements to employees around March 2 each year and file the forms with the IRS by March 31 if filing electronically. Missing these deadlines or filing incorrect forms can lead to penalties of over $280 per form.

ERISA Form 5500 Filing Requirement

If your ICHRA covers 100 or more participants at the start of the plan year, you are generally required to file Form 5500 annually with the Department of Labor. This report discloses financial and operational details about your plan. The penalties for failing to file are severe, potentially reaching $2,670 per day.

Assess ERISA Small Plan Exception

Good news for smaller companies. If your plan covers fewer than 100 participants and is unfunded (meaning you pay reimbursements from your general assets), you are likely exempt from the Form 5500 filing requirement. You should assess your participant count at the beginning of each plan year to confirm if this exception applies to you.

Part 4: Handling Notices, Filings, and Privacy

Beyond the big annual reports, there are several other specific compliance tasks on the audit readiness checklist. These cover everything from employee privacy to special fees and notices.

HIPAA Privacy Compliance for Substantiation

When employees submit receipts for medical services, the plan may receive protected health information. HIPAA applicability depends on the plan’s size, administration, and design. Some self-administered plans with fewer than 50 participants are excluded from the HIPAA Privacy Rule, while other arrangements may be subject to it. Employers should limit access to claim information and confirm their obligations with the administrator or qualified counsel.

COBRA Notification Requirements

If you have 20 or more employees, your ICHRA is subject to federal COBRA. This means you must provide a General COBRA Notice to new participants and a COBRA Election Notice to employees who lose coverage due to a qualifying event (like termination). Failure to send these notices on time can result in penalties of $100 per day per affected person.

PCORI Fee Filing via Form 720

All employers with a self insured plan, including an ICHRA, must pay a small annual fee to fund the Patient Centered Outcomes Research Institute.

Medicare Part D Creditable Coverage Notice

Each year before October 15, you must provide a notice to any Medicare eligible participants informing them whether the prescription drug coverage they can get through their individual plan is “creditable” (as good as Medicare's). This helps them make smart decisions during Medicare open enrollment and avoid late penalties.

Section 111 MSP Reporting

For employers with 20 or more employees, Medicare Secondary Payer (MSP) rules require you to report coverage information to Medicare for any employees who are also Medicare beneficiaries. This quarterly reporting, known as Section 111 reporting, helps coordinate benefits properly. The potential penalties for noncompliance are steep, so it's an important, if technical, item for your audit readiness checklist.

W-2 Health Coverage Reporting Requirement

Employers that file 250 or more W 2 forms must report the total cost of employer sponsored health coverage in Box 12 with code DD on the employee's W 2. For an ICHRA, this is typically the total allowance amount you made available for the year. This is for informational purposes only and does not make the benefit taxable.

Part 5: Checking Local Requirements

Federal rules aren't the only ones that matter. Checking for local rules is an often overlooked but critical part of a complete audit readiness checklist.

State and Local Mandate Check

Several states (like California and New Jersey) and cities (like San Francisco) have their own health coverage mandates. These can include state level reporting requirements that mirror the federal 1095 forms, mini COBRA laws for small businesses, or minimum health spending requirements. A quick check of the laws where your employees live and work ensures you don't miss a local obligation.

Simplify Your ICHRA Audit Readiness Checklist

Managing an ICHRA doesn't have to be a compliance headache. While this audit readiness checklist covers a lot of ground, the right partner can automate most of it for you. A modern platform handles everything from verifying coverage and substantiating expenses to generating the right reports and notices on time. This frees you up to focus on your business, confident that your benefits plan is running smoothly and correctly.

Ready to see how simple ICHRA administration can be? Schedule a free consultation with SimplyHRA to learn how our platform keeps you compliant without the complexity.

Frequently Asked Questions

What is the most important item on an ICHRA audit-readiness checklist?

No single record is enough. The core control is a complete evidence trail. Federal ICHRA rules require annual substantiation that each participant and covered dependent is enrolled in individual health insurance coverage or Medicare, plus ongoing substantiation before an expense is reimbursed for the month in which it was incurred. An HRA may reimburse only substantiated medical-care expenses. Keep the plan terms and notices, enrollment and opt-out records, coverage documents or attestations, reimbursement requests and determinations, and records used for required filings.

What are the biggest financial risks of ICHRA noncompliance?

For an applicable large employer, one potential risk is an employer shared responsibility payment. For 2026, the IRS says the annual indexed amounts used in the calculations are $3,340 under Section 4980H(a) and $5,010 under Section 4980H(b)(1). Any proposed payment is calculated monthly and depends on the employer's facts; these amounts are not automatic flat fines for every employee. The IRS generally begins a proposed assessment through Letter 226J.

How often should employers review an ICHRA audit-readiness checklist?

Review it at each compliance event, not only once a year. Before each plan year, confirm the plan design, employee classes, and required notice. When a participant or dependent becomes covered, collect the required annual substantiation. Before each reimbursement, substantiate both the person's coverage for the relevant month and the medical-care expense. Review applicable filing requirements on their annual deadlines and revisit the checklist whenever plan terms, workforce classifications, or governing guidance change.

Can software automate ICHRA audit readiness?

Software can support the collection of attestations, record storage, deadline tracking, and application of configured plan rules, but it does not replace the written plan or plan-administrator oversight. The Department of Labor explains that an ERISA-covered group health plan needs a written plan, a recordkeeping system, and documents for participants and government reporting. Configure any system to follow the plan terms, capture annual and ongoing substantiation, preserve readable records, and route exceptions for review by the person authorized to make benefit decisions.

Does this checklist apply to employers with fewer than 50 full-time equivalent employees?

Yes, if the employer sponsors an ICHRA. The Department of Labor states that employers of all sizes may offer an ICHRA, subject to the rule's conditions. The employer shared responsibility provisions generally apply only to applicable large employers, meaning employers that averaged at least 50 full-time employees, including full-time equivalent employees, during the preceding calendar year. However, the ICHRA's same-terms, opt-out, participant-notice, and coverage-substantiation conditions apply to the arrangement itself. Separate ERISA, COBRA, and reporting duties depend on the employer's and plan's specific facts.

What is the difference between an ICHRA glossary and an audit-readiness checklist?

A glossary explains terms. An audit-readiness checklist converts requirements into actions, supporting evidence, responsible owners, deadlines, and completion status. Use a glossary for context and use the checklist, written plan, and current official guidance to administer the arrangement. A glossary is not a plan document or a compliance record.