Every January, the same scramble happens. Benefits leaders pull out their ACA checklists: Pick a vendor. Validate ALE status. Watch the IRS deadlines. It feels productive, like you're doing compliance right.
But many employers are walking into a quiet problem, and it has nothing to do with a missed filing date or the wrong form.
Your Source Data Is a Mess
The biggest threat to ACA compliance is a data integrity crisis upstream, where your payroll, HRIS, and benefits enrollment systems disagree on one question: Did this employee actually work 30 hours this month?
Many compliance failures trace back to source data that has been accumulating errors for months, not to someone filling out a 1095-C wrong.
The Rarely-Spoken Blind Spot: Two Truths, One Penalty
When you calculate affordability, two systems tell you two different things:
- Payroll systems use actual hourly pay and actual hours worked: overtime, bonuses, PTO, the works.
- Benefits administration systems (your BenAdmin or HCM module) often use scheduled hours or plan year estimates.
When those two disagree, your safe harbor test breaks. Say an employee drops to 30 hours a week but the benefits system still shows 40. That produces one of two bad outcomes:
- False positive offers: You offer coverage to someone who isn't full-time. No penalty, but wasted premium dollars.
- False negative offers: You don't offer coverage because the system thinks the worker is part-time, but payroll shows 130+ hours in a month. If the pattern is widespread enough to drop you below the 95% offer threshold, the 4980H(a) penalty applies: $3,340 per full-time employee for 2026, assessed across your full-time workforce minus the first 30, month by month, once any full-time employee receives a Marketplace subsidy.
A third failure mode sits beside these two. If you offer coverage but the employee's premium share exceeds the 2026 affordability limit of 9.96% (applied through the W-2, rate-of-pay, or federal poverty line safe harbors), the 4980H(b) penalty applies instead: $5,010 per subsidized full-time employee in 2026, limited to the employees who actually received a premium tax credit. You face this penalty for the same reason: an upstream hour-count error changes who counts as full-time in the first place.
The Variable Hour Time Bomb
Variable hour employees who cross 30 hours mid-month are the most dangerous edge case. Traditional ACA reporting aggregates hours by calendar month, but many payroll systems run on pay periods that straddle month boundaries. Hours get split incorrectly, and a month that was full-time looks part-time.
Methodology determines which rule applies. Under the monthly measurement method, you test each month on its own. Under the look-back measurement method, the opposite applies: once an employee averages 30 or more hours per week during the measurement period, you must treat them as full-time for the entire stability period that follows, even if their hours later fall. A wrong hour count in the measurement period gets locked in for every month of the stability period.
Most employers never audit the month-to-month mapping between payroll and benefits that feeds those hours. That is where the time bomb sits.
Three Questions That Will Save You Millions
Instead of buying another piece of ACA software, run a data provenance audit before you generate a single form. Ask these three questions:
- Source conformance: For each employee, exactly which system is the source of truth for hours and wages in each calendar month? (The answer should be payroll, not the HCM position record.)
- Temporal alignment: Does the benefits enrollment date match the employee's effective start date in payroll? A one-day delay can place an offer in the wrong month, and that misalignment compounds through the stability period.
- Safe harbor consistency: If you use the W-2 safe harbor, does your engine apply the affordability percentage to the employee's actual Box 1 wages for the months they worked and were offered coverage, or does it annualize a salary as though they worked all year? For part-year employees, the IRS requires prorating actual wages. Annualizing inflates the threshold and can make an unaffordable offer look compliant.
How the IRS Finds the Mismatch
The IRS does not audit your payroll hours line by line. It matches your 1095-C filings against Marketplace premium tax credit records. When a full-time employee received subsidized coverage and your form shows no qualifying offer, or an offer that fails the affordability test, the IRS sends Letter 226-J proposing a 4980H penalty. The letter includes the employee's premium tax credit listing and a month-by-month proposed assessment.
Since a law signed in late 2024, employers have at least 90 days to respond, up from the prior 30. That window is where the upstream data rot gets exposed. Your defense rests on the payroll and benefits records behind the form: the hours, the offer codes, the enrollment dates. If those systems disagree, you will spend the response window reconstructing months of data under deadline, or accept an assessment you cannot dispute.
That is the practical case for fixing data provenance before you file. The form the IRS sees is a summary. What gets audited is the source data behind the summary.
The Bottom Line
Stop treating ACA reporting as an annual filing exercise. Treat it as a continuous data reconciliation program between your payroll system and your benefits enrollment system.
The larger cost is the false sense of compliance that comes from clean-looking 1095-Cs hiding upstream data rot.
Start with a simple step. Pull the monthly hours column from your most recent ACA report and compare it against payroll's actual hours worked for one group of variable-hour employees. Flag every row where the two disagree, then trace each discrepancy to the system that produced it.
Fixing that data lineage saves more than any vendor's correction service. A clean report is easy to sell. A clean data pipeline is what protects the business when a 226-J letter arrives.