Skip to content
paybillke
Government

SHA employer monthly reporting Kenya 2026: schedules, audits, records

The monthly reporting cycle Kenyan employers owe SHA, what SHA can request on audit, record-retention norms, and the common reporting errors to fix before they compound.

AO
by Reviewed by Michael Mwangi 11 min read Updated 12 September 2026Verified 12 Sept 2026

What SHA requires monthly

The monthly return has three components:

  1. Deduction schedule. One row per employee, with National ID, full names, gross monthly pay, computed 2.75%, floor-adjusted (KES 300 minimum where the raw 2.75% is lower), and the applicable payroll period.
  2. Remittance evidence. The portal-generated payment reference against which you paid, plus the M-PESA confirmation SMS or bank transfer advice.
  3. Active staff list. The current roster on the employer portal, updated for new joiners and leavers before the schedule is finalised. See adding staff to SHA for the roster update mechanics.

All three are done through the employer portal in one cycle. The schedule is uploaded, the roster is refreshed as part of that upload, and the payment reference the portal issues ties everything together.

Portal vs bulk-file upload

The employer portal supports two upload modes:

  • In-portal edit, where you make monthly changes to gross pay per employee and the portal calculates SHIF for you. Practical for very small employers with stable staff.
  • Bulk CSV upload, where you export the SHA schedule from your payroll system and upload the file. This is the norm for anything above around ten staff or where payroll changes month to month.

The CSV template is available from the portal. Common payroll systems used in Kenya (SAP, Sage, Sasa Payroll, Payroll Kenya, in-house Excel) can export in that shape. If yours cannot, the manual fix is a small pivot in the payroll register mapped to the SHA columns.

What a SHA audit looks like

A formal SHA audit request typically asks for:

  • The monthly deduction schedule for each of the last 12 months
  • The remittance receipt (portal + M-PESA/bank) for each of those months
  • The general ledger entry clearing the SHA liability for each month
  • Reconciliation of the staff list against your KRA P9 and NSSF returns
  • Any correspondence with SHA regarding disputed periods, corrections, or amendments

The request is usually issued in writing with a 14 or 21 day response window. On evidence of substantive discrepancy, SHA can extend the audit to earlier periods.

Record retention

SHA has not published a specific record-retention period as of 26 August 2026. The prudent Kenyan employer default is seven years, consistent with KRA record-keeping norms for tax and payroll evidence and the broader Companies Act reporting practice. Cite that seven-year figure as best practice, not SHA-specific rule.

Retain:

  • Monthly deduction schedules (CSV or in-portal exports)
  • Portal confirmations and payment references
  • M-PESA SMS receipts and bank transfer advices
  • General ledger extracts clearing the SHA liability
  • New joiner and leaver forms tied to the SHA roster
  • Any SHA correspondence, including corrections and dispute resolution

Digital retention is fine, provided the files are reproducible on request and time-stamped. Encrypted cloud storage (Google Workspace, Microsoft 365) is standard.

Common reporting errors and how to fix them

Wrong National ID on the schedule

The single most-common error and the archetypal source of "paid but inactive" complaints. The deduction lands but does not credit the employee's SHA record. Fix path:

  1. Identify the affected employees from the mismatch report on the portal.
  2. Correct the ID on the roster.
  3. Contact SHA (0800 720 601 or portal support) to reallocate the historical mis-posted contributions.
  4. Provide the payment reference and the corrected schedule.

Computing SHIF on basic salary only

Under-collection. Fix by recomputing on gross for all periods since the error started, top up the difference in the next month's remittance, and note the correction in the schedule. See the full deduction guide for what counts as gross.

Applied old NHIF cap

Under-collection at the top of the salary distribution. SHA has no upper cap. A CEO on KES 800,000 pays KES 22,000, not KES 1,700. Recompute the affected employees back to the point the cap was wrongly applied and top up.

Missed mid-month joiners

Employees who started mid-month but were not added to the schedule for that month. Add them to the next schedule with a back-dated correction line for the missed period. Document in the notes.

Leavers still on the roster

Not a compliance error in itself but produces "expected but not paid" flags on the portal. Off-board leavers on their last day. The portal handles the roster cleanup; the monthly return then matches.

Penalty-avoidance patterns worth adopting

  • Calendar the 5th, not the 9th. Any monthly reminder should trigger the 5th of the month for portal upload and payment. The 9th is the deadline, not the target.
  • Reconcile before you remit. Match your payroll register total to the schedule total on the portal before you push payment. A payment that reconciles cleanly does not need reallocation later.
  • Save both confirmations together. Portal receipt and M-PESA or bank receipt, side by side. Missing one on audit is the difference between clean and messy.
  • Off-board on the last day. Do not carry leavers into the next month's schedule.
  • Quarterly self-review. Once a quarter, pull the last three months' schedules against your payroll register and confirm they match. Small drifts caught quarterly are trivial; discovered on audit they compound.

How mid-month cycles complicate the reporting

Two mid-month events reliably complicate the SHA return without breaking it, provided the process is set up for them:

New joiners mid-month

Add the joiner to the portal on their start date. On the first monthly return their SHIF is computed on the pro-rated gross actually paid that month, not the full-month gross. The next month runs at full gross. Retain the offer letter and start-date evidence with the roster change.

Leavers mid-month

Off-board on the last day. Their final SHIF is on the actual last pay, not the full-month gross. The next monthly return no longer includes them. Retain the leaver form and the last-day payroll evidence with the roster change.

Salary changes mid-year

Update the gross on the portal at the same time as the payroll change. SHIF is 2.75% of whatever gross is actually paid in the month, so a mid-year raise flows through naturally on the next monthly schedule.

Promotions and one-off bonuses

Include the bonus in that month's gross for the SHIF calculation. Do not annualise. Do not smooth. A KES 100,000 bonus paid in December is part of December gross, contributes to December SHIF at 2.75%, and appears in the December remittance schedule.

The audit response playbook

When a SHA audit request lands, run this sequence:

  1. Acknowledge in writing within two working days. Confirm the response window (usually 14 or 21 days) and the scope (typically 12 months rolling).
  2. Pull the 12 monthly schedules, the 12 remittance receipts, and the general ledger extract for the SHA payable account for the same period.
  3. Reconcile schedule totals to remittance amounts to GL clearance for each month. Any drift flagged and explained in the response.
  4. Cross-check the staff list against the KRA P9 filings and NSSF returns for the same period. Note any timing differences.
  5. Bundle the audit pack: cover letter, reconciled totals table, per-month evidence file, staff-list cross-reference.
  6. Submit within the response window. Retain the submission evidence.

The audit closes cleanly where the reconciliation reconciles. Where it does not, expect follow-up on the specific periods that drift. Prompt engagement is what closes an audit; silence extends it.

What a clean reporting file looks like

A well-run 2026 Kenyan employer with clean SHA reporting has, per month:

  • A CSV or in-portal schedule matching the payroll register to the shilling
  • A portal payment reference issued after upload
  • A bank or M-PESA confirmation against that reference
  • A general ledger entry clearing the SHA payable to zero
  • A brief email or memo file trail on any corrections

Under audit those five artefacts, produced across 12 months, close out any query in a single response cycle. The absence of any one of them is what turns a routine audit into a protracted one.

Sources

  1. Employer portal: employers.sha.go.ke, accessed 26 August 2026.
  2. SHA premium rates: sha.go.ke/premium-rates, accessed 26 August 2026.
  3. Section 27(6), Social Health Insurance Act 2023. 2% penalty on late employer remittances.
  4. KRA record-keeping norm of seven years, applied here as prudent default for SHA in the absence of a published SHA-specific period.
  5. SHA toll-free helpline 0800 720 601.