WISP Guide for Tax and Accounting Firms

Who needs one

Tax return preparers are treated as financial institutions under the Gramm-Leach-Bliley Act, and the FTC Safeguards Rule requires them to develop, implement and maintain a written information security plan, often called a WISP. The IRS and its Security Summit partners remind tax professionals of this requirement every year.

Where to start

IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, is a template written for smaller practices. IRS Publication 4557, Safeguarding Taxpayer Data, explains the underlying safeguards.

What the plan covers

• A qualified individual responsible for the information security program
• A written risk assessment of where client information is held and what threatens it
• Safeguards chosen from that assessment, including access controls, encryption and multi factor authentication
• Secure disposal of information that is no longer needed
• Training for everyone who handles client information
• Oversight of service providers, including any outsourcing partner
• An incident response plan
• Regular testing, monitoring and review of the plan itself

When something goes wrong

The Safeguards Rule requires covered firms to notify the FTC within 30 days of discovering a security event involving the unencrypted information of 500 or more consumers. Tax professionals should also report data theft to the IRS through their stakeholder liaison.

Service providers belong in the plan

If a partner prepares returns or keeps books for your clients, your plan should say how that partner is selected, what safeguards your contract requires, and how you check them. Questions worth asking any provider:

1. Can we read your written information security plan before we sign?
2. Where does the work happen: in our systems, in a secured workspace, or on your staff’s computers?
3. Is multi factor authentication required everywhere client data is held?
4. Can data be downloaded, printed, emailed or copied to removable media?
5. How quickly is access removed when someone leaves or changes role?
6. How and how quickly will you tell us about an incident?

Sources

• FTC Standards for Safeguarding Customer Information, 16 CFR Part 314
• IRS Publication 5708 and IRS Publication 4557

General information for accounting professionals, not legal or tax advice. Confirm requirements against current law and IRS guidance.