Why tax offices need a written plan
Under the FTC Safeguards Rule, tax preparers and accounting firms count as financial institutions. The rule requires covered businesses to keep a written information security program that protects customer information. For a tax office, that's the WISP.
The IRS publishes two free resources to help: Publication 5708, which walks through creating a WISP for a tax and accounting practice, and Publication 4557, which covers safeguarding taxpayer data more broadly.
What goes in a WISP
The Safeguards Rule lists the elements a written program needs. In plain English:
- Someone in charge. A named person responsible for the security program.
- A risk assessment. Where taxpayer data lives in your office, and what could go wrong.
- Safeguards. Controls like limiting who can access what, encrypting data, and adding a second lock to email and other key accounts.
- Staff training. So everyone knows what the plan asks of them.
- Vendor oversight. Making sure the software and service providers you use protect your clients' data too.
- An incident response plan. What you'll do if something goes wrong.
- Regular review. Updating the plan as your office and systems change.
The most common mistakes
- A template that doesn't match the office. A plan full of systems you don't use, and missing the ones you do, won't help when it matters.
- A plan nobody has read. If staff haven't been walked through it, it lives only on paper.
- Writing it during tax season. The best time is the quieter months, so it doesn't compete with client work.
How to get it done
You can write a WISP yourself using Publication 5708 as a guide. If you'd rather have it fitted to your office by someone who does this work, WISP Ready builds the plan from Publication 5708, matches it to your real computers and software, and trains your staff, for one fixed price after a free consultation.
Sources
- IRS Publication 5708: Creating a Written Information Security Plan for your Tax & Accounting Practice (PDF)
- IRS Publication 4557: Safeguarding Taxpayer Data (PDF)
- FTC: Safeguards Rule, What Your Business Needs to Know
This guide is general information, not legal advice. ByteSize Technology provides technical services; your firm owns its compliance program. Talk with your attorney about your specific obligations.