Tax and accounting firms in Florence, Fort Mitchell, Delhi and Fairfield know the PTIN routine by heart. In fact, you’ve likely renewed enough times to finish it half asleep. Even so, one checkbox deserves a second look, because it confirms you know the law requires a data security plan.
For many firms, that plan started as a template a few years back. If you’ve added remote staff or new software since then, your plan likely describes the office you used to run.
Let’s look at what a WISP for tax preparers should contain and how to close gaps by January.
Why PTIN renewal asks about your WISP
Here’s why the question shows up on your renewal. The FTC Safeguards Rule treats tax and accounting professionals as financial institutions.
Under the rule, your firm must keep a written plan that describes how it protects client information. Each year, the IRS uses PTIN renewal to remind you of that duty.
The acknowledgment simply restates an existing obligation. Even so, it puts on record that you knew the law required a plan. As a result, a missing or outdated plan becomes hard to explain to regulators and clients after a breach.
Plus, the FTC requires firms to report a breach of unencrypted data on 500 or more consumers within 30 days.
What a WISP for tax preparers should contain
IRS Publication 5708 gives tax and accounting firms a free sample plan to start from. Then tailor each section in plain language to your own office. A solid WISP covers these pieces:
- A Qualified Individual. One person oversees your security program and answers for it. Also, the role can go to a staff member or an outside IT provider.
- A risk assessment. List every place client data lives, including tax software, portals, email, laptops and paper files. Then note what could go wrong in each spot.
- Multi-factor authentication (MFA). The rule requires MFA for every person who accesses customer information. With that in mind, check email, tax software, remote access and cloud storage first.
- Access controls. Each staff member gets the access their job requires and nothing more. Also, your plan should explain how you shut off logins when staff leave.
- Encryption. The rule requires you to encrypt client data in storage and in transit. That’s why your plan should say how you handle both.
- Staff training. Teach your team to spot phishing emails and spoofed wire or ACH requests. After that, keep a simple log of who finished training and when.
- Vendor oversight. List each vendor that touches client data, including your IT provider. Next, explain how you check that each one protects it.
- An incident response plan. Write down who to call first if something goes wrong, starting with your IRS Stakeholder Liaison. Because a breach can lock you out of email, keep a printed copy too.
- A review schedule. Update the plan at least once a year. And update it again after a big change, like new software, a second office or remote staff.
Small firms get a little relief. Firms holding data on fewer than 5,000 consumers can skip a few formal pieces, like the written incident response plan. Still, they need the WISP itself.
Where WISPs fall short
Many firms download a template, fill in the firm’s details and file it away. The catch is that a template describes a generic office instead of yours. For example, template-based plans often miss gaps like these:
- The plan says MFA covers every account. Meanwhile, the shared scanner mailbox still signs in with a password alone.
- Seasonal preparers from last spring still have working logins.
- The plan describes a backup system the firm replaced two years ago.
- Clients email tax documents. Then staff reply with attachments instead of using the portal the plan describes.
- The plan lists a Qualified Individual who left the firm last year.
In each case, your PTIN acknowledgment turns into a promise your systems can’t keep.
A 20-minute WISP check for the managing partner
So where does your firm stand? Set aside 20 minutes this week and work through these questions with your office administrator.
- Can you find the current plan in under five minutes?
- Did your team update it within the last 12 months?
- Does the plan say which person serves as your Qualified Individual?
- Have you turned on MFA for email, tax software, the client portal and remote access?
- Have you removed logins for former and seasonal staff?
- When did your team last test restoring a client file from backup?
- If a staff member clicked a phishing link today, who would they call first?
If you answered “no” or “not sure” anywhere, you now have a to-do list for November.
Fix what your WISP check uncovers ahead of tax season
November and December give you the last quiet stretch ahead of filing season. Use that window to turn on MFA, clean up old accounts, test a restore and prep seasonal logins.
After that, update your written information security plan so it describes the systems you’ll run in January. Also, add one habit to the plan: call a known number to verify any change to bank or wire details. Then re-date the plan and save a copy where your team can find it. That way, your PTIN acknowledgment matches what your office does every day.
Get a free WISP gap check from a local Cincinnati and Northern Kentucky IT team
Want a second set of eyes? CMIT Solutions of Cincinnati & NKY offers a free IT security audit for businesses in our service area. The session takes 60 to 90 minutes. During that time, we compare what your WISP says with how your systems run today. Then we hand you a plain-English list of gaps and the steps to close them.
We provide IT support for accounting firms and tax preparers across Cincinnati and Northern Kentucky. We also help firms answer the security questionnaires that custodians and auditors send. After the audit, we can help you meet the Safeguards Rule with a WISP your firm can stand behind.
Book your free IT security audit. CMIT Solutions of Cincinnati and Northern Kentucky works with businesses in downtown Cincinnati, Over-the-Rhine, Clifton, Northside, College Hill, Price Hill, Westwood, Delhi, Colerain, Mount Healthy, Forest Park, Springdale, Sharonville, Fairfield and Harrison. In Northern Kentucky, we serve Covington, Newport, Bellevue, Fort Thomas, Fort Mitchell, Erlanger, Florence, Burlington, Hebron, Union, Independence and Walton, along with Lawrenceburg, Indiana.
Prefer to talk? Call our team at (513) 347-5800.
