AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor paid preparers, EROs and tax and accounting firms that confirm the WISP duty at each PTIN renewal and keep the plan current for staff.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Paid tax return preparers and tax and accounting firms, which the IRS describes as financial institutions under the GLBA and FTC Safeguards Rule regardless of size.
The FTC enforces the underlying Safeguards Rule; the IRS asks each preparer to confirm awareness of the WISP duty on Form W-12 at PTIN application and renewal.
Annual PTIN renewal with the W-12 data security question; the IRS sample plan calls for review at least annually and staff acknowledgment at annual training
Publication 5708 (Rev. 8-2024); Publication 4557 (Rev. 6-2024); Form W-12 (Rev. October 2025), 2024-08 (Publication 5708). Free to read.
| Date | What happens | Status |
|---|---|---|
| 2025-10 | Form W-12 revised (Rev. October 2025), keeping line 11 Data Security Responsibilities | Done |
| 2026-10-15 | IRS processing 2027 PTIN applications and renewals (page updated) | Done |
Each one needs an owner, an approval, and proof it reached the people it covers.
IRS Pub 5708; 16 CFR 314.3
A written, accessible plan sized to the practice, covering objectives and scope, the Qualified Individual, risks, hardware inventory, safety measures and an implementation clause.
IRS Pub 5708 outline III; 16 CFR 314.4(b)
The plan lists the types of information handled, potential areas for internal and external data loss, and procedures to monitor and test those risks.
IRS Pub 5708 Sample Attachment D
The IRS suggests each employee and contractor sign and date an acknowledgment of the WISP policies, renewed at annual training and kept on file.
IRS Pub 5708 Sample Attachments A and B
Attachments set record retention rules and rules of behavior and conduct for safeguarding client PII.
IRS Pub 5708 Sample Attachment C; 16 CFR 314.4(j)
Written steps for responding to a breach, including reporting data loss to the IRS and states and notifying the FTC when 500 or more people are affected.
IRS Pub 5708 Sample Attachments E and F
Lists of hardware holding PII and of staff authorized to access PII, with their access levels.
Citations are to the standard or regulation; wording is ours.
What reviewers sample about these documents and the people they cover.
Form W-12 line 11 asks each preparer to confirm awareness of the legal duty to create and maintain a WISP; a box must be checked to complete the form.
In an FTC inquiry, expect a request for the written plan, its last review date and the named Qualified Individual.
IRS guidance treats signed, dated employee acknowledgments kept on file as the documentation trail for training and policy understanding.
After a data theft, IRS guidance has preparers report the loss to the IRS and states; the plan's breach procedures show who does what.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of IRS WISP? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
Publication 5708 states that tax and accounting professionals are financial institutions under the GLBA and Safeguards Rule regardless of size. It also notes a sole practitioner can use a shorter plan scaled to the practice.
Form W-12 (Rev. October 2025), line 11, asks the preparer to confirm awareness that paid preparers are required by law to create and maintain a WISP, and points to Publications 5708 and 4557. The online renewal carries the same question.
The IRS sample template carries a last modified or reviewed date and calls for review and update at least annually. The Safeguards Rule also expects the program to be adjusted after testing results or material changes.
Under 16 CFR 314.6, institutions holding information on fewer than 5,000 consumers are exempt from the written risk assessment, written incident response plan, annual board report and continuous monitoring or testing requirement. The written plan, Qualified Individual, safeguards and staff training still apply.
Publication 4557 notes that online providers must also follow the six security and privacy standards in Publication 1345 for authorized IRS e-file providers. Those sit alongside the WISP.
free for 30 days