Tax Season Security: The Written Plan Every Tax Preparer Needs

Tax season is when a small accounting office holds more sensitive information than at any other time of year: Social Security numbers, bank details, prior returns and identity documents for every client. Criminals know it, which is why tax preparers are targeted every filing season.

It is also why federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan, usually called a WISP. If yours is a template you downloaded once and never opened again, this is a good week to fix that.

This is a plain-language overview, not legal advice.

Why a written plan is required

Under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, tax and accounting professionals are treated as financial institutions and must protect client data. The IRS and its Security Summit partners publish Publication 5708, a WISP template written for smaller practices, and Publication 4557, a guide to safeguarding taxpayer data.

What goes in a WISP

• Who is responsible. One named person who owns the plan.
• What you hold and where. Client data in your tax software, email, file shares, portals, paper files and backups.
• The risks. What could go wrong with each, from phishing to a stolen laptop.
• The safeguards. What you do about those risks, in writing.
• Staff rules and training. Including seasonal and part-time staff.
• Vendors. Who else handles client data and how you check on them.
• What happens in an incident. Who to call and in what order.

The safeguards that matter most in tax season

The IRS has long pointed tax professionals to six basics. They are a good checklist for any firm:

1. Antivirus software on every computer, kept current.
2. Firewalls protecting the office network.
3. Multi-factor authentication on tax software, email and remote access.
4. Backups of client data that you have tested.
5. Drive encryption on laptops and desktops.
6. A VPN for anyone working outside the office.

Add one habit to that list. Be suspicious of email from a “new client” who wants you to open an attachment or click a link to see their documents. It is one of the most common ways into a tax office.

Signs that client data may have been stolen

• Clients’ e-filed returns are rejected because a return was already filed with their Social Security number.
• Clients receive IRS letters about returns they did not file.
• You receive more e-file acknowledgments than returns you submitted.
• Computers run slowly, or the cursor moves on its own.

If you see any of these, act quickly. The IRS asks tax professionals to contact their local IRS Stakeholder Liaison, and the FTC Safeguards Rule requires a report to the FTC within 30 days when unencrypted information on 500 or more consumers is taken.

Making it more than a binder

• Review the plan every year, before the season starts.
• Walk seasonal staff through it on their first day.
• Test a restore from your backups, not just the backup job.
• Confirm multi-factor authentication is on for every account, with no exceptions for partners.
• Remove logins for anyone who has left.

This is the kind of groundwork our cybersecurity and compliance teams handle for financial services firms.

Common questions