Published
IRS Publication 5708 gives tax preparers a sample structure, not a completed security program. Tailor it to your firm's real workflows and safeguards, then track what still needs implementation.
What is the IRS WISP template?
IRS Publication 5708 is a free guide that includes a sample Written Information Security Plan for tax and accounting practices. It provides a starting structure, explanations, and example attachments.
The sample is not a complete plan for every firm. Read the instructions, download the publication directly from IRS.gov, and replace generic language with details about your systems, people, vendors, and responsibilities.
A blank template is a drafting aid, not a completed or implemented security program. A document that uses your firm's name is not necessarily a document that describes how your safeguards work.
Do small tax preparation firms need a WISP?
The FTC Safeguards Rule includes tax preparation firms among covered financial institutions. Covered firms must develop, implement, and maintain an information security program appropriate to their operations and the sensitivity of customer information.
Firm size is not a blanket exemption. The exception for institutions maintaining information about fewer than 5,000 consumers applies to specific provisions, and coverage depends on the firm's activities and applicable jurisdiction. Confirm your obligations with qualified counsel when needed.
A WISP should give the people protecting client data clear direction and be simple enough for the firm to keep current.
Start with one client's information journey
Before editing policy language, trace how a typical client's documents move through your firm. Use the exercise to identify safeguards to document.
For example, a client may upload documents, a seasonal preparer may review them remotely, a partner may approve the return, and supporting files may be retained afterward. Identify the systems, access points, and responsible people at each stage.
Ask which portal, mailbox, computer, and application handle the documents; whether staff download or forward copies; who can access the records; and what happens to those copies after the engagement ends. Repeat the exercise for materially different workflows such as payroll or bookkeeping.
Record the actual product and responsible person. Do not put passwords, recovery codes, or taxpayer records into the WISP.
Turn responsibilities into actions someone can own
A plan that assigns everything to “IT” leaves unanswered questions when your software vendor, outside provider, and office manager handle different tasks.
Use a simple responsibility table for actions such as approving seasonal access, removing access when work ends, reviewing a backup restoration, and handling a suspicious client-document request. Name the decision owner, the person performing the work, and the evidence to retain.
Choose a backup contact for time-sensitive tasks. An incident should not wait for one person to return from vacation.
Keep a responsibility and evidence tracker
For each safeguard, note the covered system or workflow, who decides, who implements it, the current status, a dated evidence reference, the next action, its target date, and who reviewed it. Keep the evidence itself in approved private storage; the tracker needs a reference, not a copy of taxpayer records, credentials, or sensitive configuration.
Check seasonal staff access before and after the engagement
Seasonal access is easier to manage when the approved route and end date are clear before a preparer starts. Review the steps with each staff member and the person responsible for accounts:
- Use an approved individual account; do not share a partner or coworker's login.
- Confirm multifactor authentication is set up for the approved accounts and portals.
- Use only the firm's approved client-document portals and approved devices or storage locations.
- Handle client information only through the agreed workflow; do not forward it to personal email or keep unapproved local copies.
- Give each person a reporting contact and a backup contact for suspicious messages, lost devices, or misdirected documents.
- At the end of the engagement, remove or disable access, review shared links and retained copies, and record who confirmed closure.
Separate written safeguards from verified safeguards
Treat every broad statement in the draft as a question to investigate. If the plan says remote access uses multifactor authentication, list each route and ask the responsible administrator to demonstrate enforcement on each one.
For each safeguard, record whether it is verified, reported but unverified, planned, or requiring correction. Keep the evidence date and scope beside the conclusion.
Useful evidence may include an access export, device-management report, restore-test record, alert-routing configuration, or documented review. Do not describe a planned safeguard as operational.
Write procedures around real requests
Your staff need to recognize when an ordinary workflow becomes suspicious. The IRS has warned tax professionals about new-client phishing messages that use links or attachments to target their systems.
Decide how the firm verifies an unexpected inquiry, which document-transfer method staff should use, and where an employee reports a questionable message. Walk through the procedure with preparers and front-office staff.
Then test a credential-theft scenario. Can staff find the response contacts without opening the potentially affected mailbox? Record uncertainty as a procedure gap and assign the next action.
Give unresolved gaps a visible next step
Do not quietly leave sample language that describes a safeguard you have not implemented. Keep an action register with the affected system or workflow, what remains uncertain or needs correction, the responsible owner, target date, interim measure, and evidence needed to close the item.
For example: confirm whether inactive seasonal accounts remain in the document portal, have the office manager obtain an administrator export, and assign a partner to review the result.
Use the action register to track implementation and bring questions about legal obligations to your qualified adviser.
Update the plan when the business changes
Add a WISP review question to decisions about new software, providers, locations, and staffing: does this change who can access client information or how the firm protects it?
Keep a version history showing who approved each material revision. Set a recurring review date and revisit affected sections when systems, vendors, staffing, remote-work practices, or responsibilities change.
Common WISP questions
Can I use the free IRS WISP template without hiring a consultant? Yes. Publication 5708 is available to help firms develop their own plans. Outside support can help with adaptation, documentation, or separately scoped safeguard review.
Does completing the template prove compliance? No. A completed document does not demonstrate that its safeguards are implemented. The plan, actual practices, and supporting evidence need to agree.
Can our IT provider help? Yes. Your provider can explain configurations and supply agreed technical evidence. Your firm still needs to decide who should have access and who owns each responsibility.
Need help adapting the WISP to your firm?
Securing Your Business provides WISP support for tax preparers, including tailored development or revision, responsibilities, implementation priorities, and evidence review when included in the agreed scope.
A document-only engagement helps tailor the plan, clarify responsibilities, and organize stated practices and available documentation. Separately scoped technical verification reviews agreed evidence such as account settings, access exports, or restore records.
Bring your existing plan if you have one, a general description of your technology, and the questions you cannot confidently answer. Scope, deliverables, and price are agreed before work starts.
Sources
Write down the response before you need it
Use our free small business incident response plan template to record contacts, insurer notice instructions, and recovery priorities. The 18-page fillable PDF includes industry add-ons and a short tabletop exercise for your team and IT provider.
Discuss WISP support for your tax firm.
Share a nonconfidential summary of your firm, existing plan, and questions. Documentation support and technical verification are scoped separately; do not submit taxpayer records, credentials, or sensitive evidence through the public form.