IRS Compliance Service
Every paid tax preparer is required by the IRS to maintain an up-to-date, signed Written Information Security Plan (WISP). At TechFiscal, we develop a fully customized WISP tailored to your firm’s unique operations, technology, personnel, and data security practices. Our team delivers a comprehensive, audit-ready plan, helping you meet compliance requirements and prepare confidently for the 2026 filing season.
Get Your WISP — Free ConsultationThe framework
Requires every paid tax return preparer to maintain a written security plan covering taxpayer data. Since 2024, WISP attestation is built into PTIN renewal (Form W-12) — false certification is a federal offense carrying PTIN and EFIN revocation risk.
The 2023 amendments require financial institutions — including CPA and tax firms — to document encryption, MFA, access controls, vendor oversight, and incident response, overseen by a named Qualified Individual.
Classifies any firm handling consumer financial data as a financial institution, requiring a written protection program — including an annual risk assessment and a documented review cycle.
Understanding WISP
A Written Information Security Plan is a formal policy document describing how your firm collects, stores, accesses, and protects sensitive client data. It is not a software product or a checklist — it is the legal record that proves your firm operates a deliberate, documented data security program, and it is the first thing an IRS or FTC examiner will ask to see.
returns/year triggers mandatory WISP status under federal guidance
Risk assessment, access controls, incident response & more
maximum interval between required WISP reviews per IRS guidance
Why It Matters
A WISP is not paperwork for its own sake. It defines your firm’s incident response, your vendor vetting process, your employee training requirements, and your breach notification obligations — in one enforceable document. Per IBM Security’s 2025 Cost of a Data Breach Report, the average breach now costs $4.88 million — a figure that would close most independent tax and accounting practices outright. Even a contained incident involving a few hundred records routinely exceeds $100,000 once notification, forensic review, legal fees, and lost clients are counted.
| Regulation | Who It Applies To | Key WISP Requirement | Enforcement |
|---|---|---|---|
| IRS Publication 4557 | All federal tax return preparers, regardless of firm size | Written plan covering device inventory, access controls, breach response, and staff training | PTIN / EFIN Revocation |
| FTC Safeguards Rule | Financial institutions incl. CPA firms, tax preparers, bookkeepers | Documented program with a designated Qualified Individual and annual risk assessment | Up to $51,744/day (2026) |
| GLBA (Gramm-Leach-Bliley Act) | Any firm handling consumer financial data | Written safeguards program, vendor management policy, and employee training records | Up to $100K + personal liability |
Who Needs a WISP
If your firm touches federal tax data or client financial information in any way, you need a current, signed WISP on file — regardless of headcount, revenue, or how many states you operate in.
IRS Required
Any CPA firm, tax preparation office, or enrolled agent that prepares or transmits federal returns must maintain a current, signed WISP at all times — from a solo practitioner to a multi-partner practice. The IRS can request it during any compliance review and can suspend e-file privileges without one.
GLBA Required
Firms that store, process, or transmit client financial records fall under the GLBA Safeguards Rule even without preparing returns. Handling sensitive financial data for clients triggers a documented written-security obligation.
FTC Required
Advisors and wealth managers holding consumer financial information must maintain a formal, written information security program under the FTC Safeguards Rule — including a named security coordinator and a documented annual review.
IRS Required
Payroll processors hold some of the most sensitive data a business possesses — SSNs, EINs, and direct deposit details. Both the IRS and FTC require documented security policies protecting this data.
What’s Included
We build a fully customized WISP based on your firm’s operations, technology, and compliance needs — created from the ground up, never from a generic template. Here’s exactly what your plan includes.
We document how your firm operates and identify the taxpayer information you collect, process, and store.
A comprehensive assessment of the risks that could impact taxpayer data, aligned with IRS Publication 4557 guidelines.
Clear policies that define how users gain access to sensitive information and how accounts are secured.
A structured response framework to help your firm react quickly and meet reporting obligations if a security incident occurs.
Policies that help ensure every team member understands their role in protecting taxpayer information.
Compliance requirements evolve, and your WISP should too. TechFiscal helps keep your plan current and audit-ready each year.
How It Works
Getting a compliant WISP doesn’t have to be complicated — no lengthy forms, confusing compliance language, or time-consuming paperwork. TechFiscal handles the process from start to finish.
Meet with a specialist, ~20 min, discuss firm structure & workflows
~20 minSystems, data protection and access controls are evaluated
Async intakeA fully customized plan is built for your firm (not template-based)
Custom — not a templateAdjustments + final audit-ready document
Satisfaction guaranteedThe Stakes
Without a current and properly maintained WISP, your firm may face increased compliance risks during audits, security incidents, or regulatory reviews.
The IRS added WISP attestation to the PTIN renewal process (Form W-12) in 2024. Certifying compliance without an actual plan is false certification under penalty of perjury. The IRS can suspend or revoke your PTIN and EFIN — without either, you cannot legally prepare or e-file federal returns.
IRS Publication 4557 — Sections 5 & 6The FTC has actively enforced Safeguards Rule violations against financial firms, including CPA practices, since 2023. The inflation-adjusted maximum civil penalty for 2026 runs into the tens of thousands of dollars per violation, and each day of non-compliance can count as a separate violation.
16 CFR Part 314 — FTC Safeguards RuleMost states layer their own data security and breach-notification laws on top of federal requirements. California, New York, and Massachusetts each carry distinct obligations and separate penalty structures, with state fines reported in the range of $5,000 to $750,000 depending on jurisdiction and incident scale.
State-level enforcement varies by jurisdictionWithout documented security policies, a breach exposes your firm to negligence claims from affected clients. Courts have consistently held that tax professionals owe clients a duty of care — no WISP means no documented evidence that reasonable precautions were taken.
Professional liability & E&O exposureA firm without a WISP may face overlapping compliance risks and potential enforcement actions from multiple regulatory agencies at the same time:
IRS Requirements
A WISP must contain specific elements to satisfy IRS compliance standards. TechFiscal ensures every requirement is clearly documented, easily auditable, and prepared for review by regulatory agencies.
Common Questions
Yes. Firms that prepare or assist with federal tax returns are required to maintain a Written Information Security Plan (WISP) under IRS and FTC data protection requirements. These obligations apply to firms of all sizes, including solo practitioners and seasonal tax preparers.
While sample WISP templates are available, they are intended only as a starting point. Regulators expect your security plan to reflect your firm’s actual technology, personnel, business processes, and security controls. Generic templates often fail to address firm-specific risks and compliance requirements.
A WISP should be reviewed at least once each year and updated whenever there are significant changes to your technology environment, staffing structure, business operations, or security practices. Maintaining documentation of reviews and revisions is essential for compliance.
No. WISP Compliance is available as a standalone service. However, firms enrolled in TechFiscal’s managed IT programs may qualify for discounted pricing and ongoing annual review services.
That’s perfectly fine. We review your existing policies, procedures, and documentation, identify any compliance gaps, and incorporate relevant materials into a complete and updated WISP tailored to current regulatory requirements.
Yes. We supply employee acknowledgment forms and can provide staff training on key security policies, password management practices, phishing awareness, and incident response procedures to help support firm-wide compliance.
Client Feedback
“We went through an IRS data security review last spring and passed without issues. The TechFiscal WISP had every document they asked for, organized exactly right. Worth every penny — this is one thing you don’t want to wing.”
“TechFiscal had our WISP drafted and delivered in under a week. The document actually reflects how our firm works — not some generic template. We’re audit-ready for the first time ever.”
“I had no idea how many gaps we had. TechFiscal walked me through the whole thing and the annual update service means I never have to worry about falling out of compliance again.”
Get Started Today
Don’t wait until a compliance review exposes a gap. TechFiscal delivers a fully customized, IRS-compliant WISP — designed around your firm’s actual systems, staff, and workflows, not a generic template.
Get Your WISP — Free Consultation