Your Firm Has a WISP, But Does It Still Reflect How You Work?
Your accounting firm may already have a written information security plan (WISP). That’s important. But having the document and following it are two different things.
Take multi-factor authentication (MFA). If your WISP says it’s required, could someone show you which accounts have it enabled, when that was last checked, and how any exceptions were handled? If the answer is unclear, that’s a good place to start.
A current document isn’t the same as a working plan
Your WISP describes how your firm intends to protect client information. The day-to-day work tells you whether those protections are actually in place. A recently updated document doesn’t tell you whether access permissions are right, staff have completed training, or a service provider is doing what the plan says it should.
That doesn’t mean you need to rewrite the WISP every time you review it. Check the safeguards, record what you found, and update the plan—or the way your firm operates—when something changes.
The FTC Safeguards Rule applies based on the activities a firm performs, not simply because it calls itself an accounting firm. Tax preparation is one activity the FTC identifies as covered. Firms subject to the Rule must maintain a written information security program, test or monitor safeguards, and adjust the program as circumstances warrant.[1][2]
Make it easy to find the proof
A simple tracking sheet is often enough. For each safeguard in your WISP, note who is responsible, what evidence you reviewed, where it’s stored, when you checked it, any open exceptions, and the next action. It doesn’t need to be complicated.
For example, an MFA review entry might look like this:
Field | Example |
Control | MFA enrollment |
Owner | Office manager |
Evidence to check | Current enrollment export |
Where to find it | Identity provider’s admin console |
Date reviewed | Actual date of the review |
Exceptions | Accounts excluded and reasons, if any |
Next step | Follow-up owner and due date |
An enrollment report may show which accounts are enrolled, but it won’t necessarily prove MFA was required at every sign-in or that each exception was appropriate. Be clear about what you checked and what still needs to be verified. Limit access to the tracking sheet and keep sensitive account-level exports in your firm’s-controlled systems.
What should you review?
Start with the safeguards already listed in your WISP. Common areas include user access, MFA, encryption, employee training, security monitoring or testing, service provider oversight, and incident response. This is a practical starting point, not a complete compliance checklist. MFA uses at least two different types of verification, such as something you know and something you have—not two passwords.[1]
If an access or MFA review is 90 days old, that’s a useful reminder to ask whether it should be checked again. It is not a 90-day deadline imposed by the Safeguards Rule. And if a record is missing, don’t jump to conclusions: perhaps the check happened but wasn’t documented, perhaps it never happened, or perhaps the safeguard itself needs attention.
What if your IT provider handles the work?
Your IT provider may manage systems, configure security tools, or supply reports, depending on your agreement. But outsourcing the work doesn’t remove your firm’s responsibility to oversee it. The Safeguards Rule requires covered firms to oversee service providers, including through appropriate contract safeguards and periodic, risk-based assessments.[2]
Ask your provider which systems are in scope, what records they can provide, and which decisions belong to your firm. A report that isn’t immediately available doesn’t necessarily mean the provider dropped the ball. First find out what the agreement covers and where the record is supposed to live.
If The Computer Guy, LLC (TCG) manages a system for your firm, we can help you identify what evidence is available for the work we perform. Your firm still needs to review that information and decide whether it’s sufficient.
Start with one safeguard
Pull up your WISP and choose one item to review. Find the person responsible, locate the supporting record, note when it was checked, and identify anything that still needs attention.
If reality matches the plan, document it. If it doesn’t, assign someone to follow up and set a date.
If you’re creating a WISP or updating an older one, IRS Publication 5708 includes a sample written information security plan for tax and accounting practices. It’s a helpful starting point, but it needs to be tailored to your firm.[3]
A useful WISP isn’t the one that looks the best on paper. It’s the one that reflects what your firm actually does—and gives you a way to check.
A note on scope
Whether the Rule applies, and whether any limited exceptions apply, depends on your firm’s activities and circumstances. Limited exceptions do not remove every requirement. If an outside provider employs the Qualified Individual overseeing a covered firm’s program, the firm must still designate a senior employee to direct and oversee that individual and require the provider to maintain a protective information security program.[1][2] This tracking approach is not a compliance certification or a guarantee against a breach.
Not sure whether your WISP reflects how your firm actually operates? At The Computer Guy, LLC (TCG), we work with accounting firms to help them understand where their technology and security practices stand and identify areas that may need attention. If you'd like a second set of eyes, we're happy to have a conversation.
Sources
[1] Federal Trade Commission, FTC Safeguards Rule: What Your Business Needs to Know. https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
[2] 16 CFR § 314.4, Elements of the Safeguards Rule; 16 CFR § 314.6, Exceptions. https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4
[3] Internal Revenue Service, Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice. https://www.irs.gov/pub/irs-pdf/p5708.pdf
Comments