IRS written information security plan

Not as a clause inside the letter. For Form 1040 filers, Rev. Proc. 2013-14 requires the consent to be a separate written document, on paper or electronic, though it may be attached to the engagement letter. It must include the mandatory statements, be signed and dated by the taxpayer, and be in place before the disclosure or use it covers.

No. Treasury regulations list what counts as authority for substantial authority purposes, such as the Code, regulations, rulings and court cases, and state that conclusions in treatises, periodicals and opinions of tax professionals are not authority. An AI answer can point to authorities, but the preparer has to read and weigh the primary sources themselves before relying on a position.

It can help draft, summarize and flag issues, but the firm stays responsible for the return. Treat AI output as a draft that a credentialed preparer reviews, and hold features that suggest tax positions to the same review standard as staff work. If a vendor's AI makes substantive determinations, ask counsel how the Section 7216 rules on disclosures to other preparers apply.

On a fixed date written into the approval, such as April 30 or the extension deadline, never an open-ended phrase like "after tax season." At expiry, the owner either closes the exception with evidence or brings it back to the approver for a fresh, dated renewal. An exception that quietly rolls into the next season becomes an undocumented gap in the WISP.

The Safeguards Rule at 16 CFR 314.4(e) requires covered financial institutions, which the IRS says includes tax preparers, to provide personnel with security awareness training that is updated as necessary. The rule does not name specific lures, so firms often use current IRS warnings, such as the new client and EFIN scams, as training content.

Not as of Oct. 17, 2026. The IRS announced Tax Professional Awareness Week for the week of Oct. 19, 2026 to help preparers get ready for the 2027 filing season, but the opening date for accepting 2026 returns had not been published. Firms should watch IRS.gov news releases, which typically announce the date before the season begins.

The IRS published its 2026 Dirty Dozen in IR-2026-30 on March 5, 2026. The list covers IRS impersonation by email and text, AI-enabled IRS phone impersonation, fake charities, misleading tax advice on social media, IRS Online Account identity theft, abusive Form 2439 claims, bogus self-employment tax credits, ghost preparers, inflated noncash charitable deductions, overstated withholding, spear-phishing and malware aimed at tax professionals, and aggressive Offer in Compromise marketing. Item 11 is the one written for tax firms.

IRS guidance says to email dataloss@irs.gov with the subject "W2 Data Loss," including the business name, EIN, a contact, a summary of the loss and the number of employees affected, without attaching any employee data. It also directs businesses to statealert@taxadmin.org for state reporting and to file a complaint with the FBI's IC3.

The IRS asks tax professionals not to reply or click links, and to send the message to phishing@irs.gov with the subject line "Spearphishing," then report it to the Treasury Inspector General for Tax Administration and delete it. Forwarding the email as an attachment preserves the header data the IRS uses to trace the sender. Reports to the FTC and IC3 are also accepted.

Stakeholder Liaisons are IRS contacts assigned by geography who receive data theft reports from tax professionals. The IRS says that if theft is reported quickly, it can take steps to block fraudulent returns filed in clients' names. Liaisons are listed by state on IRS.gov, so it helps to record your local contact in your incident plan before busy season.

Deleting helps contain the exposure, but it does not answer whether a notice duty applies. Capture what was uploaded, when, and by whom before deleting, because that record supports the firm's Section 7216, FTC Safeguards Rule and state breach analysis. Vendor terms decide how long deleted content stays on their systems. OpenAI, for example, says deleted chats are scheduled for permanent deletion within 30 days.

Weekly during filing season. IRS Publication 4557 tells preparers to check e-File Application and PTIN accounts weekly for the total returns filed and to deactivate unused EFINs. A count higher than the returns the practice actually filed is a sign of data theft and should be reported to the IRS Stakeholder Liaison.

Only in certain cases. The IRS says clients should complete Form 14039, the Identity Theft Affidavit, if they receive an IRS notice or letter, or if their e-filed return is rejected because of a duplicate Social Security number. The preparer's report to the Stakeholder Liaison is what lets the IRS start screening returns tied to the stolen data.

After three failed attempts, the client cannot use the e-signature option for that form. IRS Publication 1345 requires the ERO to obtain a handwritten signature on Form 8878 or 8879 instead. Signatures returned by mail, fax, email or hand delivery are handled as handwritten signatures, not remote e-signature transactions.

Yes. IRS Publication 1345 accepts identity verification that meets NIST SP 800-63 Level 2 with knowledge-based authentication, or a higher assurance level. NIST's current guidance, SP 800-63A-4, finalized in July 2025, says knowledge-based verification shall not be used for identity verification, so some firms choose a stronger method such as ID document and selfie checks.

IRS Publication 1345 requires the Electronic Return Originator to keep Forms 8878 and 8879 for three years from the return due date or the IRS received date, whichever is later. The forms are not sent to the IRS unless requested, and EROs may store them as electronic images if the system meets Revenue Procedure 97-22.

Yes. IRS Publication 1345 allows taxpayers to e-sign Forms 8878 and 8879 when the return is e-filed through an ERO whose software verifies the taxpayer's identity first and keeps an audit trail of the signing. If the taxpayer fails verification three times, the ERO must get a handwritten signature instead.

Yes, for remote signings. The IRS states that identity verification must be completed every time a taxpayer electronically signs Form 8878 or 8879. The only exception is a taxpayer who signs in person and has a multi-year relationship with the ERO. A verification completed last season does not carry forward to this season's remote signature.

The Safeguards Rule sets no review frequency for logs. It asks for controls designed to detect unauthorized use, which points to a risk-based schedule the Qualified Individual sets and writes down. Many practices review automated alerts as they arrive and sample activity more often during filing season. Whatever the cadence, record who reviewed, when, and what was found.

Yes. In IR-2026-106, the IRS stated that the MFA requirement applies to tax preparation firms regardless of size. The FTC Safeguards Rule, 16 CFR 314.4(c)(5), requires MFA for any individual accessing any information system unless the Qualified Individual approves reasonably equivalent or more secure controls in writing.

IRS Publication 4557, Safeguarding Taxpayer Data, is the IRS guide to protecting client information for tax and accounting professionals. It explains the FTC Safeguards Rule obligations that apply to preparers and recommends specific controls, including anti-malware on all devices, drive encryption, multi-factor authentication and minimum password lengths. Publication 5708 provides a sample WISP built on it.

The Security Six are the baseline protections in the IRS Taxes-Security-Together Checklist: activate anti-virus software, use a firewall, use two-factor authentication when it is offered, use backup software or services, use drive encryption, and create and secure virtual private networks. They are a starting point. A firm's written information security plan should describe how each one is implemented.

No. The IRS says its toll-free assisters cannot accept third-party notification of tax-related identity theft. Tax professionals report client data theft to their local IRS Stakeholder Liaison instead, who notifies IRS Criminal Investigation and others within the agency. Liaisons are listed by state on IRS.gov, so the contact belongs in the firm's incident response plan.

Yes. IRS Publication 5708 provides a sample written information security plan for tax and accounting practices, and Publication 4557 gives broader safeguarding guidance. A template is a starting point; the plan should describe your firm's actual systems, vendors, and procedures.

It is an annual campaign by the IRS and its Security Summit partners, held in early December, that warns taxpayers, businesses and tax professionals about identity theft and scams before filing season. The 10th annual week took place in the first week of December 2025 and reminded tax professionals of their legal obligation to keep a Written Information Security Plan and use multi-factor authentication.

Every PTIN expires on December 31 of the year it was issued, so preparers renew each fall for the coming year. The 2026 renewal fee was $18.75. Online renewal takes under 15 minutes, while a paper Form W-12 can take about six weeks to process. Line 11 of the current Form W-12 includes the data security acknowledgment.

Line 11 of Form W-12 (Rev. October 2025) asks preparers to check Yes or No to a statement that they are aware paid tax return preparers are required by law to create and maintain a written information security plan protecting all taxpayer information. The line refers preparers to IRS Publications 5708 and 4557.

Under 16 CFR 314.6, a firm that maintains customer information on fewer than 5,000 consumers is exempt from four requirements: the written risk assessment, continuous monitoring or penetration testing, the written incident response plan, and the Qualified Individual's annual written report. Everything else, including MFA, encryption, training, access controls and vendor oversight, still applies.

At the time employment ends. The IRS sample WISP in Publication 5708 says terminated employees' logins and passwords will be disabled at the time of termination, and Publication 4557 says to deactivate passwords and user names immediately. Setting an end date when the account is created, then verifying the next day, keeps removal from depending on memory.

No. IRS Publication 4557 tells firms to prevent password sharing and make sure each employee with access to taxpayer accounts uses a unique password, and the IRS sample WISP in Publication 5708 states the firm will not have shared passwords or accounts. Named logins also show who did what and let the firm remove one person cleanly.

A knowing or reckless violation of Section 7216 is a misdemeanor punishable by up to one year in prison and a fine of up to $1,000. Section 6713 adds a civil penalty of $250 per improper disclosure or use, capped at $10,000 per calendar year. Those amounts rise to $1,000 and $50,000 when the disclosure is connected to identity theft.

It can be. The regulations define disclosure as making tax return information known to any person in any manner whatever, and a public AI service is a third party. The rules include exceptions and a written consent process, and whether a specific vendor fits one is a question for counsel. A free consumer chatbot used with a personal account is unlikely to fit any of them.

It must name the preparer and taxpayer, state the purpose, identify the information and recipient, and be signed and dated by the taxpayer. For Form 1040 filers, Rev. Proc. 2013-14 adds format rules: a separate document, at least 12-point type on paper, mandatory statements in a set order, affirmative opt-in, and a one-year default duration if none is stated.

Treasury regulations define a tax return preparer to include an employee who performs services that assist in preparing returns as part of the job, and the text does not distinguish by hours or season. A seasonal preparer or intern who helps prepare returns is covered, so the firm's AI rules on client data should apply to them from the first day.

A security exception is an approved, time-limited departure from a specific written policy or control, usually with compensating controls and an expiry date. Risk acceptance is a broader leadership decision to tolerate an identified risk without fully reducing it. A seasonal preparer working on an approved MFA alternative until enrollment finishes is an exception. Deciding, on the record, not to fund a planned control this year is risk acceptance.

Under 26 CFR 1.6107-1(b), the signing preparer must keep a copy of each return, or a list showing the taxpayer's name, TIN, tax year and return type, for three years after the close of the return period. The return period runs from July 1 to June 30, so a return filed in April 2026 must be kept until at least June 30, 2029.

Yes. The rule's definition of financial institution, at 16 CFR 314.2(h)(2)(viii), includes an accountant or other tax preparation service in the business of completing income tax returns. Covered firms must maintain a written information security program meeting 16 CFR 314.4, scaled down somewhat for firms with fewer than 5,000 consumers.

The IRS says to report the theft to your local IRS Stakeholder Liaison right away, because speed is critical to blocking fraudulent returns. Its data theft guidance also lists the state tax agencies (through the Federation of Tax Administrators), state attorneys general, the FBI, the Secret Service if directed, local police and affected clients. If the event involves the information of 500 or more consumers, the FTC Safeguards Rule also requires notice to the FTC within 30 days of discovery.

It depends on what the feature does and how the vendor uses the data. The regulations allow disclosure to software contractors and processing services within limits, but uses outside the exceptions, such as substantive advice from another preparer or vendor use of data for its own purposes, generally require the taxpayer's signed written consent. Tax counsel should review each feature.

According to the IRS, anyone with a Social Security number or an individual taxpayer identification number can get an Identity Protection PIN, including people living abroad. The six-digit PIN prevents someone else from filing a tax return using that number. Taxpayers request it themselves, so tax practices typically tell clients how to sign up rather than requesting it for them.

If staff use AI tools with client information, the plan should address them. The FTC Safeguards Rule requires access controls, monitoring of authorized users and oversight of service providers, and the IRS reminds tax professionals that federal law requires a written information security plan. A short AI section names approved tools, prohibited data and the controls that enforce the rule.

At least once a year and whenever something material changes. IRS Publication 5708 tells firms to review the plan at least annually or whenever there is a material change, and 16 CFR 314.4(g) requires tax preparers to adjust their security programs after material changes to operations, testing results or risk assessments.