The Question Nobody Asks Until It's Too Late

Every CPA firm owner thinks they'll get to it eventually — the WISP, the compliance paperwork, the whole security documentation thing. It sits on the to-do list right below "clean up the shared drive" for years, until an auditor asks for it, an insurer requires it for renewal, or worse, a breach happens and there's nothing to show. If your firm doesn't have a Written Information Security Program in place, it's not a paperwork gap. It's a real, measurable risk sitting on your books right now.

What a WISP Actually Is (And Why It's Not Optional)

A WISP — Written Information Security Program — is a documented plan showing exactly how your firm protects client financial data: Social Security numbers, bank details, tax records, the works. Under the FTC Safeguards Rule, any firm that handles this kind of taxpayer data is required to have one, and the IRS backs this up through Publication 4557. This isn't a "best practice" suggestion. It's a legal requirement, and it applies whether you're a solo practitioner or a 50-person firm.

Here's the part a lot of firm owners miss: using cloud software like QuickBooks, UltraTax, or Lacerte doesn't get you off the hook. Your provider securing their platform is one layer. Your firm still has to document how staff access that data, what happens if a laptop gets stolen, how passwords are managed, and who's responsible when something goes wrong. That documentation is the WISP, and no software subscription writes it for you.

The Direct Costs of Not Having One

Let's talk numbers, because that's what actually gets attention. The FTC Safeguards Rule allows for penalties that can run into thousands of dollars per violation, and "per violation" can mean per client record affected — which adds up fast for a firm holding hundreds of tax files. On top of that, missing WISP documentation puts your PTIN renewal at risk with the IRS. No renewed PTIN means you can't legally prepare returns for compensation. That's not a fine — that's your firm's ability to operate.

The Cost You Don't See Coming: Insurance

Professional liability and cyber insurance carriers have gotten a lot more aggressive about this in the last couple of years. Many now ask for proof of a documented WISP before they'll renew your policy, and some have started denying claims after a breach if the firm can't show they had reasonable security measures documented and in place beforehand. So the scenario firms don't think about: you get breached, you file a claim, and the insurer denies it because there was no WISP on file. Now you're covering breach response, client notification, and reputational damage entirely out of pocket.

The Client Trust Cost

Beyond fines and insurance, there's a slower cost that's harder to put a number on: client trust. CPA firms deal in the most sensitive financial information a person has. If your firm gets breached and it comes out that basic documented security practices weren't in place, that's not just a bad news cycle — that's clients quietly moving their business to a firm that can show they take data security seriously. In a field built almost entirely on trust and referrals, that's expensive in a way that doesn't show up on a single invoice.

What This Actually Looks Like in Practice

A managed IT service for CPA firms that specializes in this space builds the WISP as part of the core engagement, not as an upsell. That means risk assessments mapped to your actual systems, a written policy your leadership signs off on, and an annual review cycle so the document doesn't go stale the moment regulations shift. This is the difference between a generic IT service for CPA firms that treats compliance as someone else's job, and a managed IT service built specifically around how accounting firms operate — where WISP compliance, cybersecurity, and day-to-day IT support come from the same team looking at the same systems.

The Real Question to Ask Yourself

If an examiner, insurer, or new client asked to see your WISP tomorrow, could you produce one? If the honest answer is no, that's worth fixing before it becomes a bigger problem than a checklist item. [Check out our WISP compliance service] to see exactly where your firm stands — most firms find out their gaps in a single free audit, not after something goes wrong.

FAQs

Do I need a WISP if I'm a solo practitioner?
Yes. The FTC Safeguards Rule and IRS Pub. 4557 apply regardless of firm size — a one-person practice handling taxpayer data still needs documented security policies.

How much does it cost to build a WISP?
It varies by firm size and existing infrastructure, but most managed IT services for CPA firms bundle WISP drafting into a broader engagement rather than charging as a standalone project.

Will my insurance company actually ask for my WISP?
Increasingly, yes. Many cyber and professional liability carriers now request proof of a documented security plan before renewing coverage, and some have denied claims without one.

Can I write a WISP myself without an IT provider?
Technically yes, but it needs to reflect your firm's actual systems and be defensible under audit — most firms end up working with a provider who specializes in IT service for CPA firms to get it right the first time.