A CPA firm holds what identity thieves want: names, Social Security numbers, bank details, payroll records and financial statements, for many clients in one place. The IRS says data thefts at tax professionals' offices are on the rise and that data security is a necessity for every tax professional, whether a partner in a large firm or a sole practitioner. It also says protecting taxpayer data is the law. This article lays out a program a firm can run, built on the FTC Safeguards Rule and the IRS publications that apply it to tax and accounting practices. The existing article on the FTC Safeguards Rule and vendor oversight covers service providers in more depth.
The legal frame
Publication 4557 states that federal law gives the Federal Trade Commission authority to set data safeguard regulations for entities including professional tax return preparers, and that under the Safeguards Rule, tax return preparers must create and enact security plans to protect client data. It adds that failure to do so may result in an FTC investigation. Publication 5708 states that tax and accounting professionals are considered financial institutions under the rule, regardless of size, and that the rule requires a written information security plan.
The rule at 16 CFR Part 314 lists what the program must contain:
- A designated qualified individual to implement and supervise the program.
- A written risk assessment that is repeated over time.
- Access controls that are periodically reviewed.
- Encryption of customer information on the system and in transit.
- Multi-factor authentication for anyone accessing customer information.
- Continuous monitoring, or else annual penetration testing and vulnerability assessments at least every six months.
- Oversight of service providers.
- A written incident response plan.
- Written reports to the board or governing body by the qualified individual.
- Notification to the FTC of a breach affecting 500 or more consumers' unencrypted information, as soon as possible and no later than 30 days after discovery.
A firm that holds customer information on fewer than 5,000 consumers is exempt from four of these elements: the written risk assessment, the testing requirement, the written incident response plan and the annual report to the governing body (16 CFR 314.6). The IRS still recommends each of them. Use the list as the program's table of contents.
Governance
Name the qualified individual in writing, with authority and time to do the job. In a small firm, that is often a partner or the office manager with an outside adviser. Report to the partners at least annually, in writing, on risks, incidents, testing and plan changes. Keep the reports. A security program that exists only in the head of the person who set it up fails the first time that person is unavailable.
Controls that matter most
Publication 4557 lists basic steps and the firm should adopt each as policy:
- Phishing awareness. Train staff to recognize phishing emails, especially those pretending to be from the IRS, e-Services, a tax software provider or a cloud storage provider, and never to open embedded links or attachments in a suspicious message.
- Security software. Anti-virus and anti-malware on all devices, with automatic updates.
- Strong, unique passwords and a password manager if the firm chooses one.
- Multi-factor authentication for anyone accessing customer information.
- Encryption of sensitive files and emails, especially those with taxpayers' personally identifiable information.
- Backups to a secure external source not connected full time to the network.
- Final review of return information, especially direct deposit details, before e-filing.
- Disposal. Wipe or destroy old drives and printers that held sensitive data.
- Least privilege. Limit access to taxpayer data to people who need it.
- E-file monitoring. Check e-file applications and PTIN accounts weekly for the total returns filed, and deactivate unused EFINs.
- Authorizations. Withdraw from outstanding powers of attorney and tax information authorizations for taxpayers who are no longer clients.
- Audit logs that record who did what, when and what changed.
- Clean desk policy.
Remote and hybrid work
Remote work extends the firm's network into homes. The publication calls for a VPN that creates a secure, encrypted connection to the office network together with multi-factor authentication, and the FTC checklist asks firms to set policies for employees who telecommute, including whether and how they may keep or access customer data at home, and protections against viruses and spyware on personal computers. See remote and hybrid audit fieldwork.
Service providers
Software, cloud storage, payroll, outsourced preparation and IT providers all touch client data. The Safeguards Rule requires the firm to select providers that can maintain safeguards, require them by contract to do so and oversee their handling of customer information. See ET 1.150 third-party service providers, ET 1.700 confidentiality and offshore and section 7216 consent for offshore preparation.
Training and accountability
Every employee, professional and administrative, should be trained on threats and safeguards. Include a signed acknowledgment of confidentiality and security standards, discipline for violations and immediate deactivation of access for departing staff. Repeat training on a schedule and after any incident.
Testing and monitoring
Test that the controls work: restore from a backup, run a phishing simulation, review user access lists, review the audit logs and check that departed staff accounts are closed. Record the results and the fixes. Update the written plan when the tests show gaps or when operations change.
Incident response
Keep a written plan that says who decides, who is called, how evidence is preserved and when clients, the IRS, the states and the FTC are notified. See data theft response plan for tax and audit firms.
Documents to maintain
- The written information security plan. See WISP template walkthrough.
- The risk assessment and the hardware and software inventory.
- The checklist from Publication 4557. See IRS Publication 4557 checklist.
- Training records and acknowledgments.
- Vendor contracts and oversight records.
- Test results and corrective actions.
- The incident response plan and any incident log.
Why the audit side cares
Firms that audit clients also hold client data in workpapers, and the same controls apply. The AICPA's confidentiality and AI guidance applies to data entered into any tool. See AICPA confidentiality and AI tools with client data and AI governance framework for CPA firms.
FAQ
Does the Safeguards Rule apply to a small firm?
Publication 5708 says tax and accounting professionals are financial institutions under the rule regardless of size. Firms with information on fewer than 5,000 consumers are exempt from four elements (16 CFR 314.6) but not from the rest.
Is multi-factor authentication required?
The FTC rule calls for multi-factor authentication for anyone accessing customer information on the system.
When must the FTC be told of a breach?
For a breach affecting 500 or more consumers' unencrypted information, as soon as possible and no later than 30 days after discovery.
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Sources
- FTC, Standards for Safeguarding Customer Information (Safeguards Rule), 16 CFR Part 314: https://www.ecfr.gov/current/title-16/part-314
- IRS, Publication 4557, Safeguarding Taxpayer Data: https://www.irs.gov/pub/irs-pdf/p4557.pdf
- IRS, Publication 5708, Creating a Written Information Security Plan: https://www.irs.gov/pub/irs-pdf/p5708.pdf
- IRS, Protect your clients; protect yourself: https://www.irs.gov/tax-professionals/protect-your-clients-protect-yourself
Part of CORAA University · Tax and compliance for CPA firms: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error