When a firm discovers that client data has been stolen or locked, the first hours are spent deciding who to call and what not to touch. A written response plan removes the guesswork. The FTC Safeguards Rule requires a written incident response plan, and Publication 4557 sets out the steps the IRS expects tax practitioners to take. This article builds a response plan from those sources. For the related client-side scenario, see ransomware at an audit client.
What the sources require
The FTC Safeguards Rule (16 CFR 314.4(h) and (j)) requires a written incident response plan, except for firms holding information on fewer than 5,000 consumers (314.6), and requires notice to the FTC of a breach affecting 500 or more consumers' unencrypted information as soon as possible, and no later than 30 days after discovery. Publication 5708 repeats that a security event affecting 500 or more people must be reported to the FTC within that time. Publication 4557 states that tax practitioners should report data losses or thefts immediately to the IRS so that precautions can be taken to protect clients from fraudulent returns filed in their names.
Step 1: Contain
Take immediate action to secure compromised information. Publication 4557 gives the example that if an internet-connected computer is compromised, disconnect it from the internet. Turn off remote access paths that may be in use. Change credentials for affected accounts, with a plan for the order, and check that the intruder has not created new accounts.
Step 2: Preserve
Publication 4557's FTC checklist calls for preserving and reviewing files and programs that may show how the breach occurred, so do not wipe a compromised machine. Record the date and time of discovery, who found it and what was seen. Keep logs. Note what has been done to the systems since discovery. Forensic evidence can disappear in a restart or a cleanup.
Step 3: Bring in expertise
The publication recommends security professionals to determine the cause and scope of the breach, stop it and prevent more. Have a retainer or a named provider before an incident. Engage counsel as well, so that communications about the incident follow privilege rules where they apply.
Step 4: Notify the IRS, states and law enforcement
Publication 4557 says to:
- Report client data theft to the local IRS Stakeholder Liaison.
- Contact the FBI local office if directed by the IRS.
- File a police report with local police.
- Contact the states where the firm prepares state returns, using the Federation of Tax Administrators contact list for reporting a data breach.
- Contact the insurance company to report the breach and check whether the policy covers mitigation costs.
- For ransomware, contact the FBI and CISA in addition to the IRS.
The publication notes that IRS telephone assistors cannot accept third-party reports of identity theft, so the firm should keep the Stakeholder Liaison updated with developments.
Step 5: Notify the FTC and clients
For a breach of 500 or more consumers' unencrypted information, notify the FTC as soon as possible and no later than 30 days after discovery, electronically on the form on the FTC website. Publication 4557's FTC checklist also says to consider notifying consumers if their personal information is subject to a breach that poses a significant risk of identity theft or related harm, law enforcement if criminal activity may be involved and the credit bureaus and other businesses that may be affected, and to check state breach notification laws. The FTC provides a guide for businesses on data breach response with templates for client letters. Prepare the client notice with counsel and approve it through the one designated spokesperson, as the WISP template recommends through its Public Information Officer. See WISP template walkthrough.
Clients who are told promptly can take protective steps, such as the Identity Protection PIN that the IRS makes available. Publication 4557 recommends educating clients about it.
Step 6: Recover
- Determine how the intrusion or theft occurred and make required fixes before resuming tax preparation and before being issued a new EFIN, as the publication says.
- Develop a continuity plan.
- Make full backups of all business data. If backups were not being made, begin during recovery. A routine backup means a data loss or ransomware attack will not destroy all the files.
- Restore from clean backups after the cause is removed.
- Review e-file accounts and PTIN activity for fraudulent returns.
Step 7: Document and learn
Write a post-incident report: timeline, cause, data affected, actions taken, notifications and dates, costs and corrective actions. Update the written information security plan and the risk assessment. Report to the partners and, as the FTC rule describes, in writing to the governing body. Record the lessons in training. See cybersecurity for CPA firms.
Plan outline
A response plan should be short enough to use under stress:
- Roles. Incident lead, technical lead, counsel, spokesperson, partner contact. Names and phone numbers, including backups.
- Triggers. What counts as an incident: lost device, phishing success, unauthorized access, ransomware, vendor breach.
- First hour checklist. Contain, preserve, call the incident lead.
- Contact list. IRS Stakeholder Liaison, FBI, local police, state agencies, insurer, security provider, counsel, software vendors and clients.
- Decision tree. Whether FTC notice applies, whether client notice applies and what the state law says.
- Communication templates. Reviewed in advance.
- Recovery steps. Restore, test, return to service.
- Post-incident review. Within a set period.
Test the plan with a tabletop exercise at least annually and record the results.
Audit and engagement implications
If an incident exposes audit workpapers or client confidential information, review the confidentiality duties and any client contract terms on notice. See AICPA confidentiality and AI tools with client data and ET 1.700 confidentiality and client data offshore. Where an attest client's data is involved, the engagement team should consider the effect on the engagement and communications with those charged with governance.
FAQ
Who is the first call after discovering theft?
Internally, the incident lead. Externally, a security professional and counsel, then the IRS Stakeholder Liaison.
Is notice to the FTC always required?
For a breach affecting 500 or more consumers' unencrypted information, the FTC states it is required within 30 days of discovery.
Should the firm keep working during an incident?
Only on systems confirmed clean. The publication says fixes must be made before tax preparation resumes.
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Sources
- IRS, Publication 4557, Safeguarding Taxpayer Data: https://www.irs.gov/pub/irs-pdf/p4557.pdf
- IRS, Publication 5708, Creating a Written Information Security Plan: https://www.irs.gov/pub/irs-pdf/p5708.pdf
- FTC, Standards for Safeguarding Customer Information (Safeguards Rule), 16 CFR Part 314: https://www.ecfr.gov/current/title-16/part-314
Part of CORAA University · Tax and compliance for CPA firms: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error