Free WISP Audit Checklist for Tax Preparers
See if your firm's Written Information Security Plan would survive an IRS review or FTC enforcement action — in under 10 minutes.
By the WISPWolf Compliance Team · Updated June 2026 · 10 min read
The IRS Security Summit is actively increasing WISP enforcement for tax preparers, CPAs, enrolled agents, and small firms. In 2026, IRS examiners and FTC investigators look for specific documentation — not just that a Written Information Security Plan exists, but that it is current, implemented, and reviewable on demand. This checklist maps directly to IRS Publication 4557, IRS Publication 5708, and FTC 16 CFR Part 314. Use it before your PTIN renewal, before any cyber insurance application, and before your next annual WISP review.
What IRS auditors look for in a WISP review
These are the eight documentation categories most commonly requested during IRS data-security reviews and FTC Safeguards Rule enforcement actions. Each item below is a direct quote or paraphrase from IRS Publication 5708, IRS Publication 4557, or 16 CFR Part 314.
The WISP audit checklist
Work through each category. Mark yes only if you can produce documentation on request. If you mark no, that is a gap — and gaps are what auditors write up.
Written program documentation
- Named Qualified Individual documented in writing with title, contact information, and scope of authority
- WISP signed and dated within the last 12 months by the QI and firm leadership
- Annual review attestation on file with date, reviewer name, and summary of changes
- WISP version history maintained so an auditor can trace what changed and when
- Staff list with access levels documented — who can access client data, on which systems, and at what permission level
- Physical and remote access policy current, including visitor procedures, workstation locking, and off-hours access rules
Risk assessment & controls
- Written risk assessment completed within the last 12 months with a clear completion date
- Risk assessment covers all systems containing client data — tax software, cloud storage, email, backups, and any mobile devices
- Risk ratings assigned and documented for each identified threat, with likelihood and impact scores
- Control decisions mapped to risk findings — every risk has a corresponding documented control
- Vendor security assessment on file for all data-handling service providers, including tax software, IT support, and cloud backup vendors
Technical safeguards
- MFA enabled on all systems accessing client data — not just email, but tax software, cloud storage, remote desktop, and password managers
- Data encrypted at rest using AES-256 or equivalent on all devices, drives, and cloud storage containing taxpayer data
- Data encrypted in transit using TLS 1.2 or higher for email, file transfers, remote sessions, and API connections
- Patch management policy documented and current — who patches, on what schedule, and how exceptions are tracked
- Endpoint protection installed and active on all devices that access client data, including personally owned devices if used for work
- Remote access requires VPN or equivalent secure connection; no direct RDP or unsecured remote access to firm systems
Staff training & acknowledgement
- Annual security awareness training documented with curriculum, date, delivery method, and topics covered
- Training attendance records on file for every employee and contractor with access to client data
- Staff have signed WISP acknowledgement this year, confirming they have read the plan and understand their responsibilities
- Onboarding security training documented for any new staff before they are granted access to client data
Incident response readiness
- Written incident response plan exists and is current, with defined severity levels and escalation paths
- IRS Stakeholder Liaison contact info documented for your state or territory, with a backup contact
- State breach notification timeline documented — know your state's trigger, deadline, and required recipient list
- Designated response lead named in writing, with clear authority to engage legal counsel, forensics, and insurance
- Post-incident review process defined, requiring the WISP to be updated within 30 days of any security event
After the checklist: what to do with your gaps
If you have gaps after running this checklist, you have three paths. First, fix them yourself using the IRS templates at irs.gov — free, but time-intensive and generic, and they do not tell you whether your specific controls are adequate. Second, use WISPWolf to identify, prioritize, and document remediation in a guided workflow that maps to your firm size, tax software, and IT setup. Third, engage an MSP or compliance attorney for complex gaps involving multi-office setups, inherited infrastructure, or prior security incidents. Most solo and small firms fall into the second path: the gaps are real, but the fix is procedural, not architectural. Start with the free compliance quiz to see your exact score and which category to tackle first.
Audit exposure warning
If you answered No to 3 or more items above, your firm has measurable audit exposure today. The FTC's enforcement posture in 2026 is active — "we planned to fix this" is not a defense in an investigation. Start with your highest-impact gaps first.
Score your firm's readiness in 5 minutes
The WISPWolf compliance quiz turns this checklist into a scored assessment. You will see exactly which categories are green, yellow, or red — and what to fix first. No email required to see your score.
Dig deeper into WISP compliance
IRS Publication 5708 Guide
The complete plain-English guide to creating a Written Information Security Plan aligned with IRS guidance.
Read guideAnnual WISP Review Checklist
Use this annual review checklist to keep your CPA firm audit-ready and insurer-friendly year-round.
Read guideIncident Response Plan Template
An eight-section incident response plan template aligned with the FTC Safeguards Rule and IRS Pub 5708.
Read guideWISP audit questions, answered
- IRS Publication 4557, Safeguarding Taxpayer Data
- IRS Publication 5708, Creating a Written Information Security Plan
- FTC Safeguards Rule 16 CFR Part 314
- IRS Security Summit guidance and model WISP template
- Verizon Data Breach Investigations Report 2024