Consider a firm that signed its WISP in March, filed the renewal, and has not opened the document since. Two preparers have left, one has joined, the firm has switched portals, and it now feeds client documents into a cloud bookkeeping platform that did not exist in the file a year ago. The WISP, meanwhile, still describes a four-person office, a local server, and a vendor that the firm dropped in June. The document is current in the sense that it exists; it is not current in the sense that it describes anything.
The FTC Safeguards Rule requires tax preparers to maintain a WISP, and the IRS asks for one at PTIN renewal. Neither agency specifies that the program must reflect reality, but a program that describes a firm that no longer exists will not survive a close reading, and the gap between the paper and the practice is precisely what an examiner or a plaintiff’s attorney will find first.
An annual review, done properly, is not a ritual re-reading. It is a working audit of what has actually moved: staff, systems, vendors, and the threats that target them. Each of those changes the program hastily, and each deserves its own line of inquiry.
The problem: a WISP that sits still while the firm does not
The FTC Safeguards Rule does not ask a firm to write a security program once and file it away. It asks the firm to maintain one — to keep it current with the business it actually conducts. That verb, maintain, does the quiet work in the regulation. A program that described the firm accurately in January may misdescribe it by October, and the gap between the two is not a technicality. It is the difference between a document that demonstrates compliance and one that undermines it.
The IRS adds its own prompt. The PTIN renewal asks whether the preparer has a written information security plan in place, which means the question arrives on a schedule whether or not the document has kept pace with the year. A firm can answer yes and still be holding a paper relic.
The drift happens in ordinary ways. Consider a firm that adopts a new client portal in March, hires a seasonal preparer in January, and moves its document storage to a different cloud provider over the summer. Each change is reasonable. None of them is dramatic. But the WISP still names the old portal, the old headcount, and the old storage arrangement, and no one has revised the section on access controls to reflect who can now reach client data and from where. The document describes a firm that no longer exists.
This is the risk that annual review exists to catch. A WISP that describes last year’s practice is evidence against the firm, not for it. An FTC examiner, an IRS inquiry, or a state board asking questions will read the document against the firm’s actual operations, and the discrepancies will read as neglect rather than oversight. The same holds for a template pulled from Tech 4 Accountants, Rush Tech Support, or an IRS Publication 4557 starting point: any of these can serve as a foundation, but none of them updates itself.
The review is the mechanism that keeps the document honest.
What the Safeguards Rule actually asks you to revisit
The Safeguards Rule does not tell you to dust off your Written Information Security Program every January and read it aloud. It asks for something more demanding: a periodic reassessment of risk, an adjustment of safeguards in light of testing results and operational changes, and ongoing oversight of the service providers who touch client data. None of this arrives with a calendar date attached. The rule expects your program to reflect current reality, not the reality of the year you wrote it.
Consider a firm that added three staff members, moved its tax software to a hosted platform, and engaged a new e-signature vendor. Each change alters the risk picture. The rule’s maintenance provisions exist for precisely this reason: safeguards that fit last year’s operations may leave this year’s gaps wide open.
IRS Publication 4557 and Publication 5708 give tax professionals a workable framework for the same exercise. They translate the rule’s abstractions into questions a practitioner can answer: what data do you hold, where does it go, who can reach it, and how would you know if something went wrong.
A WISP template from any source—Tech 4 Accountants, Rush Tech Support, NATP, AICPA—still requires the firm to fill in its own specifics. Those specifics are the parts that go stale. Your vendor list, your access controls, your incident response contacts: all of it drifts the moment operations change. The template cannot track that drift. Only the person who runs the firm can.
What changes each year: the six things to check
Start with personnel. Who joined, who left, and whose access changed mid-year? Consider a firm that added a bookkeeper in March and never updated its access-provisioning section; the document still describes a two-person operation, and the newest hire can read everything the principal can. Offboarding matters as much: a departed employee’s active credentials are a finding waiting to happen.
Next, systems and software. New tax prep platforms, client portals, mobile devices, and migrations from a local server to cloud hosting each alter the security picture. A WISP written for desktop software does not describe a firm that moved its files to the cloud in July. If the document names products the firm no longer runs, revise it.
Third, vendors and service providers. The FTC Safeguards Rule requires oversight of third parties that touch client data. List who receives it now — payroll processors, cloud hosts, document-shredding services — and confirm contracts and due diligence are current. A template from Tech 4 Accountants or Rush Tech Support, or one drawn from IRS Publication 4557, will prompt this review; it will not perform it.
Fourth, the threat picture. New phishing methods, fresh IRS scam alerts, and disclosed vulnerabilities in software the firm already runs all belong in the risk assessment. A WISP that names last year’s scam is a historical document.
Fifth, physical and access controls. An office move, a new remote-work arrangement, or laptops purchased without verified encryption each change what the WISP must say.
Sixth, incident history and near-misses. If the firm weathered a phishing attempt or a misdirected email, the response section should reflect what the firm learned, not what it once assumed it would do.
How EEZY WISP handles the annual review
EEZY WISP is a written information security program — the security policy document a business is required to keep, written and maintained. The document is maintained. That is the point of an annual review, and it is built into the product rather than left to the firm’s memory. EEZY WISP is written for tax preparers subject to the FTC Safeguards Rule and the IRS requirement to have a WISP on the PTIN renewal.
The annual review is the working audit described above: staff, systems, vendors, and threats, each in turn, each checked against what the document says. When something has changed — a new preparer, a new piece of software, a vendor that no longer holds client data — the document is updated to reflect it. The review is not a ritual re-reading. It is the act of keeping the program current, and EEZY WISP is maintained so that the act is possible.
A firm that prefers to do this work itself has other routes. The IRS publishes templates in Publications 4557 and 5708. NATP and AICPA offer their own. Tech 4 Accountants and Rush Tech Support sell WISP templates, and an MSP can write a policy from scratch. Each is a legitimate way to produce the document. The difference is what happens after. A template is a starting point; a policy written by an MSP is a snapshot. EEZY WISP is maintained, which means the annual review is not the moment a firm discovers its program no longer describes its practice. The document is already being kept current. Pricing is on the site.
What the review costs in time and money
Pricing for EEZY WISP is on the site at eezywisp.com. The annual review itself carries no separate fee. The real cost is the hours a principal or office manager spends on the six checks above — typically a few focused hours for a small firm, more if vendors or systems changed substantially. That time is the price of keeping the document honest, and it is not optional under the Safeguards Rule, which expects the program to reflect current circumstances rather than the circumstances of some earlier year.
Compare the alternatives on their own terms. A template from Tech 4 Accountants or Rush Tech Support carries its own price — check the vendor, since none is stated here — and the review burden lands on the same principal regardless of which document the firm bought. An MSP-written policy arrives through a consulting engagement, which may suit a firm that wants someone else to do the thinking, though the engagement does not end the firm’s obligation to review what was written. The IRS 4557 and 5708 templates are free and demand the most self-assembly; a firm using them should budget the largest share of review time, because the document will not have been shaped to the firm’s particular systems and vendors in the first place.
The annual review, then, is not a recurring fee but the discipline that makes whatever document the firm owns worth having. A WISP that has not been read against the current staff roster, the current software stack, and the current vendor list is a historical record, not a program. The hours spent on the review are the difference between the two.
Getting started: the first review, week by week
Three weeks is enough. A firm that spreads the work across three weeks will finish; a firm that schedules a single afternoon will not.
Week one: read the WISP against reality. Take the current document and the firm’s actual practice, side by side. Mark every sentence that no longer matches what happens — a named employee who has left, a software tool no longer in use, a safeguard the firm describes but does not perform. Consider a firm that wrote its WISP three years ago and has since moved its client portal; the document still describes the old portal. That sentence is not a technicality. It is a misstatement about the firm’s own security, and an examiner will notice.
Week two: gather the facts. Work through the six checks from the section above and collect the raw material: the current staff roster, the vendor list, the software inventory, and any notes on incidents or near-incidents from the past year. Do not revise anything yet. The task this week is to know what is true.
Week three: revise, assign, and schedule. Rewrite the passages that no longer hold. Give each safeguard a named owner — one person, not a department. Then set the next review date, twelve months out, and put it on the calendar before the week ends. A review date that lives only in the WISP is a wish.
Firms using EEZY WISP work from the maintained document they already hold, so week one starts from a current text rather than an archaeological dig. Firms working from a template supplied by NATP, the AICPA, or an MSP should confirm that the template carries a review schedule; if it does not, add one. A WISP without a review date is a letter that never gets mailed.
Where the WISP sits in the rest of the stack
A WISP does not live in a drawer. It touches nearly everything else the firm operates. The IRS asks whether the firm maintains a written security program as part of the PTIN renewal; the answer should describe the actual program, not the one from two hires ago. Client engagement letters increasingly carry security representations — how data is stored, who can reach it, what happens when something goes wrong — and those representations should match the WISP’s text. Cyber insurance questionnaires probe the same ground: multifactor authentication, encryption, vendor oversight. If the WISP promises controls the firm has not implemented, the questionnaire becomes a liability rather than a formality. Portal and practice-management software deserve the same scrutiny. The WISP describes the security settings of these systems; when the software updates, or the firm switches providers, the document must follow. A firm that moved from one document portal to another last March but never revised its WISP is describing a firm that no longer exists.
Keeping the document current is easier when the document itself is easy to reach. EEZY WISP is part of the EEZYVERSE family, so a firm that uses other EEZY products signs in once and sees one central bill at eezycloud.com/account/. Support hours run Monday through Friday 9 AM to 8 PM and Saturday through Sunday 9 AM to 12 PM Eastern, published at eezycloud.com/support.
None of this requires a consultant or a weekend. It requires reading the document against the firm as it stands — the staff roster, the software stack, the insurance forms, the engagement letters — and correcting what no longer holds. An annual review, done honestly, is the difference between a document a firm has and a program a firm runs.
Frequently Asked Questions
What should I review in my WISP each year?
Review your risk assessment, vendor list, access controls, incident response plan, employee training records, and any business changes such as new software, staff, or client data types. The FTC Safeguards Rule expects your Written Information Security Program to reflect current operations, not last year's.
Does the IRS require me to update my WISP annually?
The IRS requires tax preparers to maintain a Written Information Security Program as part of PTIN renewal. While the IRS does not mandate an annual update by a specific date, an outdated WISP that no longer matches your practice invites trouble during an FTC examination.
What triggers a WISP update besides the annual review?
New software, a data breach, a change in staff with access to client data, a new office location, or revised FTC guidance all warrant immediate review. Consider a firm that adds cloud payroll processing mid-year; that vendor belongs in the WISP's third-party service provider section without waiting for December.
Can I update my EEZY WISP myself, or do I need a consultant?
EEZY WISP is written and maintained as a document you can update yourself. The language is plain enough that most firm owners can revise sections without hiring outside help. If your situation grows complex, a security consultant remains an option, not a requirement.
Where do I find the current version of my EEZY WISP?
Log in through the EEZYVERSE portal with your single account credentials. Your current WISP and any prior versions are stored there, and your subscription appears on the central bill at eezycloud.com/account/. Support operates Monday through Friday 9 AM to 8 PM and weekends 9 AM to 12 PM Eastern.
If your WISP has not kept pace with the past year, EEZY WISP is worth a look: a written, maintained security program built for tax and accounting practices. Pricing is on the site.
EEZY WISP is part of the EEZYVERSE family: one login, one bill, every EEZY product.