WISP for Tax Firms: Templates vs Software vs AI Agents

By Jude Lee · · Comparison

Two accountants reviewing a printed written information security plan beside laptops in a CPA firm office

Why the security-plan conversation comes back every autumn

PTIN renewal season puts data security back on the agenda for US preparers, and the IRS has consistently used that window to remind practitioners about their obligations. The two documents to actually read are IRS Publication 4557, Safeguarding Taxpayer Data and Publication 5708, the Security Summit’s WISP template built for small tax and accounting practices. Separately, the FTC Safeguards Rule (16 CFR Part 314, under Gramm-Leach-Bliley) treats tax preparers as financial institutions and sets out requirements including a designated qualified individual, a written risk assessment, access controls, encryption, multi-factor authentication and an incident response plan.

One detail that matters a great deal for solo and small practices: the Rule contains an exception at 16 CFR 314.6 relieving financial institutions that maintain information on fewer than 5,000 consumers from certain obligations — including the written risk assessment, the written incident response plan, and the annual report to the board or governing body. That is not a pass on the rest of the program, and the threshold and the exact list of relieved provisions are worth confirming against the current text on ftc.gov rather than against a blog post. Check irs.gov too; the Safeguards Rule has been amended more than once.

What has changed since most firms last touched their WISP is not the rule. It’s the stack. Somewhere in your firm, someone has probably pasted a trial balance into a chatbot, turned on an AI feature inside the ledger, or connected an AI assistant to QuickBooks Online. If your plan doesn’t name those flows, it no longer describes your firm.

1 named owner
The FTC Safeguards Rule expects a designated qualified individual to run the program
FTC Safeguards Rule, 16 CFR Part 314

Where AI assistants land inside a security plan

A WISP is, at bottom, an inventory plus a set of controls: what taxpayer data you hold, where it lives, who can reach it, how it’s protected, and what happens when something goes wrong. An AI assistant with access to your systems is simply another identity with permissions — and an MCP connection (the Model Context Protocol, an open standard for giving an AI governed access to tools and data) is the pipe it reaches through.

So the AI entries in your plan aren’t exotic. They look like this:

Template, managed vendor, or AI assistance

IRS Pub 5708 template
Free, written for firms your size, and recognizable to examiners and insurers. Costs you partner hours and goes stale the moment your stack changes. Best for solo and small firms with a simple, well-understood toolset — and the right starting skeleton for almost everyone else too. Understand its limits: it is a document template, not a risk assessment, not an asset inventory, and not an AI-tool policy. A firm above the small-entity threshold will not satisfy the Safeguards Rule by filling it in alone.
Managed security vendor or vCISO
You get a risk assessment, policy set, MFA/endpoint tooling and an incident plan maintained by people who do this daily. Real money, real onboarding. Worth it when you have staff turnover, multiple offices, SOC-type client demands, or you’ve already had a scare. Ask explicitly whether their policy library covers AI tools and API/MCP integrations — many were written before that was a question.

The third path is using an AI assistant to draft and maintain the document itself. Be honest about what that is: a strong first-draft generator and a good reconciler of plan-versus-reality. It is not a control, and it does not know your firm’s risk tolerance. Give an assistant your Pub 5708 skeleton, your asset list and your vendor agreements, and it will produce a coherent draft in an afternoon.

Then a human has to verify every factual claim in it, and the specific failure mode is worth naming so reviewers know what they’re hunting: language models confidently invent citations. Expect plausible-looking references to IRS publication numbers that don’t say what the draft claims, CFR subsections that don’t exist, control names borrowed from a framework you don’t follow, and deadlines stated with unearned precision. Check every citation against the primary source. A plan that overstates your controls is worse than no plan.

A security plan that describes controls you don’t actually run isn’t compliance. It’s a written admission.

Making the plan maintain itself with a monitoring agent

The higher-value agentic use isn’t drafting. It’s the quarterly review nobody does.

  1. Inventory before you automate

    List every system holding taxpayer data and every AI tool touching it. Spreadsheet is fine. This is the step firms skip.

  2. Expose read-only signals, not raw client data

    Connect an assistant to admin-level metadata — identity provider user lists, practice management roles, document-storage sharing settings — rather than to client files. Access reviews need permissions, not returns.

  3. Document the review agent as its own privileged identity

    The monitoring agent is not outside the scope of the plan — it holds admin-read credentials to your identity provider and sharing settings, which makes it one of the more sensitive accounts in the firm. Inventory the agent, its service credentials, its scope, its logging and its credential rotation schedule in the WISP alongside every other AI tool. Otherwise you have created exactly the undocumented flow this exercise exists to eliminate.

  4. Package the review as a skill

    Write the review procedure once as a reusable skill: pull the user list, compare to the current staff roster, flag accounts inactive 60+ days, flag external shares, flag any integration with write scope that isn’t in the approved list.

  5. Route exceptions to a named human

    The agent produces a findings memo with evidence links. The qualified individual decides and signs. No auto-revoking access during busy season.

  6. Version the plan alongside the findings

    Each review either confirms the WISP or triggers an edit. Keep both, dated.

If you’re weighing where client data can safely go in the first place, our breakdown of four setups for using client data with AI covers the tenant and residency questions that determine what you can even write into the plan. And if the connection itself is the project, the mechanics of connecting an AI assistant to QuickBooks or Xero via MCP are where least-privilege actually gets enforced.

What firms actually mean by automation in this context

Automation in accounting spans three different things that get lumped together: deterministic rules (bank rules, recurring journal entries, workflow triggers), robotic process automation that replays clicks, and AI agents that interpret unstructured inputs and carry out multi-step tasks. For security plan work, rules win more often than people expect — an automatic offboarding workflow that kills accounts when HR marks a departure is more reliable than any model. Reserve the agent for the parts that need judgment and synthesis: reading vendor DPAs, reconciling messy inventories, drafting narrative sections.

Whether AI replaces the accountant who signs off

No, and the Safeguards Rule is a clean illustration of why. The rule contemplates a person accountable for the program. Accountability doesn’t delegate to software. Our expectation — stated as opinion, not measurement — is that AI will keep compressing the preparation and monitoring layers of this work while concentrating value in review, judgment and sign-off, which is also the shape of what we think is happening to close work and return prep. The tasks most exposed are the ones that were pure document assembly.

Sizing the payoff without making up numbers

Don’t model this as hard savings. Model it as avoided drift plus recovered hours:

(hours spent annually on the plan, access reviews and evidence gathering) × (loaded hourly cost of whoever does it) = current cost. Estimate what share of those hours are assembly versus judgment — assembly is the automatable portion. Then set against it the cost of the tooling and the one-time build, and account for the recovered hours going back to billable or advisory work rather than evaporating. Plug in your own figures; a two-person practice and a 40-person firm will land in completely different places, and for the two-person practice the honest answer is often “use the IRS template and spend the money on MFA and backups instead.”

Not sure where to start?

Get a free automation audit: we map your bookkeeping, month-end close, client onboarding, document collection, and AP/AR — and show you what's worth automating before you spend a dollar.

Get a free automation audit

Related guides