PTIN Renewal and WISP Requirements for Tax Preparers

Summarize and analyze this article with:

ChatGPT Perplexity Grok Google AI Claude

Paid tax preparers must create and maintain a written information security plan (WISP). PTIN renewal includes an acknowledgment that you are aware of that duty. The acknowledgment does not certify that your firm’s security plan is complete or that its safeguards are working.

That distinction matters when you renew your Preparer Tax Identification Number (PTIN). Completing the renewal and maintaining a WISP are separate responsibilities. Use the renewal cycle as a reminder to check the plan your practice actually follows.

Key takeaways

Form W-12, Line 11 asks about awareness of the written information security plan requirement.

A renewed PTIN is not proof that your firm’s data security program meets its obligations.

A small or solo tax practice still needs a plan suited to its work and risks.

Review the WISP regularly and when staff, systems, vendors or workflows change.

What does Form W-12 ask about a WISP?

Line 11 of Form W-12 asks whether you are aware that paid tax return preparers must create and maintain a written information security plan to protect taxpayer information.

The paper form provides Yes/No boxes. The Form W-12 instructions describe this as an acknowledgment of awareness. It is not a question asking you to certify that every safeguard has been implemented, and Line 11 does not require you to attach your WISP.

Read the current Form W-12 and its instructions when completing your application. Answer accurately, and treat the security plan itself as work your practice must carry out beyond the renewal form.

What are the IRS WISP requirements for tax preparers?

A WISP explains how your practice protects the client information it collects, stores, uses and shares. It should describe responsibilities and safeguards that fit your operations. For a broader explanation, see our guide to what a WISP is.

IRS Publication 4557 connects tax preparers’ data protection responsibilities to the FTC Safeguards Rule. Its guidance covers assigning responsibility, assessing risks, implementing and testing safeguards, overseeing service providers and training staff.

For example, a policy that says staff use secure file sharing should identify the approved way to exchange client documents. If employees still send tax records through an unapproved channel, revising the wording alone will not fix the gap. The written procedure and the day-to-day workflow need to agree.

For a closer look at the IRS guidance, read our Publication 4557 guide for tax firms.

Does a solo preparer or small tax firm need a WISP?

Yes. IRS Publication 5708 explains that size does not remove the written plan requirement, although a sole practitioner’s plan can be simpler than a large firm’s. The plan should reflect the practice’s activities and the sensitivity of its client data.

The FTC provides limited exemptions from certain Safeguards Rule provisions for institutions maintaining customer information on fewer than 5,000 consumers. That is not a blanket exemption from maintaining a written information security program. Check which provisions apply to your practice using the FTC’s Safeguards Rule guidance.

Security coordinator evaluating firm safeguards cinematic visual | Verito

A useful small-firm plan is specific enough that someone can follow it. Naming the person responsible for access changes is more helpful than saying “access is managed.” Listing the approved client portal is more helpful than saying “files are exchanged securely.”

What should you review before renewing your PTIN?

Use the following checklist to organize a practical review. It is a starting point for checking your current WISP, rather than a complete list of every requirement that may apply to your firm.

Responsible person: Confirm who maintains the plan and who handles security questions when that person is unavailable.
Client data and systems: Compare the plan with the devices, tax software, email, portals and storage your practice uses now.
Access: Check current staff and contractor accounts, remove access that is no longer needed, and confirm how multifactor authentication is used.
File handling and recovery: Check secure document exchange, retention procedures and backups. Record who checks that a backup can be restored.
Service providers: Review which vendors handle client information and where responsibilities for protecting it are documented.
Staff readiness: Confirm that employees know the approved workflows and how to report a suspicious message or possible data exposure.
Incident contacts: Check that your response procedure names the people to contact. Publication 4557 directs preparers to report client data theft to their IRS Stakeholder Liaison.
Review record: Record what you checked, unresolved gaps, the person responsible for each action and the next review.

For example, adding a seasonal preparer should trigger more than adding a name to the WISP. Check their account permissions, explain the approved client-document workflow and assign responsibility for removing access when their engagement ends.

When should you update the security plan?

Review it regularly and after meaningful operational changes. The sample plan in Publication 5708 includes an annual review, while the FTC’s guidance calls for adjusting the program as risks, operations and testing results change.

PTIN renewal is a useful reminder, but it should not become the only review point. Moving to a new client portal, changing an IT provider or opening a second office can create a reason to review the plan sooner.

Keep a short change record beside the current version. State what changed, why it changed and who needs to follow the revised procedure. This makes the document easier to maintain and use for staff training.

What if you do not have a WISP?

Start by identifying who will coordinate the work, what client information you handle and where it resides. Use Publication 5708 as a starting resource, then adapt the plan to your practice and put its procedures into use. Verito’s WISP guide and template resource can also help you organize the work.

Do not treat PTIN renewal as confirmation that this work has been completed. Form W-12 separately warns that false or misleading information can lead to penalties or denial or termination of a PTIN. That warning is not the same as a statement that a missing WISP automatically revokes a PTIN.

Annual written security plan review cinematic visual | Verito

How Verito helps with your WISP

Verito’s VeritShield WISP service provides a custom written plan based on your firm’s size, technology and workflow. A scoping call with a Verito engineer helps document those details, and the service includes revisions as your practice changes.

If your current plan no longer reflects how your firm operates, explore VeritShield WISP to see how Verito can help with the documentation. Your practice still needs to implement and maintain the safeguards described in its plan.