Renewed Your PTIN? Don’t Overlook Security Training.
Small tax and accounting firms are required to train staff on security. Here’s what the FTC Safeguards Rule asks for, and how to cover it with a small investment.
FOR TAX & ACCOUNTING FIRMS
If you renewed your PTIN (Preparer Tax Identification Number) this year, you checked a box you may not have thought much about. Line 11 of Form W-12 asks you to confirm you’re aware that paid tax return preparers “are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information.”
For a lot of small firms, that box is the first time the requirement feels real. The plan itself, your WISP (Written Information Security Plan), has several parts. This post is about one that small offices often leave undocumented: training the people who handle client data.
Why a six-person firm is treated like a bank
Under the Gramm-Leach-Bliley Act, tax and accounting professionals count as financial institutions. That puts you under the FTC’s Safeguards Rule, the same rule that covers lenders and other businesses that handle sensitive financial information. The IRS has been reminding tax pros about this for years. It even publishes a free template built for smaller practices, Publication 5708, to help you write your plan, and Publication 4557, Safeguarding Taxpayer Data, covers the security basics.
Think about what sits in your files: Social Security numbers for whole families, bank and routing numbers for refunds, W-2s, years of income history. That’s exactly what identity thieves need to file fake returns. Small firms aren’t too small to be targeted. They’re often the easier target.
The small-firm break, and what it doesn’t cover
The Safeguards Rule does give small firms some relief. If you hold customer information on fewer than 5,000 consumers, four requirements drop away: the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan, and the annual written report to your board or owner.
Security awareness training is not on that list. Section 314.4(e) of the rule requires you to give all of your personnel security awareness training, updated as needed to reflect the risks you’ve identified. That applies whether you have forty people or four, and it includes the seasonal help you bring on in February.
What “trained” looks like when someone asks
The rule doesn’t hand you a curriculum or a schedule. In the simplist of terms, a small firm should be able to show three things:
• Everyone was trained. That means everyone who touches client data, including the owners and seasonal staff.
• The training fit the risks. Emails pretending to be a client or the IRS, requests to change where a refund or payment goes, weak or reused passwords, a lost laptop or phone, and how to report something that looks wrong.
• There’s a record. Who completed what, and when.
That last one is where most small offices come up short. A conversation at the January staff meeting might be good training, but it leaves nothing behind. If a client, your insurer or a regulator asks, “we talked about it” is hard to prove. And the stakes when something goes wrong are real: the Safeguards Rule now requires firms to notify the FTC within 30 days of discovering certain security events that affect 500 or more people.
Do it before filing season, not during
Training is easiest to fit in before the season starts. By mid-February nobody has time to sit down for anything, and the people trying to get at your client data know exactly when you’re busiest. A short session in the next few weeks means your whole team, seasonal staff included, starts the season knowing what to watch for, and you have the record filed with your WISP before the first return goes out.
Where ClickCerts fits
ClickCerts was built for exactly this. Your team takes short security awareness training online, followed by a quiz. Everyone who passes earns a certificate, and you get a report showing every name, status and completion date. A new course comes out each quarter, so training stays current through the year instead of being a one-time event.
From 1 to 1,000 (or more users) ClickCerts is also priced for small offices. Plans start at $18 per person per year, so a six-person firm covers its whole team for $108 a year. You can sign up online and have your team invited the same afternoon, with no sales call and no IT department required.
To be clear about what it is: ClickCerts covers the training piece of your WISP and gives you the record to keep with it. It isn’t the whole plan, and you’ll still want to work through Publication 5708 for the rest. But it’s one requirement you can check off this week.
Ready to get your team trained before the season starts? Sign up at clickcerts.com.
This post is general information, not legal advice. For questions about your firm’s specific obligations, talk with your attorney or compliance advisor. For more information please see FTC Safeguards Rule: What Your Business Needs to Know.
