Document Collection and WISP

This Self-Study course is designed for Tax Professionals, including tax return preparers, Annual Filing Season Program (AFSP) participants, Enrolled Agents (EAs), Certified Public Accountants (CPAs), accountants, and other professionals who collect, store, process, or transmit confidential taxpayer information.

This course does not include video lessons. Training is completed through independent study of the course materials followed by a final exam.

After reviewing the course materials and successfully passing the final exam, participants receive IRS CE/CTEC credit in their account.

The course focuses on Written Information Security Plans (WISP), secure document collection, and the protection of confidential taxpayer information in tax practice. You will learn why information security begins at the moment client documents are collected, what information is considered confidential, what risks arise during the document collection process, and what responsibilities Tax Professionals have when handling sensitive client data.

You will review the documents commonly collected from individual and business clients and learn how different methods of receiving information affect data security. The course examines the use of secure client portals such as TaxDome, email, paper documents, messaging applications, and SMS, with particular attention to the risks associated with each method.

Special attention is given to Consent to Use and Consent to Disclose, including the difference between these two types of consent and their connection to a tax practice’s information security procedures.

The course provides a detailed overview of the Written Information Security Plan (WISP), including why maintaining a WISP is a legal requirement rather than simply a recommended best practice, who is subject to the requirement, and how compliance may be evaluated during a review or audit. You will learn what reviewers typically look for, which issues may be considered Red Flags, and what potential consequences may arise when a tax practice does not have a WISP or maintains an outdated or ineffective plan.

You will also learn the key elements of a properly structured WISP, including its purpose, scope, equipment inventory, data retention and disposal policies, formal implementation procedures, training documentation, breach notification considerations, and supporting appendices. The course explains the difference between having a WISP merely as a document and maintaining an operational WISP that reflects the actual procedures used in a tax practice. Practical examples and WISP templates are included to help you understand how information security requirements can be translated into real-world procedures for both tax firms and solo practitioners.

Practical examples and WISP templates are included to help you understand how information security requirements can be translated into real-world procedures for both tax firms and solo practitioners.

The course also covers data breaches, including what may constitute a breach, common types of security incidents in tax practice, and why breaches involving taxpayer information can be particularly serious. Finally, the course addresses the protection of client information during international travel, including cloud-based data, preparation before traveling with devices, what to consider if a device is searched, and confidentiality considerations for EAs and CPAs.