What Should a Tax Firm Ask an IT Provider? (Line 11)
Renewal season starts in October and every PTIN expires on 31 December. Somewhere in that process is Line 11, and it is the reason a lot of accountants end up talking to an IT company for the first time.
What should a tax or accounting firm ask an IT provider?
Start with the one that has a deadline attached: can you show me, in writing, that the safeguards my written security plan commits to are actually in place? Then ask what is excluded from the fee, how backups are tested, who owns your data, and what happens when a preparer leaves mid-season.
Why this is different from hiring IT for any other business
Form W-12 is signed under penalty of perjury, and Line 11 asks you to confirm you know that paid preparers are required by law to keep a written information security plan. The FTC Safeguards Rule applies to tax preparers as financial institutions, which surprises people every year. The exposure is real and specific: the IRS can suspend or revoke a PTIN, which is the licence to earn; FTC civil penalties run to $51,744 per violation per day; §7216 carries $1,000 per violation plus criminal exposure; and at 500 or more clients affected, breach notification to the FTC is due within 30 days.
So the conversation is not really about IT. It is about whether the plan the law requires actually exists and matches what is in place.
The written plan is free. Do not buy it.
The IRS publishes the template as Publication 5708. TaxDome, Protection Plus and several state CPA societies give away customised versions. If someone quotes you a fee to write your WISP, be wary — you are buying a free document. (Here is how to fill in the free template yourself, section by section, and the 12-point checklist of what has to be true behind it.)
What a template cannot do is put the safeguards in place. The plan commits you to multi-factor authentication, encryption, a named Qualified Individual, an incident response process, vendor oversight and an annual review. That is the work, and that is the honest thing to pay for.
The questions worth asking
Can you evidence the controls, not just install them?
The difference matters at renewal and it matters enormously if anything ever goes wrong. Ask whether you will be able to show that MFA was enforced on every account, that laptops were encrypted, and when the plan was last reviewed. Ask for it as a report you receive, not a screen someone shows you.
What happens to a seasonal preparer’s access in April?
Firms scale up for season and back down after. Every one of those departures is an access event, and seasonal staff are exactly the population most likely to have been set up quickly with a shared login. Ask how the provider handles it, and whether anyone reviews who still has access in May.
Where does client data actually live?
Between the tax software, the portal, the document management system, email and whatever is on the preparer’s laptop, most firms have more copies than they think. Ask the provider to map it. It is a reasonable first engagement and it is usually where the surprises are.
What is excluded from the monthly fee?
Same as every industry, and just as rarely volunteered. Get the list.
Do you understand that busy season has no maintenance window?
From late January to mid-April there is no good time to reboot a server. A provider who plans around that is worth more than one who is merely cheaper. Ask when they would do disruptive work, and whether they have supported a practice through a season before. (The pre-season job most firms skip: making QuickBooks Desktop fast again.)
A note on what actually gets exploited
Not the tax software (though it has its own requirements; see Drake vs Lacerte vs UltraTax CS vs ProSeries: the IT side). The account. Credential theft and business email compromise are what put preparer data on the street, and the mitigations are unglamorous: MFA everywhere with no partner exemption, encrypted laptops, someone watching for mailbox rules created quietly, and a tested restore. None of that is exotic and all of it belongs in the plan the law requires.
Where to start without paying anyone
There is a short self-check here that walks the Safeguards Rule requirements and tells you where you stand. It is free, it is not a lead form dressed as a tool, and if it tells you that you are in reasonable shape then that is a legitimate answer.
We are a small IT company in Haines City and we look after a few accounting practices around Polk and Osceola. Managed support runs $125 to $299 per user per month depending on how much compliance work sits on top. If it would help to have someone tell you honestly where your practice stands before October, we will do that for nothing — about twenty minutes, and you get a straight answer either way.
General information about a regulation, not legal or tax advice.
The same question, other industries
Each of these covers the questions that matter in that specific business, rather than the generic list.
