A WISP for CPAs is no longer optional, and AI can help accounting firms meet WISP regulatory requirements by speeding up the process of identifying risks, drafting security policies, creating staff training materials, building incident response plans, and keeping the program updated. AI should not replace professional judgment, legal guidance, or cybersecurity expertise, but it can give CPA firms a strong starting point for documenting how they protect taxpayer and client data.
Between IRS Publication 4557, the FTC Safeguards Rule, state privacy expectations, and the daily pressure of serving clients, creating a Written Information Security Program (WISP) can feel like one more compliance project sitting at the bottom of the list. A WISP does not have to be overwhelming. With the right prompts, a review process, and security oversight, AI can help create a WISP for CPAs by moving from a blank page to a practical, customized security program.
Why CPA Firms Need a WISP
CPA firms handle some of the most sensitive information a person or business owns. This includes tax returns, Social Security numbers, payroll records, banking details, financial statements, ownership documents, and personal identifying information.
That makes accounting firms attractive targets for cybercriminals. It also means regulators expect tax professionals to take data protection seriously.
IRS Publication 4557 states that protecting taxpayer data is the law and explains that tax return preparers must create and enact security plans to protect client data under the FTC Safeguards Rule. It also warns that failure to do so may result in an FTC investigation.
The FTC Safeguards Rule applies to financial institutions under FTC jurisdiction, and the rule specifically includes tax preparation firms as covered financial institutions. It requires reasonable administrative, technical, and physical safeguards to protect customer information.
What Should a WISP For CPAs Include?
A WISP is a documented plan that explains how your firm protects client information. It should reflect how your firm works, not a generic template downloaded and forgotten.
At a minimum, the WISP for CPAs should address:
• Risk assessment
• Access controls
• Multi-factor authentication
• Encryption
• Data backups
• Vendor management
• Employee training
• Incident response
• Physical security
• Device and software inventory
• Data retention and disposal
• Annual review and updates
IRS Publication 4557 also recommends steps such as creating a data security plan, using anti-malware tools, enabling multi-factor authentication, encrypting sensitive files, backing up data, limiting access to taxpayer data, and implementing audit trails. AI can help organize these areas into a working document, but your firm still needs to validate the details.
How AI Can Help Create A WISP For CPAs
AI is useful because it removes the “blank page” problem. Many firms delay creating or updating a WISP for CPAs because they do not know how to structure the document or what language to use.
AI can help with the first draft. Your team and advisors should handle the final version. Here are practical ways CPA firms can use AI.
1. Use AI to Build a Risk Assessment Template
Every WISP starts with understanding risk. A CPA firm should know what sensitive data it collects, where that data is stored, who has access to it, what systems process it, and what could go wrong.
You can use AI to create a first-draft risk assessment table. For example, you could prompt: “Create a risk assessment template for a 15-person CPA firm that handles tax returns, payroll data, QuickBooks files, Social Security numbers, and client financial statements. Include risk category, possible threat, likelihood, impact, current safeguard, and recommended improvement.”
AI may return a useful table covering phishing, unauthorized access, weak passwords, vendor risk, unpatched software, lost laptops, and ransomware.
That is not the final assessment. It is the starting point. Your firm still needs to confirm what systems you use, how employees access data, and which risks are most relevant.
2. Use AI to Draft Security Policies
A strong WISP for CPAs includes clear policies. These policies explain the rules employees must follow when handling client data. AI can help draft policies for:
• Acceptable technology use
• Password management
• Remote work
• Email security
• Vendor access
• Data retention
• Clean desk expectations
• Mobile device use
• Incident reporting
• Client file sharing
For example, you could ask: “Write a plain-English remote work security policy for a CPA firm that uses Microsoft 365, cloud tax software, and secure client portals. Include requirements for MFA, approved devices, VPN use, public Wi-Fi, and client data storage.”
This gives you a working draft. Then, your leadership team, IT provider and legal counsel can review it to make sure it fits your operations.
3. Use AI to Translate Regulations into Action Items
Regulatory language can be hard to turn into day-to-day tasks. AI can help summarize IRS Publication 4557 or the FTC Safeguards Rule into a checklist your firm can use. For example: “Summarize the FTC Safeguards Rule requirements for a small CPA firm and turn them into a practical checklist.”
That type of prompt can help your firm identify action items such as assigning a qualified individual, assessing risks, implementing safeguards, training employees, monitoring systems, and updating the plan regularly.
The key is to verify the summary against authoritative sources. AI can misstate, oversimplify, or miss important details. Treat it like a research assistant, not the final authority.
4. Use AI to Create Employee Training Materials
Technology is important, but people are often the first line of defense. IRS Publication 4557 emphasizes that every employee, including administrative staff, should be educated about security threats and safeguards.
AI can help create short, practical training content for your team, including:
• Phishing examples
• Monthly security reminders
• Short quizzes
• Scenario-based exercises
• Email do’s and don’ts
• Client portal reminders
• Tax season security tips
For example: “Create a 10-question phishing awareness quiz for employees at a CPA firm. Include realistic examples involving tax software, IRS notices, client document requests, and payroll changes.”
This helps keep security visible without creating a heavy training burden.
5. Use AI to Draft an Incident Response Plan
A WISP for CPAs should not only explain how your firm prevents problems. It should also explain what happens when something goes wrong. A data incident response plan should identify:
• Who leads the response
• Who contacts IT support
• Who contacts legal counsel
• How the firm contains the issue
• How systems are preserved for investigation
• When clients may need to be notified
• How the firm documents the incident
• How recovery is handled
AI can create a first draft of an incident response plan, including roles, timelines, and escalation steps. Then your firm should customize it with real names, phone numbers, vendors, insurance contacts and legal resources.
This is especially important because during an incident, your team will not have time to figure things out from scratch.
6. Use AI to Keep the WISP Updated
A WISP for CPAs is not a one-time document. It should be reviewed regularly. Your firm should revisit it when:
• You add new software
• You change tax platforms
• You hire remote employees
• You change IT providers
• You add a new office
• You experience a security incident
• Regulations change
• Your client data workflows change
AI can help you compare your current WISP against a checklist and identify areas that may need review. It can also help summarize meeting notes from your annual WISP review.
For example: “Review this WISP outline and identify what may be missing for a CPA firm with remote employees, cloud tax software, Microsoft 365 and outsourced payroll clients.”
Again, AI can help organize the review, but leadership still owns the final decisions.
What AI Should Not Do
AI can make WISP planning faster, but it should not be given unrestricted access to sensitive firm or client data.
Do not paste client tax returns, Social Security numbers, payroll files, bank data, passwords, or confidential client information into a public AI tool. Before using AI for compliance work, your firm should decide:
• Which AI tools are approved
• What data can and cannot be entered
• Who is allowed to use AI
• Whether AI outputs must be reviewed
• Where AI-generated drafts are stored
• How prompts and outputs are documented
A secure AI policy should be part of your broader WISP planning.
A Simple AI Prompt Framework for CPA Firms
To get better AI results, be specific. A vague prompt creates vague output. Use this structure:
• Role: Tell AI what role to play.
• Context: Explain your firm size, services and systems.
• Task: State exactly what you want.
• Format: Ask for a table, checklist, policy or outline.
• Review: Ask it to identify gaps or assumptions.
Example: “Act as a cybersecurity advisor helping a 20-person CPA firm create a Written Information Security Program. The firm uses Microsoft 365, cloud-based tax software, QuickBooks Online, a secure client portal, and remote employees during tax season. Create a WISP outline with sections for risk assessment, access control, employee training, vendor management, incident response, data backup and annual review. Format it as a practical checklist.”
That type of prompt gives your firm something useful to review and refine.
Turning WISP Compliance into a Trust Builder
Many CPA firms think about compliance as a defensive task. They create a document because a regulator, insurance provider, or professional association expects it. But a thoughtful security program can also build client confidence.
Clients trust CPA firms with deeply personal information. When your firm can explain how it protects that information, you strengthen the relationship.
A well-built WISP for CPAs can help your firm show that security is not an afterthought. It is part of how you serve clients.
How Ma'atIT Helps CPA Firms with WISP Planning
At Ma’atIT, we help accounting firms turn security requirements into practical technology programs. That means helping firms understand their risks, strengthen safeguards, document policies and support employees with the tools and training they need.
Our approach is built around three priorities:
• Secure: Protect client data with layered cybersecurity controls, monitoring, and best practices.
• Optimize: Use tools, including AI, to make compliance more efficient and repeatable.
• Support: Help your team understand what to do, why it matters, and how to keep security part of daily operations.
AI can help accounting firms move faster, but the strongest results come when AI-generated drafts are reviewed by people who understand cybersecurity, compliance, and the way accounting firms work.
Start with The First Draft
Creating a WISP does not have to begin with a 50-page document. It can start with a risk assessment, a policy outline, an incident response checklist, or a staff training plan. The important thing is to start.
Use AI to create the first draft. Review it with experts. Customize it to your firm. Update it every year.
A strong WISP for CPAs helps protect your clients, your reputation, and your firm’s future. With the right guidance, it can become more than a compliance document. It can become a practical roadmap for running a safer, smarter accounting firm.
Contact Ma’atIT for a free consultation to review your current security program, identify compliance gaps, and learn how AI and the right technology strategy can help protect your clients, your firm, and your reputation.
Fady Salama, President
Fady Salama is the Founder and CEO of Ma’atIT, where he helps businesses align technology with profitability and growth. With a strategic, numbers-driven approach, Fady works as a fractional CIO for his clients, going beyond IT support to build smarter roadmaps, reduce waste, and drive measurable business results.