How Does an FTC Investigation Start?
FTC investigations of tax preparers typically begin in one of three ways:
- A data breach — client data is stolen and the breach is reported to the IRS or FTC
- A client complaint — a client files a complaint about how their data was handled
- Proactive enforcement — the FTC periodically investigates industries with known compliance gaps
⚠️ You don't have to have a breach to be investigated. The FTC can investigate simply to verify compliance with the Safeguards Rule.
What Does an Investigator Ask For?
If the FTC investigates your firm, the first thing they ask for is documentation. Specifically:
- Your Written Information Security Plan
- Evidence of your annual risk assessment
- Records of employee security training
- Documentation of your MFA and encryption implementation
- Vendor contracts with security provisions
- Your incident response plan
If you don't have a WISP, you immediately have no documentation to provide. That's not just a compliance failure — it signals to investigators that you haven't been taking data security seriously at all.
What Are the Penalties?
The FTC can impose civil penalties of $50,120 per violation. Here's the critical part: each missing safeguard is a separate violation. That means:
- No WISP = 1 violation
- No MFA = another violation
- No employee training = another violation
- No encryption = another violation
- No vendor contracts = another violation
Five violations at $50,120 each = $250,600. For a small tax preparation firm, that's potentially business-ending.
💡 Having a WISP doesn't guarantee you won't be investigated — but it gives you documentation that shows good faith compliance. That makes an enormous difference in how an investigation proceeds.
What About the IRS?
Separately from the FTC, a data breach involving taxpayer data triggers IRS reporting requirements. You must contact your IRS Stakeholder Liaison and may be required to notify affected clients. The IRS can also refer cases to the Department of Justice for criminal prosecution in severe cases.
What Happens to Your PTIN?
If an investigation reveals you falsely certified WISP compliance on Form W-12 Line 11, your PTIN can be revoked. Without a PTIN you cannot legally prepare tax returns. For most preparers, that's the end of the business.
The Cost of a WISP vs. the Cost of Non-Compliance
A custom WISP costs $497. The average data breach costs $4.88 million according to IBM's 2024 Cost of a Data Breach Report. Even a modest FTC enforcement action could cost tens of thousands of dollars in fines alone — before attorney fees.
The math is straightforward.
Need Help Organizing Your WISP Documentation?
- Guided questionnaire included
- Customized WISP document
- Word & PDF versions
- Loom video walkthrough
- Delivered in 48 hours
SafeguardsReady is not a law firm and does not provide legal advice. Documents are prepared based on publicly available FTC and IRS guidance. Consult a licensed attorney for advice specific to your compliance obligations.