Updates and guidance on key IRS practice developments.

• Author: Chambers, Valrie

Practice & Procedures

IRS spotlights requirement to have a written information security plan

Data security continues to be a hot topic for tax professionals--and the IRS. That is because tax practitioners and their clients continue to be frequent targets of data breaches. Although the IRS has implemented many successful tactics to fight tax refund fraud, more work is needed, especially as cyberthieves continue to become more sophisticated. The IRS is partnering with the practitioner community to combat this epidemic.

The IRS's Protect Your Clients; Protect Yourself campaign (visit tinyurl.com/ybqve3bf for more information) raises practitioners' awareness of their responsibilities and the common-sense steps they can take to protect their clients from identity theft and, in turn, their tax practice and livelihood. Steps such as protecting email accounts with strong passwords, implementing two-factor authentication, and having anti-phishing security tools are imperative. Review IRS Publication 4557, Safeguarding Taxpayer Data, available at tinyurl.com/hqp43tb, for additional best practices.

Practitioner requirement to develop a written information security plan

According to the Gramm-Leach-Bliley Act (GLBA) safeguards rule, tax preparers must implement security plans to protect client data. Failure to do so may result in a Federal Trade Commission (FTC) investigation.

Although the GLBA, also known as the Financial Services Modernization Act of 1999, P.L. 106-102, has been around for quite some time, many practitioners have been unaware they are required to develop a written information security plan that describes how their firm is prepared to protect clients' nonpublic personal information.

The IRS, aware of the confusion in the profession, boosted its efforts to remind practitioners of this responsibility, issuing several recent email alerts to the practitioner community. Additionally, in mid-October 2019, when practitioners were starting to renew their preparer tax identification numbers (PTINs), they noticed a statement on data security responsibilities added to the renewal process. Practitioners were instructed to check a box to confirm their awareness of their responsibility to have a data security plan and to provide data and system security protections for all taxpayer information.

In response to many recent requests from members, the AICPA Tax Section developed a GLBA information security plan template (available at tinyurl.com/yxv8p5pr) that Tax Section members can download and customize to comply with the safeguards rule contained in the GLBA.

Additional data security responsibilities

In addition to the GLBA safeguards rule, tax practitioners should keep in mind other client data security responsibilities.

* Sec. 7216 is a criminal provision that prohibits preparers from knowingly or recklessly disclosing or using tax return information. See the AICPA Tax Section's Section 7216 Guidance and Resources webpage at tinyurl.com/y2by96cs to aid with compliance.

* Treasury Department Circular No. 230, Regulations Governing Practice Before the IRS (31 C.F.R. Part 10), requires practitioners to exercise due diligence in preparing...