Day to day, nothing happens. No one asks to see your plan at PTIN renewal, and there is no automatic fine for not having one. The exposure arrives after a data theft or a complaint, when the FTC, the IRS, your insurer and your clients can each ask the same question: where is your written plan?
The FTC can investigate
The written plan is a requirement of the FTC Safeguards Rule, and the FTC enforces it. IRS Publication 4557 says plainly that preparers who fail to create and carry out a security plan may face an FTC investigation. The FTC has brought Safeguards Rule cases against tax businesses before.
The IRS can treat it as a professional responsibility issue
The IRS Office of Professional Responsibility wrote about this in July 2026. For practitioners covered by Circular 230, such as enrolled agents, CPAs and attorneys, it ties data security to the duties of competence and of having procedures that keep the firm compliant. It says a willful failure to maintain a plan could lead to discipline under Circular 230.
The word “willful” matters. And every year, Line 11 of Form W-12 has you confirm that you know a written plan is required.
Your insurance may not respond the way you expect
The same IRS article notes that failing to maintain a plan can cause problems with malpractice insurance coverage. Cyber and professional liability applications often ask about written security policies and controls such as multi-factor authentication. An answer that turns out to be inaccurate can complicate a claim at the worst possible time. Read your own policy and application; they vary.
A breach is harder and more expensive without one
A written plan includes the steps for a data theft: who to call, what to preserve, who must be notified and by when. Without it, those decisions get made under pressure. Deadlines still apply. The FTC must be told within 30 days when unencrypted information on 500 or more people is taken, and state laws set their own deadlines for notifying the people affected.
Clients ask
After a breach, clients want to know what you did to protect them. A dated plan, signed staff acknowledgments and a record of fixing the gaps you found show you took reasonable care. Having nothing in writing is hard to explain, to a client or to anyone reviewing the incident later.
Keeping this in proportion
Most preparers without a plan will never hear from a regulator. The point of the plan is that it makes a breach less likely, because writing one forces you to notice the shared login, the laptop that isn't encrypted and the backups sitting next to the originals. The paper matters less than the fixes it leads to.
What to do
- If you have nothing, start with the free template in IRS Publication 5708.
- If you have an old plan, check that it still names your current software, devices and staff.
- If you aren't sure where you stand, the free Self-Check takes two minutes.
Sources
- IRS Office of Professional Responsibility, Issue 2026-22, July 22, 2026
- IRS Publication 4557, Safeguarding Taxpayer Data
- FTC Safeguards Rule: What Your Business Needs to Know
This page is general information, not legal advice.