CPA firms: put your AI tools in your WISP

Short answer: Put the AI tools staff use for client work into the firm's written information security plan, including their accounts, allowed information, access and responsible owners. IRS Publication 5708 provides a WISP starting structure, and the FTC describes the written security program required of covered financial institutions. Our recommendation is to apply that existing program to AI workflows instead of treating an AI policy as a separate document nobody operates. Ask your qualified individual and counsel to confirm which requirements apply to the firm's activities and approve the resulting controls.

Obsidian Ridge offers the assessment below. The AI worksheet and examples are our recommendations for using the firm's existing program; they are not an IRS-issued AI template.

Key facts

• Should AI tools be in the WISP? Our recommendation is yes when they are part of how the firm handles client work. Record the real tool, account and data flow using the worksheet below.
• The IRS document is a starting point: Publication 5708 says it is “not intended to replace your own research”. Use the firm's actual operations to complete the plan. IRS Publication 5708, August 2024 revision, checked November 3, 2026.
• The FTC requires a written program for covered firms: Its guide says, “Your information security program must be written”. The guide names tax preparation firms among its examples and describes activity-based coverage. FTC Safeguards Rule guide, checked November 3, 2026.
• Inventory is part of the picture: The FTC says, “Keep an accurate list of all systems, devices, platforms, and personnel.” Apply that inventory question to the AI tools staff actually use. FTC guide, checked November 3, 2026.
• The document must stay useful: The IRS describes a plan that is “regularly reviewed, tested, and updated”. Give changes in AI use a place in that review. IRS Publication 5708, checked November 3, 2026.

Why isn't a separate AI policy enough?

A staff policy can say what employees may do, while the WISP records who operates the safeguards and how the firm checks them. Our recommendation is to connect the two. The policy should point to the current approved-tool register, and the plan should identify its owner and review process.

Consider an illustrative tax practice that allows an assistant to improve public website wording but has not approved client-document uploads. The useful record is more precise than the assistant's brand name. It identifies the firm account, the permitted task, the excluded information and how the administrator tests the restriction. This is an invented example, not a report about a client.

Ask staff about the work they do before asking which AI subscriptions the firm pays for. Include occasional tools, browser extensions, meeting notes, spreadsheet assistants and AI features inside existing software. An unpaid or embedded feature can still belong in the inventory if staff use it for firm work. Record reported use as a lead to verify, not as proof of a particular capability or disclosure.

Two embedded features are worth naming in that inventory by product rather than by brand. Intuit Intelligence is the AI inside QuickBooks, and it arrives with the subscription rather than being installed. TaxDome AI reads and renames the documents clients upload and answers questions about the practice. Each page records what the vendor publishes for each plan, with the date the page was read.

The AI-tool evidence index helps route vendor questions. It does not replace the firm's account review. A dated vendor statement and a screenshot of your settings answer different questions, so keep both where the qualified individual can find them.

What do Publication 5708 and the FTC guide expect a plan to describe?

Publication 5708 organizes its sample around scope, responsible people, risks, hardware, safeguards and implementation. The FTC guide describes safeguards suited to the business and its information. The FTC also identifies limited exemptions from certain provisions for institutions holding information about fewer than 5,000 consumers; do not turn that into a blanket exemption from having a program. IRS Publication 5708 and FTC guide, checked November 3, 2026.

Ask the qualified individual and counsel to determine coverage and applicable provisions from what the firm does. Do not use this article to decide that every service offered under a CPA license has identical obligations. The purpose of the AI review is to give those reviewers the actual workflow and evidence they need.

Our practical application is to treat a new AI connection as a change to the information system. If the approved use changes from public drafting to reading a client folder, send that change through review. A generic sentence allowing productivity tools does not explain the new access or identify who authorized it.

What should an AI entry in the WISP contain?

Use a maintained register referenced by the plan rather than scattering product names across several policy documents. Our suggested record fits on one page per important workflow and links to supporting evidence. Keep confidential client content out of the register itself.

For example, an approved public-copy task can require the firm account and prohibit uploading tax returns, bank details or client correspondence. That rule needs a test of the actual route staff use. If the tool also offers a mailbox or shared-drive connection, treat that as a separate proposal instead of assuming it came with approval of the writing task.

Use the AI tool risk checker to collect unknowns, and the AI policy builder to assemble staff instructions after decisions are made. Neither output should be presented as a completed legal review. The firm must approve the rule, configure the relevant systems and record what was verified.

What evidence should sit behind each entry?

Our recommendation is to retain a dated vendor source, the account configuration, the permission review and a safe test result. Ask the vendor what happens to inputs and outputs, who can access them, whether they are used for model training, how long they remain and what happens when the firm ends the service. If the answer depends on a plan or feature, record that dependency.

Keep a no-training answer separate from permission to disclose client information. A statement about model development does not settle the firm's professional, contractual or tax-information obligations. Ask counsel about those obligations before approving client material. Also distinguish the vendor's retention from copies exported into the firm's own email, storage or document system.

Have the administrator demonstrate access with an ordinary employee account. Use invented documents and a test account with the same intended restrictions. Confirm that the allowed task works and that a disallowed user cannot obtain the test material. Record a gap as a gap, even if the policy document already says access is restricted.

Check the exit path while the review is small. Can the firm obtain the approved outputs? Who owns them when the employee leaves? Which account connections must be revoked? Ask the responsible reviewer to approve preservation and deletion instructions before changing records. Do not delete a real client file to test whether an agent has permission to do so.

How should staff learn the rule during filing season?

Use a short exercise based on tasks staff recognize. Our recommendation is to show a public marketing paragraph, an invented client email, a fictional return summary and an unfamiliar meeting invitation. Ask which tasks can use an approved AI tool, which information is excluded and where an exception request goes.

Give staff a usable alternative when the answer is no. For example, an employee can ask for help rewriting a generic letter using invented details while the client-specific task goes through review. Avoid asking employees to decide whether a record is sufficiently anonymous during a busy workday. Define an approved process and route uncertain cases to the named owner.

Include seasonal workers and people who can authorize software connections. Ask them to demonstrate the account they would use without showing passwords or private personal conversations. Record training completion and the unresolved workflow questions, then revise the instruction when the firm makes a decision.

The CPA WISP guide covers the broader program. This AI-specific exercise should feed that program, so the plan, training and actual tools do not drift into three different versions of what the firm permits.

What can the firm complete this week?

The following is our recommended decision checklist. It produces a reviewable inventory and bounded approvals, not a claim that a week's work completes every WISP obligation.

1. Name the accountable reviewer. Put the qualified individual and the operational owner on the AI inventory. Ask counsel to resolve applicability and sensitive-data questions.
2. Collect actual uses. Ask staff which tools and features they use, then verify work-account connections and installed tools within the firm's authorized review scope.
3. Choose the allowed combinations. Approve the task, information type, product, account and permissions together. Leave unresolved client-data uses on hold.
4. Attach vendor evidence. Save current terms and answers for the exact plan. Record missing answers and the person responsible for obtaining them.
5. Run safe tests. Use invented data to check allowed work, denied access, output sharing, export and removal of an account connection. Record failures before rollout.
6. Update the working documents. Add the approved register reference, owner, training instruction, reporting route and review triggers to the firm's existing plan.

If staff have already uploaded client information to an unapproved tool, follow the firm's incident process. Record the account, information, approximate time and known sharing details, and involve the qualified individual and counsel. Do not decide notification or reporting duties from a product's delete button.

Keep a small change log after approval. A different subscription, new connector, changed vendor terms, wider audience or new task should trigger the owner to reconsider the affected entry. Schedule that review as an operational responsibility rather than a reminder to rewrite the whole WISP from scratch.

Where does an assessment help?

An inventory can reveal that the written plan and actual device use differ. Our recommendation is to use those findings to assign decisions, not to label every discovered tool a violation. Verify the use and permission before deciding whether to approve, restrict, remove or investigate it.

The accounting industry page puts this work in the firm's wider security context. The assessment below offers discovery and recommended fixes within an agreed scope. The qualified individual and the firm still own approval of the WISP and the work needed to implement changes.

Sources

Opened November 3, 2026:

• IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice, August 2024 revision: starting structure, scope and maintenance.
• FTC Safeguards Rule: What Your Business Needs to Know: covered activities, written programs, safeguards and limited exemptions.
• Obsidian Ridge's existing AI-tool evidence index: vendor-source routes for the firm's own review.