Assurbyte Book a free call
Menu

Circular 230 and Your WISP: What the IRS Ethics Office Says

· Assurbyte

An open office file drawer full of client folders, beside the headline: Circular 230 and your WISP.

Short answer: Circular 230 doesn't use the word "WISP," but the IRS's own ethics office says your written security plan is tied to it. The WISP (written information security plan, basically your office's rulebook for keeping client data safe) is required by the FTC Safeguards Rule. In a June 2025 article, the IRS Office of Professional Responsibility linked that plan to two Circular 230 rules: competence and firm procedures. So if you're an EA, CPA, attorney, or AFSP preparer, your WISP isn't just an FTC thing. It's part of how you show you run a careful practice.

If you've ever read Circular 230 at 11 p.m. in March hoping it would say something simple, you know it rarely does. Let's make this one simple.

What is Circular 230, and who does it apply to?

Circular 230 is the Treasury Department's rulebook for people who practice before the IRS. Its official home is 31 CFR Part 10 (that's a chapter of federal regulations). Think of it as the code of conduct for your professional badge.

The IRS Office of Professional Responsibility, or OPR, enforces it. In its June 2025 newsletter on WISPs, OPR lists who has to follow it: attorneys, CPAs, enrolled agents, enrolled retirement plan agents, and return preparers in the IRS's voluntary Annual Filing Season Program (AFSP).

You can read the full text on the IRS Circular 230 page.

Does Circular 230 require a WISP?

Not in so many words. The WISP requirement itself comes from the FTC Safeguards Rule. That rule names "an accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution in 16 CFR 314.2, so it applies to tax offices of every size.

What OPR did in its 2025 article is connect the dots. It points to two Circular 230 sections:

  • Section 10.35, Competence. You must have "the necessary competence to engage in practice before the Internal Revenue Service." OPR says competence "has been construed in related contexts to encompass technological competency." In plain words: knowing how to keep client data safe is part of being good at your job, like knowing the tax code.
  • Section 10.36, Procedures to ensure compliance. If you run or co-run a firm, you have to take reasonable steps to make sure the firm has "adequate procedures" so your team follows Circular 230. OPR notes this reaches employees and contractors too. A WISP is, at heart, a written set of procedures.

OPR's closing line is the one to remember. Given those two sections, it says, "we encourage practitioners to pay heed to the requirement to have a WISP and implement adequate data security precautions."

Could a missing WISP affect your practice?

OPR is measured about this, so we will be too. Its article says that failing to keep a WISP can put clients at risk of identity theft, and may expose a practitioner to liability under the Safeguards Rule and "the terms of their malpractice insurance coverage." It adds that "in circumstances of willfulness," it could lead to discipline under Circular 230.

Notice the order. The first worries are your clients and your insurance, not a disciplinary letter. That matches what we see small offices care about most: if something goes wrong, can you show your insurer and your clients that you had a real plan?

OPR also suggests your breach plan include "timely notification of the business's insurance carrier." Easy to forget when your screen is acting strange on April 10th. Easy to remember if it's written down.

What should a WISP cover, according to OPR?

OPR says there's no "one-size-fits-all" plan. It should fit your office's size, the work you do, and how sensitive your client data is. Then it lists practical habits worth considering, including:

  • Collect only the client info you actually need, and don't keep it longer than you have to.
  • Keep software updated and use antivirus and firewalls (a firewall is a digital doorman that decides what traffic gets in).
  • Use multifactor authentication, the "password plus a code on your phone" login, for systems with sensitive data.
  • Have written steps for a data breach, including calling your insurer.
  • If anyone works from home, set rules for paper files, home devices, and keeping personal and business accounts separate.

For the nuts and bolts, OPR points to the same two IRS guides we lean on: IRS Publication 5708, the WISP guide and sample template, and IRS Publication 4557, Safeguarding Taxpayer Data. Our walkthrough of the Pub 5708 template goes blank by blank.

How do you connect your WISP to your Circular 230 duties?

You don't need a second document. A few small moves make your existing plan do double duty:

  1. Name the person in charge. The Safeguards Rule asks for a "Qualified Individual" (16 CFR 314.4). In a small office, that's often the owner, the same person section 10.36 looks to.
  2. Write down your procedures, not just your intentions. "We're careful" isn't a procedure. "Client files are deleted from the shared drive after X years" is.
  3. Train your people, including seasonal help and contractors. Both the Safeguards Rule and section 10.36 reach beyond you.
  4. Review it every year. IRS materials call a WISP an evergreen document. Off-season is a good time, before the phones start ringing.

Not sure you need a WISP at all? Start with Do tax preparers need a WISP?, then see how it shows up on your PTIN renewal at Form W-12 line 11.

Four ways to connect a WISP to Circular 230 duties: name the person in charge, write down procedures rather than intentions, train your people including seasonal help and contractors, and review the plan every year.

FAQ

Is a WISP part of Circular 230?

Not directly. The WISP requirement comes from the FTC Safeguards Rule. The IRS Office of Professional Responsibility says it connects to Circular 230's competence rule (section 10.35) and firm-procedures rule (section 10.36).

Who does Circular 230 apply to?

According to OPR: attorneys, CPAs, enrolled agents, enrolled retirement plan agents, and return preparers in the IRS Annual Filing Season Program.

What does Circular 230 section 10.35 say?

It says a practitioner must have the necessary competence to practice before the IRS. OPR says that competence has been read to include technological competence, like protecting client data.

Do I need a separate Circular 230 security document?

No source we found asks for one. One well-kept WISP, built from IRS Publication 5708, is what OPR points you to.

Want a quick read on where your plan stands?

If you're wondering how your current setup measures up, the free Small Office Security Checkup takes a few minutes and shows you the gaps worth fixing first.

This post is general information, not legal advice. For questions about your own situation, talk to a qualified professional.

Sources