Who is the qualified individual in a small tax office?

Leer en español

The short answer

The FTC Safeguards Rule, 16 CFR Part 314, covers tax preparation firms. Section 314.4(a) says to designate a qualified individual. That person is responsible for overseeing and implementing your information security program and enforcing it. The rule says the qualified individual may be employed by you, an affiliate, or a service provider. Section 314.4(i) says to require that person to report in writing, regularly and at least annually. Section 314.6 lifts the reporting paragraph for offices that keep customer information on fewer than 5,000 consumers. It does not mention the designation paragraph.

What the rule says

Section 314.4 opens with "In order to develop, implement, and maintain your information security program, you shall:" and then lists the elements. Paragraph (a) is the first one:

"Designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program (for purposes of this part, “Qualified Individual”)."

From there the rule uses the capitalized term "Qualified Individual" for that person.

Who can be the qualified individual

The rule says: "The Qualified Individual may be employed by you, an affiliate, or a service provider." Those are the three sources it names.

It defines a service provider as "any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution that is subject to this part."

Publication 5708, the IRS guide to writing a plan, says to "Identify by name and position persons responsible for overseeing your security programs." Its plan outline asks you to "List the qualified individual who will coordinate the security programs as well as responsible persons."

If the role goes to a service provider or affiliate

Paragraph (a) adds conditions. Its words are "To the extent the requirement in this paragraph (a) is met using a service provider or an affiliate, you shall:"

• "Retain responsibility for compliance with this part;"
• "Designate a senior member of your personnel responsible for direction and oversight of the Qualified Individual; and"
• "Require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements of this part."

Under that wording, responsibility for compliance stays with you. You also designate a senior member of your own personnel to direct and oversee the qualified individual.

Paragraph (f) covers service providers separately. It starts with "Oversee service providers, by:" and includes "Requiring your service providers by contract to implement and maintain such safeguards".

The written report

Paragraph (i) says to "Require your Qualified Individual to report in writing, regularly and at least annually, to your board of directors or equivalent governing body." If there is no such body, "such report shall be timely presented to a senior officer responsible for your information security program."

The report has to include two things. The first is "The overall status of the information security program and your compliance with this part". The second is "Material matters related to the information security program", addressing "issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management's responses thereto, and recommendations for changes in the information security program."

Does the small-office exemption change it?

Section 314.6 says:

"Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers."

Paragraph (i), the written report, is on that list. Paragraph (a), the designation, is not. The threshold is a count of consumers whose customer information you maintain. It is not a count of staff.

Section 314.3(a) says the safeguards must be "appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue." Publication 5708 says: "For example, a sole practitioner can use a more abbreviated and simplified plan than a 10-partner accounting firm." That speaks to the size of the plan. See Does a one-person tax office need a WISP?

What the IRS publications say

Publication 4557 says that as part of its plan, each company must "Designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program". Publication 5708 lists the same item as "Designate a qualified individual to coordinate its information security program".

Put it in your plan

Publication 5708's plan outline has a step titled "Designate a qualified individual". It also asks you to "List authorized users at your firm, their data access levels, and responsibilities." The free WISP generator makes a draft plan. For the other parts of the rule, see the FTC Safeguards Rule guide.

Sources

• 16 CFR 314.1, 314.3, 314.4, 314.6 (eCFR, 2026-10-01): ecfr.gov, Part 314
• IRS Publication 4557 (Rev. 6-2024): irs.gov/pub/irs-pdf/p4557.pdf
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf

This is general information, not legal advice.