Your WISP has a trigger, not a renewal date

Four triggers, no date. Testing and monitoring results. Material changes to operations or business arrangements. Risk assessment results. Anything else the firm knows, or has reason to know, may have a material impact. Paragraph (g) is not on the 314.6 list, so it applies at every size.

"Material change" is not defined. Section 314.2 defines its terms from (a), "Authorized user," to (s), "You." Neither "material change" nor "business arrangements" is among them. The judgment is the firm's, so in our view the firm should be able to explain it.

The rule still has a rhythm. Below 5,000 consumers, the firm still performs risk assessments "periodically" under (b)(2), reviews access controls "periodically" under (c)(1), reviews its retention policy "Periodically" under (c)(6)(ii), tests or monitors key controls "Regularly" under (d)(1), and assesses service providers "Periodically" under (f)(3). None names an interval. Any of them can produce a result that triggers (g).

In the rule, twice. Paragraph 314.4(d)(2)(i) calls for "Annual penetration testing of your information systems," and (d)(2)(ii) for vulnerability assessments "at least every six months." Both apply only "Absent effective continuous monitoring or other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities." Paragraph 314.4(i) asks the Qualified Individual to report "in writing, regularly and at least annually." Section 314.6 reads: "Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers." Below that line, neither annual duty applies.

Above 5,000, the trigger stays. Paragraph (d)(2)(ii) adds vulnerability assessments "whenever there are material changes to your operations or business arrangements." Scale adds dates. It does not remove events.

In IRS guidance, often. Publication 5708 (Rev. 8-2024) is the IRS sample plan for tax and accounting practices. Its list of Data Security Coordinator duties includes "Reviewing the scope of the security measures in the WISP at least annually or whenever there is a material change in our business practices that affect the security or integrity of records containing PII." Its PII Disclosure Policy says measures "shall be reviewed annually." The same template suggests a "top-down security review at least every 30 days." These are the template's recommendations, not FTC rule text.

The IRS describes the duty as maintenance. Form W-12 (Rev. 10-2025), Line 11, "Data Security Responsibilities," reads: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information." W-12 is also the renewal form, and PTINs "must be renewed annually" (IR-2025-108). The line asks about awareness, not a review date. IR-2026-92 says firms "should make adjustments based on changes in operations or results from security testing and monitoring."

The program is what the firm uses. The definition describes safeguards, not a document. Section 314.3(a) requires the program to be "written in one or more readily accessible parts." The writing is its record.

A plan that no longer matches describes a different firm. If the plan says client files live on an office server, and they moved to a hosted platform last spring, the plan covers a system the firm no longer relies on. In our reading, the gap is not age. The written part has stopped describing the program.

Two paragraphs assume current facts. Paragraph 314.4(c)(2) reads: "Identify and manage the data, personnel, devices, systems, and facilities that enable you to achieve business purposes in accordance with their relative importance to business objectives and your risk strategy." Paragraph 314.4(e)(1) calls for training "updated as necessary to reflect risks identified by the risk assessment." Neither works from last year's inventory.

A new place client data lives. A hosted tax platform, a client portal, a file sync service.

A new way staff reach it. Remote work, personal devices for firm email, a seasonal preparer working from home. These touch the access controls in 314.4(c)(1).

A new service provider. IT, tax software, payroll, or e-signature. A plan naming the old provider says nothing about the new one.

An AI tool that touches client data. Part 314 does not mention artificial intelligence. In our reading, a staff member pasting client information into a general purpose assistant still changes how customer information is processed. It is also the change least likely to be announced.

A change in the firm. A merger, an acquired book of clients, a new office. Near 5,000 consumers, this can change which paragraphs apply.

A change in who holds the role. The Qualified Individual designated under 314.4(a) leaves, or the role is outsourced.

Something the firm learned. A phishing attempt that got through, a weakness a test found, a vendor's security notice. Paragraph (g) names testing and monitoring results as triggers.