Security awareness training for accounting staff works best as short monthly sessions, front-loaded in the fall, plus a 30-minute first-day briefing for seasonal hires. The FTC Safeguards Rule requires the training and expects it to change as risks change. Keep dated attendance and quiz records so the firm can show what each person learned.
What security awareness training must accounting staff get?
Accounting staff at firms covered by the FTC Safeguards Rule must get security awareness training that is "updated as necessary to reflect risks identified by the risk assessment." The rule sets no fixed schedule. IRS Publication 4557 asks for regular refreshers, and the IRS sample WISP trains everyone at least once a year and every new hire before access.
The rule text is at 16 CFR 314.4(e)(1) (eCFR, current as of October 14, 2026). It requires policies and procedures "to ensure that personnel are able to enact your information security program by: (1) Providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment." The phrase "updated as necessary" ties training content to the firm's own risks, not to a calendar.
Small firms do not escape this one. The rule's small-firm exemption, explained in Safeguards Rule exemptions for small tax firms, does not reach the training requirement.
The IRS guidance fills in the how. IRS Publication 4557 (Rev. 6-2024) summarizes the rule's duties and lists "provide security awareness training and schedule regular refreshers." It also says that "Every employee, both professional and administrative staff, should be educated about security threats and safeguards." The front-desk person who opens the mail counts.
IRS Publication 5708 (Rev. 8-2024), the IRS guide to writing a security plan, gives a sample policy: the coordinator "will conduct training regarding the specifics of paper record handling, electronic record handling, and Firm security procedures at least annually," and "All new employees will be trained before PII access is granted." That is a template, not a rule, but it gives a firm a defensible floor.
Training is one of the elements a tax preparer's written plan must address, as the post on the required elements of a tax preparer WISP lays out.
A 12-month security awareness training calendar for accounting staff
A 12-month security awareness training calendar for accounting staff gives each month one short topic, usually 15 to 20 minutes, with the heaviest sessions in September through December. By January, everyone has covered phishing, passwords, payment fraud and incident reporting, so busy season needs only five-minute reminders.
The order follows the tax year. Fall is quiet enough for real sessions and close enough to filing season that the lessons stick. January through April get short reminders at the start of a staff meeting. May through August revisit what went wrong during the season, while it is still fresh.
Training calendar for a small firm (example)
The calendar below is an example for a fictional six-person firm. Topics, lengths and formats are suggestions to adapt to the firm's own risk assessment.
| Month | Topic | Format | Length | Evidence kept |
|---|---|---|---|---|
| September | Phishing: new-client and IRS-impersonation emails | Live session with real examples | 20 min | Sign-in sheet, 5-question quiz scores |
| October | Passwords, multi-factor login and the password manager | Hands-on: each person checks their own accounts | 20 min | Checklist signed by each person |
| November | Payment change requests and callback checks | Role play with a fake bank-change email | 15 min | Sign-in sheet, role-play notes |
| December | Phishing drill and how to report a click | Unannounced drill, then debrief | 15 min debrief | Drill results by person, debrief sign-in |
| January | Handling client paper and the clean desk rule | Five-minute staff-meeting reminder | 5 min | Meeting minutes |
| February | What to do if a computer acts strangely | Five-minute reminder with the reporting contact | 5 min | Meeting minutes |
| March | Peak-season phishing reminders | Email with two real examples | 5 min read | Read receipts or initials |
| April | Extension-season fraud: refund and direct deposit changes | Five-minute reminder | 5 min | Meeting minutes |
| May | Season review: what got through, what was caught | Group discussion | 30 min | Notes, list of changes to the plan |
| June | Working from home and on the road | Live session | 20 min | Sign-in sheet, signed remote checklist |
| July | Talking to clients about IP PINs and identity theft | Live session | 15 min | Sign-in sheet |
| August | Annual WISP review and acknowledgement | Read the plan, sign the acknowledgement | 30 min | Signed acknowledgements |
The June topic has its own post: remote work security for tax preparers covers home networks, laptops and travel. The July topic draws on Publication 4557's advice to "Educate clients about the availability of the Identity Protection PIN for taxpayers"; which clients should get one is the subject of IP PIN for tax clients.
The December drill uses a script the firm can copy from running a phishing drill for tax season staff. This post does not repeat it.
Training seasonal accounting staff on their first day
Training seasonal accounting staff on their first day means a 30-minute security briefing before they get a login: how to spot phishing, how to handle client paper, who to call about anything odd, and a signed acknowledgement. Publication 5708's sample plan trains new employees before they get access to client information, and seasonal hires are new employees.
Temporary preparers and admins often arrive in January, when the fall calendar is already over. They miss the long sessions, and they start in the season Publication 5293 warns about, when new scams are "especially common during the filing season." A short first-day script closes that gap.
A 30-minute first-day script
- Five minutes: why it matters. Client files hold Social Security numbers, bank accounts and income. A stolen file can become a fraudulent return.
- Ten minutes: phishing. Show two real examples the firm received. Explain the rule: never open an unexpected attachment, and call the sender on a known number first. Publication 4557 puts it as "make contact first by phone."
- Five minutes: paper and screens. Lock the screen when stepping away. Publication 4557's checklist suggests "password-activated screen savers to lock employee computers after a period of inactivity." Client paper goes in the locked cabinet at day's end.
- Five minutes: payment and data requests. No bank, refund or payroll change is made from an email alone. Every change gets a callback to a number already on file.
- Five minutes: reporting and sign-off. Give the name and phone number of the person to tell about a click, a lost device or a strange request. The new hire signs the acknowledgement.
Seasonal staff should also get narrower access than permanent staff, which is a separate control from training. How to scope their rights is in least privilege for seasonal and remote accounting staff.
How do you record security awareness training for the WISP?
Security awareness training is recorded for the WISP with three pieces of evidence for each session: a dated attendance sheet, quiz or drill results, and a signed acknowledgement of the plan each year. Keep them in one folder by year. The point is to show who learned what, and when, if a regulator, insurer or the IRS asks.
Publication 5708 recommends an "Employee/Contractor Acknowledgment of Understanding" and explains why: "Signing and dating training leaves a good documentation trail you can keep on file for several reasons." It recommends that acknowledgements "be updated at annual training intervals and kept on file." Its sample plan requires all attendees at the annual session "to certify their attendance at the training."
A training record that holds up has these fields:
- Date and topic of the session.
- Names of attendees, with initials or signatures.
- Format and length, such as a 15-minute live session.
- Quiz or drill results by person, where the session had one.
- Follow-up for anyone who missed it or failed the quiz, with the date they caught up.
Absent staff are the gap most firms miss. A person on leave in October still owes the October session. Note the makeup date on the original sheet so the record shows the gap closed.
Results matter as much as attendance. If the December drill shows two people clicked, the record should show they got a follow-up and passed a later check. That also answers the rule's "updated as necessary" wording: the next year's calendar can give more time to the topic people failed.
Callback checks accounting staff skip on payment change requests
A callback check means verifying a request to change a bank account, a refund deposit or payroll details by phoning the requester at a number the firm already has, never one in the email. Staff skip it when the request looks routine, comes from a known address, or arrives during a rush.
The FBI's Business Email Compromise public service announcement (I-091124-PSA, September 11, 2024) describes the scam as one that "targets both businesses and individuals who perform legitimate transfer-of-funds requests," often after an attacker "compromises legitimate business or personal email accounts." Its first prevention tip is to "Use secondary channels and/or two-factor authentication to verify requests for changes in account information."
Accounting staff see three kinds of change requests that fit this pattern:
- Client bank changes. An email, apparently from a client, asks the firm to use a new account for a refund or a payment.
- Direct deposit on a return. IRS Publication 5293 (5-2018) asks preparers to make "a final review of return information" before e-filing, "especially direct deposit info."
- Payroll changes. For firms that run client payroll, an employee or the firm's own staff member asks to switch pay to a new account.
Staff skip the call for predictable reasons. The email comes from the client's real address, because the client's account was taken over. The request is small. The preparer is behind and the client sounds urgent. Training should name each excuse and answer it: a real address proves nothing when the account itself is compromised.
The callback rule, written as one line (example)
"Before changing any bank, refund or payroll account, call the person at the number already in their client file, not a number in the request, and note the date, time and who confirmed it."
A second check sits beside the call: compare the requested account with the statements the client already sent. Schema CPA files everything a client uploads by document type, issuer and period, so last month's bank statement for that client is quick to pull up and compare; the document types table on the homepage lists the statements and forms it reads.
When annual training videos fail accounting staff
Annual training videos fail accounting staff because one long session a year teaches general threats once, months before the attacks it describes arrive. Behavior changes when lessons are short, repeated, tied to emails the firm actually received, and followed by a test such as a drill. The Safeguards Rule's own wording points the same way.
A video watched in July is mostly forgotten by February. It also covers threats in general, while the rule asks for training "updated as necessary to reflect risks identified by the risk assessment," meaning the firm's own risks. A generic video cannot know that the firm's front desk received three fake new-client emails last month.
Publication 5708's sample policy anticipates this: "periodic reviews or refreshers will be scheduled until all employees are of the same mindset regarding Information Security." The annual session is the floor in that template, and refreshers fill the rest of the year.
A monthly program replaces the single video with four habits:
- Short sessions. Fifteen minutes holds attention and fits into a staff meeting.
- Real examples. Forward the phishing emails the firm actually received, with links disabled, and use them as the material.
- Tests. A drill shows who would have clicked. A quiz only shows who remembers the slide.
- Follow-up. The person who clicked gets a short one-on-one, not a public mention.
A video still has a place. It can cover the basics for a new hire who joins mid-year, and it gives everyone a shared vocabulary. Just do not let it stand in for the rest of the program. The broader picture of how training fits with backups and settings is in ransomware protection for accounting firms.