The workspace behind the program
Everything your Qualified Individual uses to keep the program current
The program is the product; these are the tools it runs on. Your firm sees all of it, all year.
WISP Builder
- Guided intake: firm profile, systems, data and access, safeguards in place, risks, incident response and disposal.
- Every save is a new version; prior versions stay viewable.
- Annual refresh starts from last year's answers with a 'What changed?' step and a change summary.
- Print-clean PDF with firm name, version and approval date.
Control Register
- A standard control set across the Safeguards areas: access, encryption, MFA, risk assessment, monitoring and testing, training, incident response, vendor oversight, disposal and more.
- Owners, status, last tested and next test due for each control.
- Testing a control schedules the next test on the deadline radar.
Evidence Vault
- Policies, test results, attestations and certificates, linked to controls, vendors and incidents.
- Expiry tracking with reminders before evidence lapses.
- A reviewer request checklist showing what is satisfied and what is missing.
- Program evidence only — never client tax returns, SSNs or taxpayer records.
Incident Response
- An eight-step runbook checked off per incident.
- The FTC 30-day notification clock when 500 or more consumers are affected.
- A notification draft for your counsel to review — CompliAct does not file it for you.
Vendor Register
- Every provider that stores, processes or accesses client data.
- Review dates and attestation status, with editable attestation request emails sent to the contact on record.
- Linked SOC 2 reports and attestations.
Training Log
- One row per staff member with last training, attestation and next due.
- Bulk logging for group sessions, and staff self-attestation.
- Refresher reminder digests to firm admins.
Evidence Packet
- One click produces a PDF with your current WISP, control summary, training, vendors and incident summary.
- Expiring read-only share links for reviewers, insurers, banks and clients.
- Recipients see exactly what was generated — later edits don't change it.