In the past five months, we have seen a greater number of requests for the Independent Security Study than in the past five years combined. What is driving this surge? Greater awareness by boards as to the importance of protecting key executives in light of recent high-profile attacks coupled with the potential tax benefits of an IRS 132 security assessment. Accordingly, more boards are taking a closer look at how their organizations protect senior executives in a cost-effective manner and demanding swift action.
For some companies, answering that call is straightforward: they have well-staffed security departments ready to respond. But for others, where security is a shared responsibility among HR, Facilities, Legal, and IT, or rests with a team of one, the task can feel daunting, especially with a deadline looming before the next board meeting. In these instances, it is essential for clients to coordinate with their tax professionals in tandem with a third-party security consultant to assist in navigating the security-related nuances of the IRS tax code.
Any security report for IRS Code Section 132 requires the completion of several core areas, including physical assessments, policy review, and cyber exposure. But what if your company has already completed one of these aspects of the assessment?
Situations like this can understandably create tension. Imagine a security director who has already completed a physical security assessment of the CEO’s home, now having to inform that same executive it must be done again and that additional funds will be required. It’s a difficult conversation. Can an outside firm simply attach the company’s assessment to their report, or perhaps make recommendations based on their review of the previous company assessment?
Looking at the tax code, 26 CFR 1.132-5 under section 2.m.iv, it states in part:
(A) A security study is performed with respect to the employer and the employee (or a similarly situated employee of the employer) by an independent security consultant;
(B) The security study is based on an objective assessment of all facts and circumstances;
It is difficult to argue that a report jointly performed by the company and the security consultant provides an objective assessment of all facts and circumstances. Companies and their tax advisors must consider if such a report is defensible during an IRS audit.
When these questions arise, we explain that this is not simply a security study evaluating the executive’s level of risk, it is an independent security study. The whole point is to ensure an objective, third-party evaluation free from internal influence. If a company submits a report in which half the work was conducted by internal staff and still labels it as “independent,” they are not only diluting the integrity of the assessment but may also be misleading the IRS. In essence, they are playing a dangerous game with tax compliance, one that may not hold up under scrutiny during an audit. Companies and their tax advisors must ask themselves: are they truly prepared to defend the independence and objectivity of their report, or are they risking reputational harm and financial penalties for the sake of perceived cost savings?
With the great increase of corporations conducting, and benefiting, from a Section 132 audit over the past six months, it is reasonable to expect the tax man will take a closer look at businesses claiming these benefits. Security directors ought to ensure they are working with ethical firms who are willing and able to stand by their final deliverable. The consequences of not doing so could be significant.
This material is not intended as tax advice and has been prepared for informational purposes only. You should consult your own tax advisors before engaging in any transactions.