Does the Independent Security Study satisfy §1.132-5 on its own?

The ISS is one of two paths the regulation provides for establishing an overall security program. The study must be paired with consistent application of its recommendations, retained documentation, and periodic reassessment.

What happens if the IRS audits the executive's security perk?

The ISS is the foundational document examiners will request. A defensible study includes clear independence language, explicit reference to §1.132-5, documented facts and circumstances, and recommendations tied to identifiable risk.

Why don't you sell executive protection or other security services?

Because we cannot credibly study what we sell. The regulation's independence requirement exists for a reason. Our structure is our answer to it.

How long does a study take?

Standard engagements run twelve weeks from kickoff to delivery. Expedited delivery is available for compressed timelines driven by proxy filings, litigation events, or changes in executive status.

Can one study cover multiple executives?

Yes. A single governing study can document the employer's overall security program and address facts and circumstances executive by executive in structured appendices.

Who conducts the work?

Senior practitioners with federal protective, investigative, or intelligence experience — augmented by digital risk and OSINT analysts. Every engagement is led by a senior partner who signs the study.

What is an Independent Security Study?

An Independent Security Study is a formal, third-party report conducted under Treas. Reg. §1.132-5(m) that documents the facts and circumstances justifying an employer's executive security program. It defines the overall security program and establishes the defensible record required for the employer to exclude executive security benefits from the executive's taxable compensation as a working condition fringe benefit.

Who qualifies as an independent third party under §1.132-5?

The regulation requires the firm performing the study to be independent — meaning it does not sell executive protection, guard services, monitoring systems, or any of the security measures the study might recommend. A firm with a financial interest in the recommended security measures cannot credibly author an independent study of those measures. The independence requirement is structural, not just a disclosure obligation.

What triggers the need for an Independent Security Study?

An ISS is typically triggered by one of four events: a proxy filing season requiring perquisite disclosure analysis, an IRS audit or inquiry involving executive compensation, a board or compensation committee review of executive security perquisites, or a significant change in the executive's threat environment. Legal counsel and tax directors are usually the first to identify the need.

How is an Independent Security Study different from a security assessment?

A security assessment is an operational document focused on vulnerabilities and recommendations. An Independent Security Study is a regulatory compliance document that must also document a bona fide business-oriented security concern, assess risks objectively, make reasonable recommendations, and be prepared by an independent third party. The ISS is what the IRS examiner will request; the security assessment may inform it but does not replace it.

Can a company's existing security vendor conduct the Independent Security Study?

An existing security vendor may conduct the physical assessments that inform an ISS. The study itself, however, should not be authored by a party that sells the recommended measures. Many employers engage their existing vendor for operational assessments and a separate independent firm for the ISS itself. The two are complementary.

What specialized reports does an Independent Security Study engagement produce?

A full engagement produces specialized reports covering physical security (residential and corporate office assessments), digital risk (online footprint, OSINT, and data broker analysis), and PII exposure, along with stakeholder interviews and governance review. These reports are synthesized into the final Independent Security Study, which includes the regulatory determination and overall security program language.

How often should an Independent Security Study be updated?

Tax counsel typically treat an ISS as current for approximately three years. Reassessment is recommended sooner if material changes occur — including changes in the executive's threat environment, a significant public event (litigation, media exposure, activist attention), changes in residential or office location, or a change in executive status.

What is the IRS safe harbor for personal aircraft use under §1.132-5(m)(4)?

The regulation provides a safe harbor for personal flights on employer aircraft used in connection with a security program. The value of the flight is determined at 200% of the Standard Industry Fare Level (SIFL) rate rather than the full fair market charter rate. This safe harbor only applies when the security program meets the §1.132-5(m) requirements, including the Independent Security Study requirement.

Does the IRS and SEC treat executive security differently?

Yes. The IRS analyzes executive security under §132 to determine whether the benefit is excluded from taxable income as a working condition fringe. The SEC analyzes the same security expense under Item 402 of Regulation S-K to determine whether it must be disclosed as a perquisite in proxy filings. A benefit can simultaneously be a non-taxable fringe benefit under §132 and a disclosable perquisite under SEC rules. The two analyses are parallel but distinct.

What documentation does the IRS expect if it audits an executive security benefit?

Examiners typically request the Independent Security Study, evidence of consistent application across similarly situated executives, the employer's overall security program documentation, and any threat assessment or incident history relied upon. Studies that include clear independence language, explicit regulatory citations, documented facts and circumstances, and recommendations tied to identifiable risk have historically withstood examination.

Compensation Planning

When Security Exceeds the ISS Recommendation: Tax Treatment of Above-the-Line Benefits

By Senior Partner · April 2026 · 5 min read

An Independent Security Study recommends a program. The company implements it. Then someone - the board, the CEO, the security director - decides the program isn't enough. Maybe the threat environment changed. Maybe the executive is uncomfortable with the level of coverage. Maybe the board wants more protection than the study called for and is prepared to pay for it.

The question that doesn't always get answered before the additional measures go in: what happens to the tax treatment of the portion that exceeds the recommendation?

The answer is straightforward, but it has real dollar consequences if it's not built into the planning before the expense is incurred.

The ISS sets the defensible floor, not a ceiling

The working condition fringe exclusion under §1.132-5(m) applies to security measures that are part of a qualifying overall security program established because of a bona fide business-oriented security concern. The ISS documents that concern, translates it into specific recommendations, and defines the program.

What the regulation excludes from the executive's income is the value of benefits provided in connection with that program. The program is what the study says it is.

Security measures that go beyond the study's recommendations aren't part of the qualifying program - they're additional benefits. The regulation doesn't prohibit them, and there's nothing wrong with a company providing a more extensive program than the study required. But the portion above the study's recommendations doesn't inherit the tax treatment of the qualifying program. It's compensation.

What "above the line" means in practice

The line is the study. What the study recommends is potentially excludable (assuming consistent implementation and all other requirements are met). What the study doesn't recommend is taxable.

A few examples of how this plays out:

The study recommends a residential security system and ground transportation for work-related travel. The executive requests 24-hour residential security staffing. The study determined that 24-hour protection wasn't warranted. The staffing cost above the recommended measures is a taxable benefit.

The study recommends secure ground transportation for certain travel categories. The executive prefers to use company aircraft for all domestic travel, citing general comfort with the security arrangement. The study didn't recommend non-commercial aircraft as a security measure. The value of that aircraft use is taxable.

The study covers the executive and their primary residence. The company extends the same security arrangements to a second home. The study didn't address the second residence. The security costs for the second property are a taxable benefit.

In each case, the additional measures may be entirely reasonable. The executive may have legitimate reasons for wanting more coverage than the study called for. The board may be comfortable with the additional cost. None of that changes the tax treatment of the excess.

Why this surprises people

The surprise typically comes from a category confusion: because the base program is tax-free, people assume the security arrangement as a whole is tax-free. It isn't. The exclusion is specific to measures that qualify under the regulation's requirements. Measures outside that perimeter are subject to the same rules as any other executive benefit.

The other source of surprise is timing. The measures go in first. The W-2 gets prepared later. If nobody flagged at the time that a particular enhancement wasn't covered by the study, the compensation team may not catch it until it's already been excluded - and then the correction requires either a restated W-2 or an amended return.

The clean version of this process runs in the other direction: the enhancement is identified, the tax treatment is assessed before implementation, and the compensation consequences are built into the arrangement from the start. If the company is going to provide additional security beyond the ISS recommendation, that's a known, manageable outcome - not a surprise.

The right way to structure it

When security enhancements above the ISS recommendation are part of the plan - whether driven by changed threat conditions, board preferences, or executive request - there are two legitimate paths.

The first is to update the ISS. If the additional measures are warranted by documented changes in the threat environment, the study can be updated to reflect the new facts and revised recommendations. An updated study with specific findings supporting the enhanced measures makes the full program defensible, not just the baseline. This is the right path when the facts actually support the additional coverage.

The second is to treat the excess as compensation. If the additional measures are driven by preference rather than documented threat, they're a benefit - valued, included in W-2 income, and disclosed in the proxy if they meet the materiality threshold under SEC Item 402. This path isn't a penalty; it's the structure. The company provides more security than the study required, the executive receives a taxable benefit, and the arrangement is handled cleanly in the compensation reporting.

What doesn't work is providing additional measures and treating them as part of the qualifying program when they're not. That's the position that becomes a problem on IRS examination - not because the measures were unreasonable, but because the tax treatment doesn't match what the regulation allows.

The proxy disclosure question

The above-the-line portion of a security program is a perquisite for SEC purposes if it doesn't meet the "integrally and directly related to the performance of duties" standard. Personal security enhancements provided primarily for the executive's comfort or preference, rather than as a documented business necessity, are likely disclosable under Item 402 of Regulation S-K if they exceed the reporting threshold.

This is worth flagging to compensation counsel before the enhanced measures go in, not after. A perquisite that requires disclosure in the proxy is a public disclosure. Companies that identify the disclosure obligation early can address it in the compensation committee narrative. Companies that miss it face the alternatives: restatement or explanation after the fact.

Planning the conversation correctly

The practical point is that the conversation about above-the-line security benefits belongs in the compensation planning process, not the security planning process. Security leadership can recommend whatever level of coverage they believe is appropriate. The question of what portion is tax-free and what portion is compensation is a separate question - and it needs to be answered before the program is set, not after the W-2 goes out.

If the board or executive wants more than the study calls for, that's a legitimate choice. The full cost of that choice - including the tax and disclosure consequences of the above-the-line portion - should be part of the decision, not a footnote to it.

This post is for informational purposes and does not constitute tax or legal advice. Readers should consult qualified tax and legal counsel regarding the treatment of specific programs.

AVREN ADVISORY

Independent Security Studies under Treas. Reg. §1.132-5

We conduct the Independent Security Study required by Treas. Reg. §1.132-5. Physical security assessment, digital risk analysis, executive interviews, and a defensible report — delivered in 12 weeks. Federal pedigree. Structural independence.