Does the Independent Security Study satisfy §1.132-5 on its own?

The ISS is one of two paths the regulation provides for establishing an overall security program. The study must be paired with consistent application of its recommendations, retained documentation, and periodic reassessment.

What happens if the IRS audits the executive's security perk?

The ISS is the foundational document examiners will request. A defensible study includes clear independence language, explicit reference to §1.132-5, documented facts and circumstances, and recommendations tied to identifiable risk.

Why don't you sell executive protection or other security services?

Because we cannot credibly study what we sell. The regulation's independence requirement exists for a reason. Our structure is our answer to it.

How long does a study take?

Standard engagements run twelve weeks from kickoff to delivery. Expedited delivery is available for compressed timelines driven by proxy filings, litigation events, or changes in executive status.

Can one study cover multiple executives?

Yes. A single governing study can document the employer's overall security program and address facts and circumstances executive by executive in structured appendices.

Who conducts the work?

Senior practitioners with federal protective, investigative, or intelligence experience — augmented by digital risk and OSINT analysts. Every engagement is led by a senior partner who signs the study.

What is an Independent Security Study?

An Independent Security Study is a formal, third-party report conducted under Treas. Reg. §1.132-5(m) that documents the facts and circumstances justifying an employer's executive security program. It defines the overall security program and establishes the defensible record required for the employer to exclude executive security benefits from the executive's taxable compensation as a working condition fringe benefit.

Who qualifies as an independent third party under §1.132-5?

The regulation requires the firm performing the study to be independent — meaning it does not sell executive protection, guard services, monitoring systems, or any of the security measures the study might recommend. A firm with a financial interest in the recommended security measures cannot credibly author an independent study of those measures. The independence requirement is structural, not just a disclosure obligation.

What triggers the need for an Independent Security Study?

An ISS is typically triggered by one of four events: a proxy filing season requiring perquisite disclosure analysis, an IRS audit or inquiry involving executive compensation, a board or compensation committee review of executive security perquisites, or a significant change in the executive's threat environment. Legal counsel and tax directors are usually the first to identify the need.

How is an Independent Security Study different from a security assessment?

A security assessment is an operational document focused on vulnerabilities and recommendations. An Independent Security Study is a regulatory compliance document that must also document a bona fide business-oriented security concern, assess risks objectively, make reasonable recommendations, and be prepared by an independent third party. The ISS is what the IRS examiner will request; the security assessment may inform it but does not replace it.

Can a company's existing security vendor conduct the Independent Security Study?

An existing security vendor may conduct the physical assessments that inform an ISS. The study itself, however, should not be authored by a party that sells the recommended measures. Many employers engage their existing vendor for operational assessments and a separate independent firm for the ISS itself. The two are complementary.

What specialized reports does an Independent Security Study engagement produce?

A full engagement produces specialized reports covering physical security (residential and corporate office assessments), digital risk (online footprint, OSINT, and data broker analysis), and PII exposure, along with stakeholder interviews and governance review. These reports are synthesized into the final Independent Security Study, which includes the regulatory determination and overall security program language.

How often should an Independent Security Study be updated?

Tax counsel typically treat an ISS as current for approximately three years. Reassessment is recommended sooner if material changes occur — including changes in the executive's threat environment, a significant public event (litigation, media exposure, activist attention), changes in residential or office location, or a change in executive status.

What is the IRS safe harbor for personal aircraft use under §1.132-5(m)(4)?

The regulation provides a safe harbor for personal flights on employer aircraft used in connection with a security program. The value of the flight is determined at 200% of the Standard Industry Fare Level (SIFL) rate rather than the full fair market charter rate. This safe harbor only applies when the security program meets the §1.132-5(m) requirements, including the Independent Security Study requirement.

Does the IRS and SEC treat executive security differently?

Yes. The IRS analyzes executive security under §132 to determine whether the benefit is excluded from taxable income as a working condition fringe. The SEC analyzes the same security expense under Item 402 of Regulation S-K to determine whether it must be disclosed as a perquisite in proxy filings. A benefit can simultaneously be a non-taxable fringe benefit under §132 and a disclosable perquisite under SEC rules. The two analyses are parallel but distinct.

What documentation does the IRS expect if it audits an executive security benefit?

Examiners typically request the Independent Security Study, evidence of consistent application across similarly situated executives, the employer's overall security program documentation, and any threat assessment or incident history relied upon. Studies that include clear independence language, explicit regulatory citations, documented facts and circumstances, and recommendations tied to identifiable risk have historically withstood examination.

Audit Defense

Example 5 and the Consistency Requirement: How ISS Programs Fail on Audit

By Senior Partner · April 2026 · 6 min read

The regulation that governs the working condition fringe exclusion for executive security includes its own cautionary tale. It's called Example 5, it appears in §1.132-5(m)(8), and it describes the most common way a well-intentioned ISS program fails on IRS examination.

Understanding it is not optional if you're running one of these programs.

What Example 5 actually says

The scenario is straightforward. A company commissions an Independent Security Study. The study concludes that 24-hour protection isn't necessary and recommends two specific components: workplace security and ground transportation security. Both are documented in the study. Both are supposed to be implemented.

The company implements only the ground transportation piece. The workplace security recommendations go unfunded, understaffed, or simply unimplemented.

The IRS examines the program.

The result: no overall security program is deemed to exist. The ground transportation benefit - the piece the company did implement - is taxable compensation to the executive. The W-2 exclusion the company had been taking collapses. Multiple years of prior returns are potentially affected.

That's it. One gap between what the study said and what the company actually did, and the entire tax position goes with it.

Why this keeps happening

Example 5 isn't a theoretical failure mode. It's a description of how these programs actually break down in practice, and the structural reason it happens is consistent across companies.

Security programs are run by security teams. Tax positions are maintained by tax teams. In most companies, those functions have minimal overlap. The security director's job is to implement the program the board approved and the budget supports. The tax director's job is to classify compensation correctly and keep the W-2s clean. Neither has automatic visibility into what the other is doing.

The study gets completed and filed. The recommendations go to the security team. Some get implemented immediately. Others get deferred because the budget runs out, because a vendor relationship changes, because the executive objects to a particular measure, or because a facilities project takes priority. Nobody tells the tax director that the workplace access controls from page 14 of the study never got installed.

A year passes. Two years. The W-2s go out with the working condition fringe exclusion applied. The study is in the file. From the tax team's perspective, everything looks clean.

Then the IRS examines the program, asks what was actually implemented, and compares the answer to what the study recommended. The gap surfaces.

What the regulation requires

The consistent application requirement is in §1.132-5(m)(2)(v). It says the employer must apply the specific security recommendations from the study on a consistent basis. Not most of them. Not the ones that were convenient. All of them, consistently, from the time the study is implemented.

"Consistent" has a time dimension too. Gaps in implementation, even temporary ones, create exposure. If a measure was implemented for two years and then quietly dropped when the executive pushed back, the exclusion for the period after the gap is at risk.

The regulation also requires that the overall security program be evaluated periodically to determine whether the bona fide business-oriented security concern still exists. A study done in 2022 and never revisited is a study the IRS can challenge as stale by 2025 or 2026. Trigger-based reassessment - when the executive's role changes, when a material threat event occurs, when the security measures change - is the operational standard. A full re-evaluation every three years is a reasonable baseline absent specific triggers.

What a defensible program looks like from the consistency standpoint

The companies that survive IRS examination on this issue have one thing in common: they treat the ISS recommendations as a compliance obligation, not a checklist item.

That means a named owner for implementation - someone whose job it is to know what the study recommends and whether each item is in place. It means contemporaneous documentation of what was implemented and when, not a reconstruction after an audit letter arrives. It means a process for flagging when a recommended measure changes, so the tax team can decide whether the study needs to be updated or the exclusion needs to be revised.

Our engagement file includes an implementation tracker that maps each recommendation to a responsible party and documents the evidence of consistent application. That tracker isn't a courtesy - it's the document that bridges the study and the tax position when someone asks.

When measures change - when the security team adjusts the program for legitimate operational reasons - the study should be updated before the next W-2 cycle reflects a changed program. Updated studies aren't a sign of weakness; they're a sign that the company is running a live compliance process rather than a one-time document exercise.

What to do if you're already running a program

If your company commissioned an ISS and has been applying the working condition fringe exclusion, the question worth answering now is whether everything in that study is actually in place.

Pull the study. List every recommendation. Match each one to current implementation. If there are gaps, document when they opened and assess whether the exclusion for the affected periods is defensible.

If the gaps are significant, the honest path is to either restore the measures and update the study, or adjust the W-2 treatment going forward and consult with tax counsel about the prior years. Neither is an attractive option, but both are better than having the IRS surface the gap on examination.

If you're not sure what the study says or whether the program matches it, that's the conversation to have before the W-2 cycle closes.

This post is for informational purposes and does not constitute tax or legal advice. Readers should consult qualified tax and legal counsel regarding the treatment of specific programs.

AVREN ADVISORY

Independent Security Studies under Treas. Reg. §1.132-5

We conduct the Independent Security Study required by Treas. Reg. §1.132-5. Physical security assessment, digital risk analysis, executive interviews, and a defensible report — delivered in 12 weeks. Federal pedigree. Structural independence.