Does the Independent Security Study satisfy §1.132-5 on its own?

The ISS is one of two paths the regulation provides for establishing an overall security program. The study must be paired with consistent application of its recommendations, retained documentation, and periodic reassessment.

What happens if the IRS audits the executive's security perk?

The ISS is the foundational document examiners will request. A defensible study includes clear independence language, explicit reference to §1.132-5, documented facts and circumstances, and recommendations tied to identifiable risk.

Why don't you sell executive protection or other security services?

Because we cannot credibly study what we sell. The regulation's independence requirement exists for a reason. Our structure is our answer to it.

How long does a study take?

Standard engagements run twelve weeks from kickoff to delivery. Expedited delivery is available for compressed timelines driven by proxy filings, litigation events, or changes in executive status.

Can one study cover multiple executives?

Yes. A single governing study can document the employer's overall security program and address facts and circumstances executive by executive in structured appendices.

Who conducts the work?

Senior practitioners with federal protective, investigative, or intelligence experience — augmented by digital risk and OSINT analysts. Every engagement is led by a senior partner who signs the study.

What is an Independent Security Study?

An Independent Security Study is a formal, third-party report conducted under Treas. Reg. §1.132-5(m) that documents the facts and circumstances justifying an employer's executive security program. It defines the overall security program and establishes the defensible record required for the employer to exclude executive security benefits from the executive's taxable compensation as a working condition fringe benefit.

Who qualifies as an independent third party under §1.132-5?

The regulation requires the firm performing the study to be independent — meaning it does not sell executive protection, guard services, monitoring systems, or any of the security measures the study might recommend. A firm with a financial interest in the recommended security measures cannot credibly author an independent study of those measures. The independence requirement is structural, not just a disclosure obligation.

What triggers the need for an Independent Security Study?

An ISS is typically triggered by one of four events: a proxy filing season requiring perquisite disclosure analysis, an IRS audit or inquiry involving executive compensation, a board or compensation committee review of executive security perquisites, or a significant change in the executive's threat environment. Legal counsel and tax directors are usually the first to identify the need.

How is an Independent Security Study different from a security assessment?

A security assessment is an operational document focused on vulnerabilities and recommendations. An Independent Security Study is a regulatory compliance document that must also document a bona fide business-oriented security concern, assess risks objectively, make reasonable recommendations, and be prepared by an independent third party. The ISS is what the IRS examiner will request; the security assessment may inform it but does not replace it.

Can a company's existing security vendor conduct the Independent Security Study?

An existing security vendor may conduct the physical assessments that inform an ISS. The study itself, however, should not be authored by a party that sells the recommended measures. Many employers engage their existing vendor for operational assessments and a separate independent firm for the ISS itself. The two are complementary.

What specialized reports does an Independent Security Study engagement produce?

A full engagement produces specialized reports covering physical security (residential and corporate office assessments), digital risk (online footprint, OSINT, and data broker analysis), and PII exposure, along with stakeholder interviews and governance review. These reports are synthesized into the final Independent Security Study, which includes the regulatory determination and overall security program language.

How often should an Independent Security Study be updated?

Tax counsel typically treat an ISS as current for approximately three years. Reassessment is recommended sooner if material changes occur — including changes in the executive's threat environment, a significant public event (litigation, media exposure, activist attention), changes in residential or office location, or a change in executive status.

What is the IRS safe harbor for personal aircraft use under §1.132-5(m)(4)?

The regulation provides a safe harbor for personal flights on employer aircraft used in connection with a security program. The value of the flight is determined at 200% of the Standard Industry Fare Level (SIFL) rate rather than the full fair market charter rate. This safe harbor only applies when the security program meets the §1.132-5(m) requirements, including the Independent Security Study requirement.

Does the IRS and SEC treat executive security differently?

Yes. The IRS analyzes executive security under §132 to determine whether the benefit is excluded from taxable income as a working condition fringe. The SEC analyzes the same security expense under Item 402 of Regulation S-K to determine whether it must be disclosed as a perquisite in proxy filings. A benefit can simultaneously be a non-taxable fringe benefit under §132 and a disclosable perquisite under SEC rules. The two analyses are parallel but distinct.

What documentation does the IRS expect if it audits an executive security benefit?

Examiners typically request the Independent Security Study, evidence of consistent application across similarly situated executives, the employer's overall security program documentation, and any threat assessment or incident history relied upon. Studies that include clear independence language, explicit regulatory citations, documented facts and circumstances, and recommendations tied to identifiable risk have historically withstood examination.

ISS Independence

Why the Independence Requirement Disqualifies Most ISS Providers

By Senior Partner · April 2026 · 5 min read

The word "independent" appears in the name of the deliverable. It also appears as an explicit requirement in Treasury Regulation §1.132-5(m)(2)(iv)(A). The IRS uses it deliberately, and it means something specific - something that most ISS providers structurally cannot satisfy.

This matters more than it might appear. A study produced by a firm that fails the independence requirement isn't a weak ISS. It may not be a qualifying ISS at all.

What the regulation requires

Section §1.132-5(m)(2)(iv)(A) requires that the Independent Security Study be performed by an independent third party. The regulation doesn't define "independent" exhaustively, but the concept maps cleanly to what any attestation function requires: no financial interest in the outcome, no ongoing operational role in the subject of the study, no compensation that depends on what the study concludes.

Applied to an ISS, independence means the firm that performs the study cannot have a financial stake in the recommendations the study makes. If the firm that writes the study also sells, installs, or staffs the security measures the study recommends, that firm has a financial interest in recommending those measures. The conflict isn't hypothetical - it's structural.

Why most ISS providers fail this

Look at the firms currently offering ISS work. The list includes executive protection companies, corporate security consulting firms, risk management firms, and integrated security providers. Almost all of them offer services beyond the study itself: executive protection staffing, residential security installation, driver programs, TSCM sweeps, digital risk platforms, guard services.

Some are transparent about this. Others describe themselves as "independent" because the team that writes the ISS sits in a different division from the team that sells the protection services. That's not independence. That's an organizational chart.

The conflict matters for a specific reason that the regulation's own structure makes clear. An ISS firm that also sells executive protection has a financial interest in three things: qualifying borderline cases (more qualifications mean more downstream clients), recommending more extensive programs (more recommendations mean more services to sell), and renewing engagements indefinitely (an executive who always needs the study updated needs the firm's services continuously).

None of those interests align with producing an accurate, objective, proportionate study. They align with producing a study that generates downstream revenue.

The question that cuts through it

Before engaging any ISS provider, one question settles the independence issue quickly:

Do you sell, install, refer clients to, or derive any revenue from any of the security services you may recommend in the study?

A clear no is the only acceptable answer. Any hedging - "we have a separate division," "we only refer clients at their request," "we maintain a wall between the study team and the services team" - is a disclosure, not a denial. The conflict exists regardless of how it's managed internally.

The IRS doesn't have to formally disqualify a study on independence grounds to make it a problem on examination. An examiner who notes that the same firm conducted the study and staffed the executive protection program has grounds to scrutinize the study's conclusions more aggressively, to question whether the recommendations were proportionate to the documented concern, and to treat the independence language in the study as boilerplate rather than fact. That scrutiny is the last thing you want when a six-figure W-2 exclusion is under review.

What about using your existing security vendor?

A question that comes up regularly: can the firm already providing executive protection conduct the ISS?

The answer is no - not for the study itself.

Your existing security vendor can conduct physical assessments that inform an ISS. Site surveys, access control reviews, vulnerability assessments - those are inputs to the study. What the vendor cannot do is author the Independent Security Study, because the study is supposed to independently evaluate whether the program your vendor is running is appropriate. Having the vendor assess the adequacy of its own program isn't independence; it's a conflict of interest with a regulatory name attached to it.

The practical structure that works is this: your existing vendor continues its operational role, and an independent firm - one with no service relationship with you or your vendor - conducts the study. The two are complementary. The study evaluates the threat environment and defines the appropriate program. Your vendor implements and maintains it. Neither role interferes with the other.

What real independence looks like

Independence in this context has three components.

No downstream services. The firm that produces the study derives no revenue from the security measures the study recommends - not directly, not through affiliates, not through referral arrangements.

No ongoing operational role. The firm isn't managing, staffing, or supervising any element of the executive's security program outside of the study and any required re-evaluations.

No contingent conclusions. The firm's compensation isn't tied to what the study finds. A firm that gets paid more for a qualifying finding than a non-qualifying one isn't independent. Neither is one whose continued engagement depends on recommending ongoing services.

This firm does one thing: the study. We don't sell executive protection, residential security, driver services, digital monitoring, or any other measure we might recommend. We don't refer clients to vendors who provide those services. The study we produce is the only deliverable, and its conclusions reflect the facts - including the conclusion that a bona fide concern doesn't exist, when that's what the facts support.

That's not a marketing position. It's a regulatory requirement, and it's the only way to produce a study that holds up.

This post is for informational purposes and does not constitute tax or legal advice. Readers should consult qualified tax and legal counsel regarding the treatment of specific programs.

AVREN ADVISORY

Independent Security Studies under Treas. Reg. §1.132-5

We conduct the Independent Security Study required by Treas. Reg. §1.132-5. Physical security assessment, digital risk analysis, executive interviews, and a defensible report — delivered in 12 weeks. Federal pedigree. Structural independence.