Qualified Individual and WISP setup
Name your QI, set roles, and start the WISP binder or folder.
Done with you
Build your Safeguards Rule program in-house, with an expert guiding every step
Guided implementation is for dealerships that want their own manager to be the Qualified Individual, but don't want to figure out the rule alone. You get a clear roadmap, one-on-one sessions on your schedule, and templates that turn each step into part of your WISP.
Learn it. Build it. Keep it. · Online nationwide, on-site in the Carolinas
Who guided implementation is for
- Dealer principals who want compliance handled in-house
- Managers named as the dealership's Qualified Individual
- Stores that started the program but stalled
- Busy teams that can't keep up with a fixed class schedule
- Dealers who want to understand the program before outsourcing it
How it works
- Gap assessmentWe review your store against every requirement and you get a written report of gaps, ranked by risk, with a checklist. Then you decide whether to continue with guided sessions or work the checklist yourself.
- One-on-one sessionsEach session covers one part of the rule: what it requires, how to put it in place at your store, and how to document it.
- Implement between sessionsYour team does the work with a checklist, a WISP section template, and a list of records to keep. Questions come to me anytime.
- Book the next step when you're readyBook your next session before you hang up, or when your schedule allows. Keep going until your program is in place.
The roadmap: what you'll build, step by step
Every dealership's order is a little different. This is the typical path, starting with the steps that reduce the most risk and get something on paper fastest.
Where your customer data lives
Inventory the DMS, CRM, email, lender portals, deal jackets, and file cabinets.
Individual logins and MFA
End shared logins and turn on multi-factor authentication on every system with customer data.
Security off the computer
Locked files and F&I offices, monitors turned away, logging out, shredding, and clearing old registrations and paperwork out of trade-ins.
Email security and wire fraud
Spotting phishing, call-back rules for payment changes, and basic email protections.
Staff training
Train your team and keep the attendance records the rule expects you to have.
Vendors and service providers
List every vendor that touches customer data, collect their security information, and check contracts.
The written risk assessment
Turn what you've found into the formal risk assessment your WISP is built on.
Encryption, retention, and disposal
Encrypt laptops and data, and stop keeping customer information longer than allowed.
Incident response plan
Write the plan, run a short tabletop exercise, and learn the FTC notification rule.
Monitoring and testing
Logging, vulnerability scans, penetration tests, and change management.
Annual report and review
Your QI's written report to ownership, and a review of the finished WISP.
Dealers with customer information on fewer than 5,000 consumers are exempt from parts of steps 8, 10, 11, and 12. See the small-business exemption.
What you get with every session
- A one-page checklist of what to do next
- A fill-in-the-blank WISP section template
- A list of the records to keep as proof
- 3 days to ask questions about what we covered
- An email recap of every follow-up call, for your files
Pricing
You pay for the sessions you book. There's no long-term contract. Contact me for current rates and a rough estimate of total time for a store your size.
Your dealership owns the program. Your Qualified Individual and team carry out the work. ROI Compliance provides guidance, templates, and answers. If you decide you'd rather hand the QI role off, you can move to a Qualified Individual plan at any point.
Questions between sessions
After each session, you have 3 days to reach out with questions about the material we covered. Send me an email with your question, and we'll handle it the way that works best for you: I'll answer by email, or we'll set up a time to talk by phone. After every call, I send a short email recap so you have a written record for your files.
Support covers guidance and clarification. Larger work, like reviewing a full policy or a new part of your WISP, is handled in a session.
Guided implementation FAQ
Can a dealership have an in-house Qualified Individual?
Yes. The Safeguards Rule allows the Qualified Individual to be an employee. The rule doesn't require a specific degree or certification, but the person must be able to oversee and enforce the program. Many dealers choose a manager who knows the store's systems and the F&I process.
How long does guided implementation take?
It depends on the size of the dealership and how much is already in place. Because sessions are booked on your schedule, you can move as fast or as slowly as your store allows. Most of the work happens between sessions, when your team puts each step in place.
Is there a long-term contract?
No. You book sessions when you're ready for the next step. There is no long-term contract. An optional monthly support plan is available between sessions.
Who is responsible for compliance during guided implementation?
Your dealership and its Qualified Individual own the program and carry out the work. ROI Compliance provides guidance, templates, and answers. If you later want ROI Compliance to take over the Qualified Individual role, you can move to a QI plan.
Can sessions be done remotely?
Yes. Sessions run over Teams or Zoom for dealerships anywhere in the United States. On-site sessions are available in the Carolinas.
Ready to start your program?
Start with a gap assessment. You'll see exactly where your store stands, then decide whether to continue with guided sessions. Not sure yet? Book a short intro call.