Key takeaways
- Offshore support adds capacity, but your firm keeps professional responsibility for the work and for client data.
- Check four things: who does the work, how data is protected, how work is reviewed, and what the provider won’t do.
- Before sharing client information, meet the AICPA Code’s third-party service provider guidance, the FTC Safeguards Rule’s service-provider requirements and, for tax return information, IRC section 7216 consent rules.
- Start with a defined set of clients, measure quality, then widen the scope.
Why firms look offshore
For many small and mid-sized US firms, the bottleneck isn’t clients. It’s people. Experienced staff are hard to hire, busy season stretches everyone thin, and senior time gets spent on write-up and reconciliations instead of review and advisory work.
India has a deep pool of accountants trained in international practice, and its time zone means work handed off in the US evening can be prepared overnight. Done well, offshore support turns preparation work into a dependable overnight service. Done badly, it creates review headaches and real risk to client data. The difference is mostly decided before you sign.
1. Who will actually do the work?
Start with the people, not the pitch deck.
- Qualifications. Are the leaders qualified accountants, such as Chartered Accountants in India? Who supervises day to day?
- Experience with your work. Have they kept books in US companies’ files, in your software, at your clients’ level of complexity?
- A named team. Will the same people work on your clients each cycle, or is work spread across a pool?
- Continuity. What happens when someone leaves? How is knowledge about your clients documented and handed over?
2. How will client data be protected?
This is where vague answers should worry you. Ask for specifics, in writing.
- Access model. Will they work through user accounts you grant in QuickBooks Online, Xero or Zoho Books, or do they expect shared passwords? Can you remove access instantly?
- Data in transit and at rest. How do files move between you, and are they encrypted? Where is data stored, and on whose systems?
- People and devices. Who can see your data, how are devices secured, and is multi-factor authentication required?
- Incidents. How quickly will they tell you about a suspected breach, and what will they do?
- Retention and deletion. What happens to your data when the engagement ends?
- Independent assurance. If a provider claims certifications such as a SOC 2 report or ISO/IEC 27001, ask to see the report or certificate and its scope, not just a logo.
3. How is work reviewed before it reaches you?
The point of outsourcing is to save review time, not move it.
- Review layers. Is every deliverable checked by a second person before it’s sent?
- Checklists. Will they follow your checklists and workpaper format, or their own?
- Open items. How are questions and exceptions reported? A single, organized list beats a stream of emails.
- Measurement. How will you both know quality is improving? Review notes per file and turnaround time are simple, useful measures.
4. Will it fit the way your firm works?
- Software. Do they already work in the platforms your clients use?
- Communication. When can your staff reach them live? A little overlap in your morning or evening matters more than round-the-clock email.
- Visibility to clients. Will they work behind the scenes under your firm’s process, and contact clients only if you want them to?
- Boundaries. Are they clear about what they won’t do? An offshore provider that isn’t a US CPA firm shouldn’t offer attest services or represent clients before the IRS.
5. Know your professional obligations
Using a service provider doesn’t transfer your firm’s duties. Three sets of rules come up most often. This is a summary, not legal advice, so check the current text and your state board’s rules.
AICPA Code of Professional Conduct
The Code addresses third-party service providers in three places. Interpretation 1.150.040 asks members to inform clients, preferably in writing, before disclosing confidential client information to a service provider. Interpretation 1.700.040 asks members either to have a contractual agreement requiring the provider to keep information confidential, or to get the client’s specific consent. And interpretation 1.300.040 expects members to make sure the provider has the necessary qualifications and to plan and supervise its work.
FTC Safeguards Rule
Tax preparers and many accounting firms are covered by the FTC Safeguards Rule (16 CFR Part 314), which requires a written information security program. Section 314.4(f) requires taking reasonable steps to select service providers that can maintain appropriate safeguards, requiring those safeguards by contract, and periodically assessing them. IRS Publication 5708 explains how this applies to tax and accounting practices.
IRC section 7216 (tax return information)
If the work involves information furnished for preparing a tax return, Treasury Regulation section 301.7216-3 requires the taxpayer’s consent before that information is disclosed to a tax return preparer located outside the United States. Disclosing a Form 1040 filer’s Social Security number offshore carries additional conditions, so many firms redact SSNs before sharing anything.
6. Scope, pricing and exit
- Written scope. Which clients, which tasks, what turnaround and what “done” means.
- Pricing basis. Per task, per client, per hour or per dedicated person, and what triggers a change in price.
- Confidentiality terms. A written agreement that meets the obligations above.
- Exit. Notice periods, how work in progress is handed back, and written confirmation that your data is returned or deleted.
7. Start small, then scale
Begin with a handful of clients or one type of task. Agree how you’ll judge the results, such as review notes per file, turnaround and the quality of questions raised, and review them together after the first few cycles. Widen the scope once the work consistently meets your standard.
About BooksBridge. We’re a Chartered Accountancy firm in Kolkata that provides offshore bookkeeping, reconciliation, payroll and year-end support to US CPA firms. We wrote this checklist because it’s the one we’d want firms to use on us. See how we work with CPA firms.
Sources
- 26 CFR § 301.7216-3, Disclosure or use permitted only with the taxpayer’s consent (Legal Information Institute)
- 16 CFR § 314.4, Elements of the FTC Safeguards Rule (Legal Information Institute)
- IRS Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice
- The AICPA’s revised Confidential Client Information Rule (Journal of Accountancy)
- Considerations for tax return preparers outsourcing overseas (The CPA Journal)
This article is general information for US accounting firms. It is not legal, tax or accounting advice.