Outsourcing bookkeeping offshore: a compliance checklist for CPA firms

1. Client confidentiality under the AICPA Code

Before you disclose confidential client information to a third-party service provider, the AICPA Code of Professional Conduct asks you either to get the client's specific consent or to have a contract with the provider that requires it to keep the information confidential (ET 1.700.040). Many firms do both. Check your state board's rules too.

The Code also expects you to be satisfied that the provider has the qualifications and skills for the work (ET 1.300.040). Your firm stays responsible for the result, so plan to supervise and review outsourced work as you would your own staff's.

2. The FTC Safeguards Rule

If your firm prepares tax returns, the FTC Safeguards Rule applies to it. You need a written information security program with a Qualified Individual in charge, multi-factor authentication and encryption of customer information. For service providers, the rule requires you to:

• choose providers that can keep customer information safe
• require those safeguards in your contract
• assess the provider periodically

If unencrypted customer information of 500 or more consumers is acquired without authorization, you must notify the FTC no later than 30 days after you discover it. IRS Publication 5708 has a template for the written plan.

3. Know when Section 7216 applies

Section 7216 of the Internal Revenue Code makes it a crime for a tax return preparer to disclose information furnished for, or in connection with, preparing a return without the taxpayer's consent. Information you hold only because of bookkeeping work is unlikely to be covered, but the line can blur, for example with year-end adjustments made for the return.

If an offshore team will see tax return information, get the client's written consent first:

• Disclosure to a provider outside the United States generally needs consent.
• For individual (Form 1040) clients the rules are strict: a separate signed document, the wording set out in Rev. Proc. 2013-14, and no opt-out consents.
• If Social Security numbers will be shared offshore without redaction, different consent wording applies, and both your firm and the provider need adequate data protection safeguards.

4. Keep client data in your systems

The lowest-risk set-up is for the provider to work inside your own QuickBooks Online or Xero subscriptions, through named logins you create, with 2-step verification, at an access level you choose and can remove at any time. Avoid emailing client records or storing them in folders the provider controls.

5. Put it in writing

Your engagement with the provider should cover confidentiality, data security requirements and incident notification, no subcontracting without your approval, turnaround and escalation, insurance, and what happens to access when the work ends. Ask for evidence of the provider's controls: a SOC report if it has one, or written answers to your security questionnaire.

How we work

We sign an NDA before any data is shared and work in your QuickBooks Online or Xero subscriptions through logins you control, on firm-owned computers with 2-step verification. Send us your security questionnaire and we'll complete it as part of onboarding. Our full list of controls is on our data security page.

How we support US firms →