How to Vet an Accounting Outsourcing Provider: A 15-Point Due Diligence Checklist

Introduction

The short answer: vetting an accounting outsourcing provider comes down to four things you can verify before you sign anything: their security posture, their team’s actual credentials, their delivery process, and their contract terms. Everything else is marketing.

Most firms skip this step. They pick a provider after a good sales call, a polished deck, and a promise of “bank grade security.” Three months later, the assigned bookkeeper has changed twice, the SOC 2 report that was mentioned in the pitch never actually arrives, and the SLA turns out to be a suggestion rather than a commitment.

This guide is a practical, 15-point due diligence checklist for CPA firms, accounting firm owners, and growing businesses evaluating an accounting outsourcing partner in 2026. It is built for people who need to make a real decision, not just read about best practices. Countsure works through this exact evaluation with prospective clients every week, so the questions below reflect what actually separates a dependable outsourcing partner from a risky one.

Key Takeaways

• Security evidence matters more than a badge. Ask for what a provider can actually show: a SOC 2 report if one exists, or verifiable controls such as employees on payroll, documented background checks, signed NDAs, and a controlled server environment.
  
• IRS Section 7216 is triggered by sending data outside the US. Disclosing return information to another preparer inside the US to help complete the return is generally allowed without consent; sending it to a preparer outside the US, especially for 1040 clients, is what actually requires a separate signed consent.
  
• Staff turnover predicts service quality. A provider with high annual turnover in its accounting division will cost you repeated ramp-up time, regardless of what the sales team promises.
  
• Written SLAs matter more than verbal assurances. Turnaround times, escalation paths, and communication cadence should all be documented, not implied.
  
• A pilot engagement is a legitimate request. A confident provider will offer a trial period before asking for a long-term contract.
  
• Pricing transparency separates strong providers from weak ones. Ask exactly what is included in the base fee and what triggers an increase.
  
• Contract exit terms deserve as much attention as onboarding terms. Look for reasonable notice periods and a documented transition plan if the relationship ends.
  
• Data ownership should never be ambiguous. Your firm, not the provider, should retain clear ownership of client work product and data at all times.
  

Why Due Diligence Matters More Than a Sales Call

The pressure to outsource is real. The U.S. Bureau of Labor Statistics projects roughly 124,200 job openings for accountants and auditors each year, on average, through 2034, and much of that demand is not being met by new graduates entering the profession. Firms are turning to outsourced and offshore teams to fill the gap, cover tax season peaks, and keep senior staff focused on advisory work instead of routine production.

That pressure can push firms into a rushed decision. A provider that looks strong in a 45 minute demo can still have unverified security claims, an undocumented onboarding process, or a contract that locks you in for 12 months with no exit ramp.

The stakes are higher than they used to be. Verizon’s 2026 Data Breach Investigations Report, based on analysis of more than 31,000 security incidents, found that breaches involving a third party reached 48% of the total, up 60% from the prior year. Your outsourcing provider is not a background vendor anymore. It is a direct extension of your firm’s security perimeter and, in the case of tax and accounting data, your regulatory exposure.

Skipping this process rarely saves time in the long run. A provider chosen without verification tends to reveal its gaps three to six months in, once a bookkeeper leaves mid engagement, a promised turnaround slips during your busiest week, or a data handling practice turns out to differ from what was described in the sales call. At that point, you are not just switching providers. You are re-onboarding a new team, re-explaining your workflow, and absorbing whatever went wrong with client-facing work in the meantime.

That is exactly what this checklist is built to catch before it becomes a problem.

The 15-Point Due Diligence Checklist

The 15 points below are grouped into four categories: security and compliance, team quality, process and scalability, and commercial terms. Work through them in order. If a provider cannot answer the first four clearly, the remaining eleven rarely matter.

Security, Compliance, and Data Protection

1. Does the Provider Hold a Verifiable SOC 2 Type II Report?

SOC 2 Type II is the report that matters, not Type I. A Type I report only confirms that security controls were designed correctly on a single date. Type II confirms those controls actually operated correctly over a review period, typically six to twelve months.

Ask to see the report itself, not a summary page or a badge on the provider’s website. A provider that says it is “SOC 2 compliant” without producing the report is often still in the process, without a completed examination.

Not every reliable provider has completed a formal SOC 2 examination, and that alone should not be an automatic disqualifier. What should be verifiable either way: whether the staff on your account are direct employees on payroll rather than short-term contractors, whether the provider runs documented background checks before anyone touches client data, whether staff sign confidentiality agreements or NDAs, and whether client work happens on a controlled, provider-managed server rather than personal devices. A provider that can walk you through these specifics, with or without a SOC 2 report, is showing you something real. You can see the specific controls Countsure applies on its data security.

2. Where Does Your Client Data Actually Live and How Is It Protected?

The correct answer is that data stays on the provider’s secure infrastructure, ideally through a virtual desktop environment, rather than being downloaded to individual laptops or local drives. Ask directly whether any client data ever touches a personal or unmanaged device.

Look for encryption at rest and in transit as a baseline, along with mandatory multi-factor authentication for anyone touching client systems. If MFA is described as optional or “recommended,” that is a gap worth pressing on.

It is also worth asking whether the provider uses any subcontractors or sub-vendors for part of your work, and if so, whether those subcontractors are held to the same security standards under a written agreement. A strong provider will have a clear answer here rather than needing to check.

3. How Does the Provider Handle IRS Section 7216 and Circular 230 Requirements?

IRC Section 7216 is triggered by disclosing a client’s return information to someone located outside the US, not by how much of the work that person does. Disclosing information to another preparer inside the US to help complete a return is generally allowed without separate consent. The rule that actually applies to most outsourcing arrangements is the offshore one, and it bites hardest on individual 1040 returns.

For 1040 clients specifically, that consent has to be a separate, signed document using the mandatory wording set out in Rev. Proc. 2013-14, not language folded into the engagement letter. Under 26 CFR 301.7216-3, the consent should also state how long it stays valid; if it does not, it is only effective for one year from the date it was signed, not renewed automatically. Sending a client’s Social Security number offshore requires both this consent and an adequate data protection safeguard maintained on both ends.

A provider experienced with U.S. accounting firms should be able to explain, without hesitation, how their workflow supports your Section 7216 consent process. Confidentiality itself is governed by Section 7216 and its companion civil penalty provision, Section 6713, together with the AICPA Code of Professional Conduct, not Circular 230, which covers practice standards before the IRS rather than data confidentiality. You can find the IRS’s own guidance in the Section 7216 information center if you want to review the requirement directly before your next conversation with a provider.

4. What Happens During a Data Breach or Security Incident?

Ask what actually happens if something goes wrong: who gets notified, within what timeframe, and what steps follow. A provider does not need a lengthy formal policy to answer this well, but a vague answer, or no answer, is worth taking seriously.

Cyber liability insurance is a bonus, not a baseline. Plenty of smaller, reliable providers do not carry it yet. What matters more day to day is whether client work happens on a controlled, provider-managed server rather than being scattered across personal laptops, since that alone removes a large share of the risk a breach response plan is meant to cover.

It also helps to ask how the provider limits exposure before an incident ever happens, through role-based access, employee background checks, and staff who are direct hires on payroll rather than rotating contractors, since accountability is easier to enforce with a provider’s own employees than with subcontracted labor.

Team Quality, Credentials, and Delivery Capability

5. What Credentials and U.S.-Specific Training Does the Team Actually Have?

Ask what percentage of the staff assigned to your account hold recognized credentials such as CPA, CA, CMA, or an equivalent professional qualification, versus staff who are entry-level hires without specific U.S. accounting training. Both can be valuable in the right role, but you need to know which you are getting for which task.

Ask how many hours of structured U.S. GAAP and IRS-specific training new hires complete before they touch client work, and how ongoing training is handled as rules change year to year. You can see the kind of professional background Countsure’s leadership team brings to this work on the About Countsure.

6. What Is the Provider’s Staff Turnover Rate in Its Accounting Division?

High turnover is one of the clearest predictors of inconsistent service. Ask for the annual turnover rate specifically within the team that would work on accounting and tax engagements, not the company-wide figure, since those numbers can differ significantly.

A provider proud of a low turnover rate will usually share the number without hesitation. Vague answers, or numbers that seem unusually low without supporting detail, are worth a second question.

It also helps to ask how turnover is measured. Some providers count only voluntary resignations, which can understate the real disruption to your account if internal transfers or terminations are left out of the figure.

7. Is Your Work Reviewed by Someone Before It Reaches You?

There should be a team lead or manager reviewing output before it lands in your queue for final review. If the person preparing your books or return sends work straight to you with no internal quality check, you are effectively doing the provider’s quality control for them.

Ask what the provider’s internal error rate target looks like, and how often it is actually measured against real delivery, not just stated as a goal. This review layer is also where most preventable errors get caught before they ever reach you, so its absence tends to show up later as extra rework on your end.

8. Does the Team Have Real Experience With Your Software and Industry?

A provider should be able to name the specific platforms their team works in daily, whether that is QuickBooks, Xero, Drake, Lacerte, or another tool your firm relies on. “We can learn any software” is a different claim from “we have staff with years of hands-on experience in it.”

Industry experience matters too. A provider that regularly supports CPA firms will understand tax season workflow pressure differently than one whose main experience is general small business bookkeeping. Countsure’s own approach to CPA firm support, including the specific software platforms and workflows the team is trained on, is outlined on the accounting and tax services for CPA firms.

Process, Technology, and Scalabili

9. Is There a Documented Onboarding and Transition Process?

Ask for a written timeline covering data migration, system access setup, and the point at which the provider takes over active work. A provider without a documented process is improvising your onboarding in real time, which is exactly when early mistakes tend to happen.

Ask what a typical onboarding timeline looks like for a firm your size, and what you are expected to provide on your end. Countsure walks new clients through this exact structure, which is detailed on the process FAQs.

A provider with a dedicated onboarding specialist, separate from the ongoing account team, generally moves through this phase with fewer dropped details than one that expects your assigned bookkeeper to handle setup and production work at the same time.

10. Are Turnaround Times Guaranteed in Writing?

Get specific numbers in the contract: how many hours for a monthly reconciliation, how many business days for an individual return, how many days for a business return during peak season versus off-season. If turnaround commitments only exist verbally, they generally are not enforceable when things get busy.

Ask what happens when a target is missed. A provider with a real SLA will have a defined escalation path or remedy. A provider without one is treating the SLA as a marketing document rather than a commitment.

11. What Does Ongoing Communication Actually Look Like?

Ask who your named point of contact is, and confirm that person is not the same individual doing the day-to-day production work. If your only contact is the bookkeeper handling your account, there is no real escalation path when something needs attention.

Expect a defined communication cadence, whether that is a dedicated messaging channel, scheduled status calls, or regular performance reviews once the engagement stabilizes. Email-only communication is generally a weak signal for an active outsourcing relationship.

Ask, too, how communication changes once the relationship moves past the initial ramp-up period, since some providers quietly scale back responsiveness once the contract is signed and the account feels secure.

12. Can the Provider Actually Scale for Tax Season or Peak Periods?

This is where many providers quietly fail. Ask what happens when several of their clients hit peak demand simultaneously. Do they maintain excess trained capacity, or does your work get pushed back because someone else’s deadline came first?

Ask directly about staff-to-client ratios during peak months, and whether capacity is reserved in advance or allocated on a first-come basis. Countsure’s approach to managing this exact seasonal surge is covered on the tax season capacity support.

It is also worth asking how far in advance you need to flag an expected volume increase for the provider to guarantee capacity, since same-week requests are rarely honored even by well-staffed providers.

Does This Checklist Change for CPA Firms vs. Growing Businesses?

The 15 points above apply to both audiences, but the weight each one carries shifts depending on who is asking.

CPA firms evaluating a provider for white-label client work should weigh points 5, 8, and 10 most heavily: staff credentials, tax software experience, and turnaround guarantees directly affect whether the firm can meet its own client deadlines and internal review standards. A missed SLA on the provider’s end becomes the firm’s missed deadline with its own client, so the margin for ambiguity is smaller.

A growing business outsourcing its own internal bookkeeping or tax preparation, without a CPA firm sitting in between, will generally weigh points 1 through 4 and points 13 through 15 more heavily: data security, IRS consent processes, and contract flexibility matter most, since the business is managing its own direct financial exposure rather than passing work through to end clients.

Either way, the security and compliance points should never be treated as optional, regardless of which side of this distinction your firm falls on.

Commercial Terms, Contracts, and Risk Protection

13. What Are the Contract Length and Exit Terms?

Favor month-to-month arrangements or short initial terms, generally 90 days or less, with a reasonable notice period for termination, such as 30 days. A 12-month lock-in with no trial option is a meaningful commitment to make before you have seen the provider’s actual work quality.

Read the fine print on auto-renewal clauses. Some contracts renew automatically for another full term unless cancelled within a narrow window, which can trap firms that intended to leave.

Also read the liability cap in the contract so you know it going in. Many outsourcing agreements, across the industry, cap liability well below the value of the work involved, so this is less about finding a specific number and more about knowing what recourse you actually have if something goes wrong, and planning your own review process around that instead of assuming the contract will cover it.

14. How Is Pricing Structured, and What Is Actually Included?

Understand whether pricing is per full-time-equivalent staff member, per client, per return, or hourly, since each model shifts risk differently. Ask what triggers a price increase and whether increases are tied to a defined, objective metric rather than an open-ended “we will let you know.”

Confirm what is bundled into the base price. Onboarding, initial training, standard software licenses, and management oversight should generally be included rather than billed as separate add-ons that inflate the real cost later. Countsure’s service and pricing structure is outlined on the packages.

15. Who Owns the Work Product, and What Happens If You Leave?

Your firm should retain clear, explicit ownership of all client data and work product at all times. This should be stated plainly in the contract, not left implied. If a provider retains any usage rights over work produced for your clients, that is a term worth negotiating out before signing.

Ask what transition support looks like if the engagement ends, including how long the provider commits to cooperating with a handover, whether they participate in transition calls, and how quickly access and data are fully returned or deleted. A provider unwilling to commit to transition terms in writing is often one that is counting on lock-in rather than performance to retain your business.

Putting the Checklist to Work: A Simple Scoring Approach

Score each of the 15 points on a simple scale from 0 to 3: 0 means the provider could not answer or the answer was unacceptable, 1 means partially acceptable, 2 means it meets expectations, and 3 means it exceeds them. Run the same scorecard across two or three providers so you are comparing them on identical criteria rather than on how polished each pitch felt.

Treat the four security and compliance points as a gate. A provider scoring below 2 on security evidence, data handling, IRS compliance readiness, or incident response should generally be eliminated regardless of how well it performs elsewhere, since a security gap is not something team quality or pricing can offset later.

A scorecard is a decision aid, not a replacement for judgment. Two providers can post similar total scores while differing sharply in the categories that matter most for your specific engagement, so review the category breakdown, not just the sum, before making a final call.

Example: A 14-person CPA firm evaluating three offshore bookkeeping providers ran each one through this exact scorecard. Two providers produced SOC 2 Type II reports and specific turnover figures within a day. The third took two weeks to respond and eventually admitted its SOC 2 process was “in progress.” That single data point, more than anything in the sales presentation, was what removed the third provider from consideration.

Choosing a Provider You Can Actually Verify

An accounting outsourcing relationship touches client data, tax deadlines, and regulatory exposure your firm cannot outsource away, even when the day-to-day production work is handled elsewhere. A 45 minute demo cannot tell you whether a provider’s SOC 2 report is real, whether its turnover rate is manageable, or whether its SLA has any teeth. This checklist can.

Due diligence does not end at signing, either. Revisit the same four categories annually, since certifications lapse, staff turn over, and contract terms can shift well after the relationship begins.

Countsure works with U.S. CPA firms and growing businesses through this exact evaluation process every week, with certified professionals trained in U.S. GAAP and IRS compliance, documented turnaround commitments, and signed confidentiality agreements behind every engagement.

Frequently Asked Questions

1. What is accounting outsourcing due diligence?

Accounting outsourcing due diligence is the structured process of verifying a provider’s security controls, staff credentials, delivery capability, and contract terms before signing an engagement. It typically involves requesting documentation such as a SOC 2 report, sample SLAs, and turnover figures rather than relying on verbal claims made during a sales process.

2. Is a SOC 2 report required for an accounting outsourcing provider?

No. SOC 2 is an attestation report issued by an independent CPA firm after an examination, not a certification, and there is no federal law that requires it. Many firms request it as one way to evidence security controls, but a provider without one can still demonstrate real security through measures such as employees on payroll, documented background checks, signed NDAs, and a controlled server environment.

3. How long should a due diligence review take before signing an outsourcing contract?

A thorough review generally takes two to four weeks, covering initial conversations, document review, reference calls, and scorecard comparison across two or three providers. Rushing this process to meet a deadline often costs far more time later if the provider turns out to be a poor fit.

4. What is a reasonable staff turnover rate for an accounting outsourcing firm?

Turnover rates vary by provider and by region, so there is no single universal benchmark, but a rate meaningfully above what the provider’s industry peers report is generally worth questioning further. Ask specifically about turnover in the accounting or tax division rather than the company-wide figure, since the two can differ significantly.

5. Do outsourcing providers need IRS consent to prepare tax returns offshore?

Yes. IRC Section 7216 is triggered once return information is disclosed to someone located outside the US, regardless of how much of the preparation work that person actually does. For 1040 clients, the consent must be a separate signed document using the wording required by Rev. Proc. 2013-14, and it stays valid for the period stated in the consent, or one year from the signature date if no period is stated. Firms remain responsible for compliance even when the actual preparation work is outsourced.

6. Should I request a pilot engagement before signing a full contract?

Yes, this is a reasonable and increasingly common request. A provider confident in its quality will typically offer a 30 to 90 day pilot with a limited number of clients before asking for a longer commitment, and a firm that refuses any trial period at all is worth a closer look.

7. What red flags suggest an accounting outsourcing provider is not ready for your firm?

Common red flags include an inability to produce an actual SOC 2 report, vague or shifting answers about staff turnover, verbal-only turnaround commitments with nothing in writing, a required 12-month contract with no trial option, and unclear language around who owns client work product and data.

8. How is outsourced accounting pricing typically structured?

Pricing generally follows one of a few models: per full-time-equivalent staff member, per client account, per return prepared, or an hourly rate, and the right model depends on the mix and volume of services involved. Ask what is bundled into the base price, since onboarding, training, and management oversight are sometimes billed separately in ways that increase the effective cost.

Related Blogs

• How to Choose the Right Outsourced Accounting Partner for Your US Business
  
• Top 10 Accounting Outsourcing Firms in the USA
  
• Why CPA Firms Are Outsourcing Bookkeeping and Tax Preparation in 2026