Sharing client data with an outside provider, done properly
Before a CPA firm shares client information with an outside provider, the AICPA Code expects it to tell clients and protect confidentiality.
Section 7216 also requires signed consent before tax return information goes to a preparer outside the United States. SF Business Solutions can work inside your firm's own systems, so client data stays under your control.
What the AICPA Code asks of your firm
The AICPA Code of Professional Conduct covers outside providers in three places. You should make sure the provider has the qualifications and skills for the work. You should tell the client, preferably in writing, that a third-party provider may work on the engagement before sharing their confidential information; an engagement letter clause usually does this. And before disclosing confidential information you need either a confidentiality agreement with the provider or the client's specific consent. Many firms do both.
Section 7216 and offshore tax work
For tax return information, Internal Revenue Code Section 7216 adds a stricter rule. If the preparer receiving the information is outside the United States, the taxpayer must sign a consent before you disclose it, using the wording in Revenue Procedure 2013-14. Social Security numbers can only be disclosed offshore with that consent and adequate data protection safeguards at both firms. Our team is distributed across the US and internationally, so plan for this consent with any work you send us.
How access can work with us
We can work inside your systems rather than receiving copies of client data. You add our accountants as users on client QuickBooks Online or Xero files and in your document portal, with the permissions you choose, and you can remove them at any time.
Ask us for our written confidentiality terms before you share any client information, and put them next to your engagement letter wording so the two match.
Giving an outsourced bookkeeper access safely
Use each platform's own user roles rather than sharing your credentials: invite the bookkeeper as an accountant user in QuickBooks Online or a standard or adviser user in Xero, turn on multi-factor authentication, and review the user list whenever someone leaves. Never share a login, and keep documents in your portal instead of email.
Questions to ask any provider
Ask for their written confidentiality terms, how staff access client systems, whether devices are company-managed, what happens to data when the engagement ends, and, if they claim SOC 2, a copy of the current SOC 2 Type II report with its exceptions. Get the answers in writing and keep them with the engagement file.
How to start
Three steps. The first one is free.
- 1
Book a free consult
A 1-hour call about your books, your software and what you need.
- 2
Give us access
Invite us to QuickBooks Online or Xero and share your bank and card statements.
- 3
We take it from there
Cleanup first if you are behind. Then we close each month between the 5th and 15th of the following month, depending on your documents.
SF Business Solutions is very diligent and responsive. I can tell they are passionate about their work, which I particularly appreciate about them. My project was rather complex but they managed to get it done according to my needs.
Do CPA firms have to tell clients they use an outsourcing provider?
Yes. The AICPA Code expects you to tell clients, preferably in writing, before sharing their confidential information with a third-party provider.
Is client consent needed to use offshore tax preparers?
Yes. Section 7216 requires the taxpayer's signed consent before tax return information is disclosed to a preparer outside the United States.
How should I give an outsourced bookkeeper access to QuickBooks?
Invite them as their own accountant user with the permissions they need, turn on multi-factor authentication, and remove the user when the work ends. Never share your login.
What confidentiality agreement should I have with an offshore provider?
A written agreement covering confidentiality, who may access data, how it is stored and returned, and what happens at the end of the engagement.
Which outsourced accounting providers are SOC 2 compliant?
Ask each provider for its current SOC 2 Type II report and read the exceptions. If a provider has none, ask which controls it uses instead and get them in writing.
Related
Hand us this month’s books.
Pick a day for a free 1-hour consult.