Co-sourcing accounting is a model where your own finance staff keep ownership of the books and the sign-offs, while an outside provider performs a defined share of the work under your direction. You keep a smaller internal team and add external capacity for the tasks that are heavy on volume or need skills you do not hold in-house.
The difference from full outsourcing is where responsibility sits. In co-sourcing accounting, an internal owner plans the work, reviews what comes back and answers for the result. This guide covers how to divide tasks, a responsibility matrix you can adapt, the professional rules that shape the split for CPA firms and public companies, and a worked example of how the hours move.
The term comes from internal audit, where it has a formal definition. The Institute of Internal Auditors' Global Internal Audit Standards, effective January 9, 2025, define fully outsourcing as contracting the entire internal audit function, while "partially outsourcing (also called 'cosourcing') indicates that only a portion of the services are outsourced." The same Standards say they apply "whether an organization employs internal auditors directly, contracts them through an external service provider, or both," and that "the board retains the responsibility to support and oversee the internal audit function."
That idea carries over cleanly to accounting and finance. A company or a CPA firm can keep its controller, senior reviewers and client relationships in-house, and contract a partner for transaction processing, reconciliations, close support or tax return preparation. The outside team works inside your systems and your calendar. Your people still own the close and the financial statements.
If you are weighing a full handover of the finance department instead, our ultimate guide to outsourcing your company's finance department covers that route.
Both models use an outside provider. They differ in who directs the work and who holds the knowledge.
| Question | Co-sourcing | Full outsourcing |
|---|---|---|
| Who owns the process and the calendar | Your internal lead | The provider, within the contract |
| Who reviews and approves output | Your staff, before anything is final | Mostly the provider, with your sign-off at the end |
| Where process knowledge lives | Shared, with documentation you control | Largely with the provider |
| Typical scope | Defined tasks or phases of a process | An entire function |
| Effort needed from your team | Regular review and coordination time | Less day-to-day time, more contract oversight |
| Exit difficulty | Lower, because your team still runs the process | Higher, because knowledge must be transferred back |
Co-sourcing suits teams that want to keep a strong internal finance or accounting function and need extra capacity or specialist skills. Full outsourcing suits teams that do not want to run the function at all. Many organizations start with co-sourcing for one process and expand later; a 30-day accounting outsourcing pilot is a sensible way to test a partner on a small scope first.
The useful test is whether a task depends on judgment about your business or on consistent execution of a documented procedure. Procedure-driven work moves well. Judgment-driven work stays.
Work that usually moves to a co-sourcing partner:
Work that usually stays with your internal team:
For CPA firms, the same split applies at the engagement level. Our breakdown of client bookkeeping workflow for CPA firms goes task by task through what to keep in-house and what to send offshore.
A written matrix stops tasks from falling between the two teams. The version below uses the standard RACI labels: R is responsible for doing the work, A is accountable for the result and approves it, C is consulted before or during the work, and I is informed after it is done. Each row has exactly one A, and in a co-sourcing model that A sits with your internal team.
| Activity | Internal finance lead | Internal staff | Co-sourcing partner |
|---|---|---|---|
| Month-end close calendar and task list | A, R | C | C |
| AP entry and payment run preparation | A | C | R |
| Payment approval and release | A, R | I | I |
| Bank and card reconciliations | A | C | R |
| Reconciling item investigation over threshold | A | R | C |
| Accruals and recurring journal entries | A | C | R |
| Non-routine entries, estimates and reserves | A, R | C | I |
| Account review and close sign-off | A, R | R | I |
| Management reporting package | A | R | C |
| Tax return first draft | A | C | R |
| Tax return review and signature | A, R | C | I |
| Process documentation and checklists | A | C | R |
| Vendor master and bank detail changes | A, R | I | I |
| User access to accounting systems | A, R | I | I |
Adjust the rows to your own processes. Two rules are worth keeping whatever you change. The partner should never hold final approval over cash movements or system access, and every task the partner performs should have a named internal reviewer. For the service levels that sit behind each row, see our guide to offshore accounting SLA clauses.
A CPA firm that brings in an outside team to help serve clients is using a third-party service provider under the AICPA Code of Professional Conduct. Three interpretations matter most.
Under ET 1.150.040, "before disclosing confidential client information to a third-party service provider, the member should inform the client, preferably in writing, that the member may use a third-party service provider." If the client objects, the member should either not use the provider for that work or decline the engagement. Our page on the engagement letter outsourcing clause covers how firms introduce the change to existing clients.
Under ET 1.300.040, "the member must adequately plan and supervise the third-party service provider's professional services so that the member ensures that the services are performed with competence and due professional care." That requirement matches the co-sourcing split: the CPA firm directs and reviews, and the provider performs.
Under ET 1.700.040, before disclosing confidential client information, the member should either enter into a contract with the provider to maintain confidentiality, with reasonable assurance that it has procedures to prevent unauthorized release, or obtain specific client consent.
The FTC's Safeguards Rule treats "an accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution under 16 CFR 314.2. The rule's information security program requirements at 16 CFR 314.4(f) include overseeing service providers. Paragraph (f)(2) calls for "Requiring your service providers by contract to implement and maintain such safeguards," and paragraph (f)(3) calls for "Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards." A co-sourcing partner that touches client tax data falls inside that oversight duty. Our vendor risk assessment guide sets out the due diligence steps.
For SEC registrants, 17 CFR 240.13a-15 requires management, with the principal executive and principal financial officers, to evaluate the effectiveness of internal control over financial reporting as of the end of each fiscal year. The rule places that evaluation with management, so controls a co-sourcing partner performs belong within the scope management evaluates.
Where the co-sourced work is internal audit itself, the IIA Standards apply directly. They list contracting with an external service provider among the options when internal resources are insufficient, and note that "external service providers may provide specialized skills, complete special projects, or perform engagements."
The figures below are illustrative assumptions for a hypothetical company, chosen to show the method. Replace them with your own time data.
A company's finance team has three people. After meetings, training and leave, each has about 110 hours a month for finance work, giving 330 hours of internal capacity. The team's monthly workload is 400 hours:
| Task area | Monthly hours | Hours moved to partner |
|---|---|---|
| Transaction processing (AP, AR, cash posting) | 150 | 130 |
| Bank and card reconciliations | 60 | 50 |
| Close entries, accruals and fixed assets | 70 | 30 |
| Payroll review and benefit accruals | 20 | 0 |
| Management reporting and variance analysis | 60 | 0 |
| Budget, forecast and lender reporting | 40 | 0 |
| Total | 400 | 210 |
Before co-sourcing, the workload exceeds capacity by 70 hours a month (400 minus 330), which shows up as late closes and overtime.
After co-sourcing, 210 hours move to the partner. Co-sourcing still costs internal time, so the example adds two items back to the internal load:
The internal workload becomes 400 minus 210, plus 31.5, plus 6, which is 227.5 hours. Against 330 hours of capacity, the team now has 102.5 hours of headroom each month. The partner carries 52.5% of the original task hours, while all reporting, forecasting and payroll review stay in-house.
Two lessons come out of the arithmetic. The review and coordination time is real and should be budgeted from the start; teams that leave it out overestimate the capacity they gain. The freed hours also need a plan, such as a faster close or work the team currently turns away. Our article on how to measure time savings from outsourcing explains how to track the before and after properly.
Map the work first. List every recurring task with its monthly hours, the person who does it and the person who reviews it. This baseline feeds both the responsibility matrix and the hours calculation.
Choose the first scope narrowly. Reconciliations or AP processing are common starting points because they are rule-based and easy to check. Expand once accuracy and turnaround meet the agreed levels.
Document before you hand over. Write procedures, account-level notes and close checklists that the partner can follow without verbal explanation. Our outsourcing knowledge transfer plan sets out a step-by-step sequence.
Set access by role. Give the partner the system permissions its rows in the matrix require and no more. Keep payment release, vendor master changes and user administration with internal staff.
Agree service levels and review points. Define turnaround times, error thresholds, escalation contacts and the internal reviewer for each deliverable.
Review the arrangement on a schedule. Compare actual hours, error rates and close timing against the baseline every quarter and adjust the scope. A pre-launch outsourcing readiness checklist for CPA firms helps confirm the basics are in place before the first month.
The most frequent failure is unclear ownership. When nobody internal is named as accountable for a process, review slips and errors reach the financial statements. The matrix above exists to prevent that.
A second problem is treating the partner as a black box. If your team stops understanding how a reconciliation is built, you lose the main advantage co-sourcing has over full outsourcing, which is that you can take the work back at any time. Keep documentation in your own systems and rotate internal reviewers through the partner's work.
A third is skipping the compliance steps for client data, such as written client notice and confidentiality contracts. Our article on accounting outsourcing mistakes and why CPA firms fail covers these and other implementation errors.
What is co-sourcing in accounting? Co-sourcing accounting is an arrangement where an outside provider performs part of the accounting or finance work while your internal team keeps ownership, review and approval. The IIA describes the same idea in internal audit as partial outsourcing, where only a portion of the services is contracted out.
Is co-sourcing cheaper than hiring? It depends on your workload, the scope moved and the provider's pricing. Build an hours model like the worked example above, add internal review and coordination time, and compare the cost of the partner's hours against the fully loaded cost of the staff you would otherwise hire.
Do CPA firms need client consent to co-source work? Under AICPA ET 1.150.040, a member should inform the client, preferably in writing, before disclosing confidential client information to a third-party service provider. Under ET 1.700.040, the member should also either have a confidentiality contract with the provider or obtain specific client consent.
Who is responsible for errors in co-sourced work? Your organization remains responsible for its financial statements and client deliverables. For CPA firms, ET 1.300.040 requires the member to plan and supervise the provider's work, so review of the partner's output is a requirement and should be scheduled into every engagement.
Can co-sourcing work for internal audit? Yes. The IIA Global Internal Audit Standards apply whether internal auditors are employed directly, contracted through an external service provider, or both, and the board retains responsibility to support and oversee the function.
Madras Accountancy works alongside in-house finance teams and CPA firms on bookkeeping, reconciliations, close support, tax return preparation and audit support, with your staff keeping review and sign-off. To talk through which tasks could move and how the split would work, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
