Switching accounting outsourcing providers works best as a planned 60 to 90 day project: export and test your data before you give notice, collect fresh Section 7216 consents if the new team sits outside the United States, run both providers in parallel for a few weeks, then shut off every login the old provider held. The legal pieces that matter most are IRS record retention, the consent rules for tax return information, and the FTC Safeguards Rule duty to oversee service providers.
This guide is written for US CPA firms and finance teams switching accounting outsourcing providers after quality, turnover or responsiveness problems. It covers when to move, what to pull out of the old relationship, how long the records you inherit must be kept, and what the compliance file should hold once the new provider starts.
Each month of weak output adds review hours for your own staff. These patterns usually mean the problem is structural:
If the issue is a gap in the contract itself, such as no turnaround targets or no service credits, fix that in the next agreement. The clauses in our guide to offshore accounting SLA terms that prevent quality slippage give you measurable standards to hold the new provider to. To put a number on what the current arrangement is costing you, the accounting outsourcing ROI calculator compares what you expected from the engagement with what you are getting.
Security failures justify starting immediately, whatever the season.
The table below is a typical schedule for a mid-size bookkeeping and tax support engagement. Larger engagements run longer.
| Days | Phase | Main outputs |
|---|---|---|
| 1 to 15 | Audit and contract review | Scope inventory by client, list of data locations, notice and exit terms from the current contract |
| 16 to 30 | Data export and new provider setup | Tested backups, new contract signed, consents collected, new user accounts created with least-privilege access |
| 31 to 60 | Parallel run | Both providers process the same period; your reviewers compare outputs and log differences |
| 61 to 75 | New provider leads, you review | Old provider winds down; your team reviews new output at full depth |
| 76 to 90 | Cutover and closeout | Old access revoked and logged, data return or destruction confirmed in writing, oversight file complete |
Avoid starting a transition between January and the April filing deadline. Your reviewers are at capacity and any dip in quality lands on clients during the busiest weeks of the year. May through August is usually the cleanest window for firms with a calendar-year tax practice, because there is time to finish the parallel run before extension season and year-end close.
Write down exactly what the current provider does for each client. "Bookkeeping" is too vague. List whether they handle bank reconciliations, payables, receivables, payroll processing, month-end close, financial statement preparation or tax return preparation, and for which entities. This inventory becomes the statement of work for the new provider and the checklist for the parallel run.
Also capture undocumented knowledge, such as client preferences, recurring journal entries and unusual software settings. Your own reviewers usually hold most of it.
Export everything before you give notice. Once notice is sent, some contracts allow the provider to cut access quickly.
What to export:
Test what you export. Restore at least one backup per client into a clean environment, confirm that reconciled balances match the live ledger, and check that the date range is complete.
Read the ownership clause. Many outsourcing agreements say client data and work product belong to the firm, while some providers keep rights to their own templates and checklists. Know what you are entitled to before the exit conversation. Our accounting outsourcing contract template shows how exit, data return and ownership terms are usually drafted.
Revoke access on a log. Build a list of every credential the old provider held: ledger logins, payroll portals, tax software seats, VPN or virtual desktop accounts, file-sharing folders, shared mailboxes and multi-factor devices. Disable each one on the cutover date and record who did it and when. The FTC Safeguards Rule requires access controls that "Authenticate and permit access only to authorized users" and that "Limit authorized users' access only to customer information that they need to perform their duties and functions" (16 CFR 314.4(c)(1)). A former vendor with a live login fails both tests. For a fuller control list, see our data security checklist for offshore accounting partnerships.
Get return or destruction in writing. Ask the old provider to certify that copies of client data on its systems have been returned or securely deleted, and keep that certificate in the engagement file.
When the work moves, the retention clock does not reset. The firm and its clients still need the underlying records for as long as the IRS can examine the return they support. The IRS sets out the general periods on its How long should I keep records page:
Assume a client's 2025 Form 1040 was filed on April 15, 2026, and your old provider also prepared the client's third quarter 2025 Form 941, due October 31, 2025, with the tax paid on time. Because the return was filed on its due date, the income tax periods run from April 15, 2026.
| Record | Start date | Period | Keep until at least |
|---|---|---|---|
| 2025 income tax records, general rule | April 15, 2026 | 3 years | April 15, 2029 |
| Same records if more than 25% of gross income was omitted | April 15, 2026 | 6 years | April 15, 2032 |
| Records supporting a 2025 bad debt deduction | April 15, 2026 | 7 years | April 15, 2033 |
| Q3 2025 employment tax records | October 31, 2025 | 4 years | October 31, 2029 |
These are the IRS floors. State rules, client contracts, professional standards and insurance requirements may set longer periods, and records for property basis need to be kept until the period closes for the year the property is sold. Build the retention date into your document index at the moment of export so nobody has to reconstruct it later.
The Safeguards Rule pulls in the other direction for data you no longer need. It requires procedures to dispose of customer information "no later than two years after the last date the information is used," with exceptions where the information is needed for business operations or where law requires you to keep it (16 CFR 314.4(c)(6)). In practice, keep what the retention schedule requires in your own systems, and make sure the old provider holds nothing once the exit is complete.
If the new team prepares or helps prepare returns outside the United States, you need taxpayer consent before any tax return information goes to them. The regulation says that if the preparer receiving the information "is located outside of the United States," then "the taxpayer's consent under § 301.7216-3 prior to any disclosure is required" (26 CFR 301.7216-3).
Consents you collected for the old provider may not carry over. For Form 1040 filers, the regulation states that "the consent must also identify the specific recipient (or recipients) of the tax return information," and every consent "must identify the intended purpose of the disclosure." A consent that names the old firm does not name the new one. Plan a fresh consent round for every individual client whose files will move, and finish it before the first file is shared. Business returns have some flexibility, since the specific-recipient requirement does not apply to non-1040 filers when the consent uses the descriptive-class option in the regulation.
Social Security numbers need separate handling. A preparer "may not obtain consent to disclose the taxpayer's social security number (SSN)" to a preparer outside the United States, and for Form 1040 filers "the tax return preparer must redact or otherwise mask the taxpayer's SSN before the tax return information is disclosed," unless an adequate data protection safeguard defined in IRS guidance is in place. Confirm in writing how the new provider meets that standard, or that SSNs will be masked. Our explainer on Section 7216 consent for tax return preparers covers the consent format and wording in more detail.
Tax preparation firms are covered by the Safeguards Rule. The FTC's Safeguards Rule guide for businesses lists "tax preparation firms" among its examples of covered financial institutions. Section 314.4(f) of the rule then sets three duties for any service provider that touches customer information (16 CFR 314.4(f)):
A switch is the natural point to show all three on paper. Keep the due diligence you did on the new provider, such as security questionnaires, a SOC 2 report if it has one and your notes from reference calls. Put the security obligations into the signed contract. Then set a review calendar, for example an annual reassessment plus a check after any incident or change in the provider's systems. The FTC summarizes the contract piece this way: "Your contracts must spell out your security expectations, build in ways to monitor your service provider's work," with periodic reassessment.
The rule also requires notice to the FTC "no later than 30 days after discovery" of a notification event involving "the unauthorized acquisition of at least 500 consumers' unencrypted information." Add a clause requiring the new provider to tell you promptly about any incident so you can meet that deadline. For help reading a provider's audit report, see our guide to SOC 2 for accounting firms and vendor due diligence.
The parallel run is the main protection against a bad cutover, so budget for paying two providers for a few weeks.
Week one. The new team reviews the exported workpapers and process notes, then sends a written list of gaps and questions.
Weeks two and three. The new team processes the same period as the old provider, working independently from your documentation. Your reviewers compare both sets of output line by line. Differences are logged and resolved, and some will turn out to be long-running errors by the outgoing team.
Week four onward. The old provider stops processing. Your team reviews the new provider's work with the depth you would apply to any new hire. Our guide to onboarding an offshore accounting team in 30 days covers how to structure feedback during this stretch.
If the old provider will not take part in knowledge transfer, schedule client-by-client sessions between your managers and the new team, and have the new provider write a playbook for each client.
Client communication. If clients never deal with the outsourced team directly, there is usually nothing to announce, since the work is delivered under your firm's name. If they do interact with the team for document requests or routine questions, send a short note naming the new contact and confirming that their main point of contact at your firm is unchanged.
Test directly for what failed last time. Ask each candidate for its documented transition process, for references from firms that moved to it from another provider, and for average tenure on client teams.
Before you sign, work through the questions to ask before signing an accounting outsourcing contract, including exit terms. The offshore accounting due diligence checklist gives you a structured way to score candidates side by side.
How long does switching accounting outsourcing providers take? Plan for 60 to 90 days from signing the new provider to closing out the old one, with three to four weeks of that spent in a parallel run.
Do I need new Section 7216 consents when I change offshore providers? For individual clients, usually yes. Consents for Form 1040 filers must name the specific recipient, so a consent naming the old provider does not cover the new one, and consent is required before any disclosure to a preparer outside the United States.
How long must I keep the records the old provider prepared? The IRS general rule is 3 years, rising to 6 years where more than 25% of gross income was omitted and 7 years for worthless securities or bad debt claims. Employment tax records must be kept for at least 4 years after the tax is due or paid, whichever is later.
What does the FTC Safeguards Rule require when I hire a new provider? Section 314.4(f) requires you to select a provider capable of maintaining appropriate safeguards, require those safeguards by contract and periodically assess the provider based on the risk it presents. Keep written evidence of each step.
Should I overlap providers or do a hard cutover? Overlap where you can, so your reviewers catch the new team's early mistakes before clients see them.
Madras Accountancy supports US CPA firms and businesses with outsourced bookkeeping, accounting, tax preparation and CFO-level work, including structured onboarding for firms moving from another provider. To talk through your transition plan, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
