An offshore accounting due diligence checklist tells a US CPA firm what to verify before client data leaves the country: the legal permissions you need from clients, the security evidence the provider must produce, the quality you can prove in a pilot, and the contract terms that let you leave cleanly. Work through it in that order and you will know whether a provider is fit to touch client files before you sign anything.
This offshore accounting due diligence checklist focuses on the parts that are specific to sending work overseas. US federal rules treat a foreign preparer differently from a domestic one, and your firm stays responsible for client data whoever holds it. For a broader, location-neutral scorecard, our 30-point checklist for evaluating an accounting outsourcing provider covers general vendor fit, and this guide adds the offshore layer on top of it.
Three sets of rules apply to almost every US firm that sends tax or accounting work overseas. They come from different regulators, so each needs its own line on your checklist.
The FTC Safeguards Rule. The Federal Trade Commission treats tax preparers as financial institutions. Its business guidance on the Safeguards Rule lists "tax preparation firms" among its examples, and it states plainly that "If your company brings in a service provider to implement and supervise your program, the buck still stops with you." Hiring an offshore team does not move your compliance duty to them.
Section 7216 of the Internal Revenue Code. Domestic preparers can often share return information with each other to complete a return. A preparer located outside the United States is a separate case that needs written taxpayer consent, and Social Security numbers carry an extra restriction covered below.
The AICPA Code of Professional Conduct. The Code says members should tell clients before confidential information goes to a third-party service provider, and should either sign a confidentiality agreement with the provider or obtain specific client consent.
If your firm also performs audits, reviews or compilations, your quality management system has to account for the provider too. The Journal of Accountancy notes that the AICPA's quality management standards add "new requirements for networks and service providers," and that "Systems of quality management in compliance with SQMS No. 1 are required to be designed and implemented by Dec. 15, 2025." That deadline has passed, so any offshore provider supporting attest work belongs inside your documented system. Our guide to SQMS and the AICPA quality management standards explains how the components fit together.
Set the baseline first so every provider quotes against the same target. Write down:
Turn that into a RACI for each process and a KPI list with definitions and a reporting cadence. The data inventory matters most, because it decides which consents and contract terms you need in Step 2. A team that will only reconcile bank feeds for business clients raises different questions from a team that will key individual returns containing SSNs.
Under Treas. Reg. § 301.7216-3, a preparer "may not disclose or use a taxpayer's tax return information prior to obtaining a written consent" unless the statute or § 301.7216-2 authorizes the disclosure, and the consent "must be knowing and voluntary." The companion rule in § 301.7216-2(c)(2) lets staff of the same firm share return information without consent only inside the United States. If the person receiving it "is located outside of the United States or any territory or possession of the United States, the taxpayer's consent under § 301.7216-3 prior to any disclosure is required." An offshore tax team therefore needs signed client consent before it sees return information, whether it is your own captive office or an outside provider.
Social Security numbers carry a stricter rule. For Form 1040 series filers, the regulation says a US preparer "may not obtain consent to disclose the taxpayer's social security number (SSN)" to a preparer outside the United States, and the US preparer must "redact or otherwise mask the taxpayer's SSN" before the information leaves the country. The exception applies only where the US preparer sends the SSN "through the use of an adequate data protection safeguard" as defined in IRS guidance, and verifies that the safeguards are maintained in the consent request.
For your checklist, that means:
Our explainer on Section 7216 consent walks through consent form content and timing in more detail.
The AICPA side runs in parallel. The "Use of a Third-Party Service Provider" interpretation (ET 1.150.040) of the AICPA Code of Professional Conduct, updated through September 2026, states that "before disclosing confidential client information to a third-party service provider, the member should inform the client, preferably in writing, that the member may use a third-party service provider." If the client objects, the member should either not use the provider for that work or decline the engagement. A separate interpretation (ET 1.700.040) adds that, before disclosure, the member should either sign a confidentiality agreement with the provider or get specific client consent. Many firms handle the notice through a clause in the engagement letter. The client conversation goes better when you prepare for it, and our tips on talking to clients about outsourcing cover the wording.
The Safeguards Rule turns vendor review into a written obligation. Under 16 CFR 314.4(f), your information security program must oversee service providers by "Taking reasonable steps to select and retain service providers that are capable of maintaining" appropriate safeguards, by "Requiring your service providers by contract to implement and maintain such safeguards," and by "Periodically assessing your service providers based on the risk they present."
The IRS reminds practitioners that "Federal Trade Commission regulations require professional tax preparers to create and enact security plans," so the offshore provider should appear by name in your written information security plan.
Ask every provider for evidence in place of assurances:
Read the SOC 2 report itself. Check the period covered, the systems in scope, the exceptions and the complementary user entity controls your firm is expected to run. Our guide to SOC 2 and ISO 27001 vendor due diligence for accounting firms explains how to read each section.
Breach handling belongs in this step too. Under the same section of the Rule, if a notification event "involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event." Your contract should require the provider to tell you about an incident fast enough for you to meet that clock. The IRS reporting steps are covered in our guide to data breach response for tax professionals.
Decision rule: proceed only if the assurance reports are current, exceptions have verified fixes, and the provider can show its controls working in a live walkthrough.
The FTC's guidance says your contracts must "spell out your security expectations, build in ways to monitor your service provider's work" and "provide for periodic reassessments of their suitability for the job." Build the agreement around those three duties.
Core documents to review:
Service levels should measure outcomes you can audit, such as response time for critical incidents, reconciliation accuracy, rework rate, system availability and agreed turnaround for workpapers and close items. Pick the numbers from your own baseline in Step 1 so the targets are realistic for your file types. Our article on offshore accounting SLA clauses gives sample wording, and the accounting outsourcing contract template lists the remaining key terms.
Plan governance from day one: a weekly operations review for the first eight weeks, then monthly, with root-cause analysis and corrective actions for every SLA miss.
A pilot shows whether the provider can deliver what the paperwork promises. Design it around your real work:
Accept the provider only if targets are met for two consecutive weeks, rework stays below the agreed threshold, and access logging behaves as documented. Test knowledge of current US rules while you are at it, for example by asking the team to explain how One Big Beautiful Bill Act changes affect the returns in your pilot sample. The 30-day pilot framework sets out a week-by-week plan.
Confirm that quality will hold during peak periods. Ask for a named engagement manager, reviewer-to-preparer ratios, US GAAP and US tax experience matched to your client base, busy season coverage hours, holiday calendars and the QA method, including sampling rate, error categories and the corrective action workflow.
Reference calls are most useful when the reference firm looks like yours. Ask about scope, start date and ramp speed, accuracy and turnaround after 90 days, incident history and how it was resolved, team turnover, and what they would change about year one.
The transition plan should include a playbook of SOPs, templates, naming rules and deadlines, plus a shadow, reverse-shadow, then own sequence with a stage gate at each move. Agree the rollback route at the same time, since an exit plan written before go-live is easier to enforce. Our contingency guide on what happens when an outsourcing provider shuts down covers the clauses and records you need if the relationship ends unexpectedly.
A scorecard keeps the decision consistent across partners. The example below weights five areas to total 100 points. Each area is scored from 1 to 5, and the weighted points equal the weight multiplied by the score divided by 5. A gate applies on top: any score below 3 in regulatory readiness or security assurance fails the provider whatever its total.
| Area | Weight | Provider A score | Provider A points | Provider B score | Provider B points |
|---|---|---|---|---|---|
| Regulatory readiness (7216 consent, SSN handling, client notice) | 25 | 4 | 20 | 2 | 10 |
| Security assurance (SOC 2 Type II, controls walkthrough) | 25 | 5 | 25 | 3 | 15 |
| Pilot results (accuracy, rework, turnaround) | 20 | 3 | 12 | 5 | 20 |
| Contract and exit terms | 15 | 4 | 12 | 3 | 9 |
| Team capability and peak coverage | 15 | 3 | 9 | 4 | 12 |
| Total | 100 | 78 | 66 |
Provider B ran the stronger pilot, yet it fails the gate because it could not explain how SSNs would be masked or protected before leaving the United States. Provider A passes with 78 points, and its weaker pilot score becomes a condition in the contract, with a 60-day review of rework rates before any expansion of scope.
Do I need client consent before sending tax work to an offshore team? Yes, for tax return information. Treas. Reg. § 301.7216-3 requires written, knowing and voluntary consent before disclosure to a preparer located outside the United States, and SSNs for Form 1040 series filers must be masked unless an adequate data protection safeguard is used and verified.
Does the FTC Safeguards Rule apply to my offshore provider or to my firm? It applies to your firm. The FTC lists tax preparation firms as financial institutions, and the Rule requires you to select capable service providers, bind them by contract to maintain safeguards and reassess them periodically.
Is a SOC 2 report enough to approve an offshore accounting provider? No. A current SOC 2 Type II report is strong evidence of security controls, but you still need Section 7216 consents, client notice under the AICPA Code, a contract that meets the Safeguards Rule and a pilot that proves quality on your own work.
How long should an offshore accounting pilot run? Two to four weeks on real cases is a practical range for most firms. Approve the provider once it meets your accuracy and turnaround targets for two consecutive weeks with rework below the agreed limit.
How often should I reassess an offshore provider? The Safeguards Rule requires periodic assessment based on the risk the provider presents. Many firms review SLA results monthly and repeat the full due diligence review each year when the new SOC 2 report arrives.
Madras Accountancy supports US CPA firms with offshore bookkeeping, tax preparation and accounting work, and can walk your team through how we handle data access, client consents, pilots and transition planning so you can complete your own due diligence. To discuss your scope, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
