Tax software access for offshore preparers should be switched on only after three things are in place: a signed Section 7216 consent from each affected client, a rule for masking Social Security numbers on individual returns, and individual logins protected by multi-factor authentication. Once those are settled, the rest of the handoff is about user permissions and review routing.
This checklist covers the order a CPA firm should follow when it gives an offshore team tax software access for offshore preparers working on 1040, 1065 and 1120 returns. It draws on Treasury Regulation 301.7216-3, IRS Publication 4557 and the FTC Safeguards Rule, and it is written for the partner or operations lead who owns the setup. It expands the software item on our wider tax season outsourcing checklist for CPA firms, which covers PTINs, routing rules and timing.
Many of the handoff problems that slow an offshore team down start with access. A preparer who can open the tax software but not the document portal will rebuild workpapers from scratch. A preparer who shares a login with a colleague leaves no audit trail when a reviewer asks who changed a depreciation schedule. A preparer who sees full Social Security numbers on individual returns may be receiving information the firm had no right to send.
Each of those issues has a regulatory angle. Section 7216 governs whether client data can leave the United States at all. The FTC Safeguards Rule sets access and authentication standards for the systems that hold it. IRS Publication 4557 translates both into practical steps for tax practices.
If you are still deciding which returns to send offshore, start with our breakdown of the 1040, 1065 and 1120 tax prep workflow and come back to this checklist once scope is set.
Under Treasury Regulation 301.7216-3, "If a tax return preparer to whom the tax return information is to be disclosed is located outside of the United States, the taxpayer's consent under § 301.7216-3 prior to any disclosure is required." The regulation also states that "A taxpayer must provide written consent before a tax return preparer discloses or uses the taxpayer's tax return information." There is no retroactive fix. If an offshore preparer can open a client file before that client has signed, the disclosure has already happened.
That has a direct software consequence. Granting tax software access for offshore preparers to the whole client database on day one is a common shortcut, and it exposes every client who has not yet consented. The safer approach is to restrict offshore users to a client group, folder or office code that contains only consented clients, and to move each client into that group only after the signed consent is on file.
A few practical points from the regulation:
For a full walkthrough of consent wording, signature rules and penalties, see our guide to Section 7216 consent for tax return preparers. The point for this checklist is narrower: tie the software permission to the consent record so one cannot exist without the other.
Suppose a client signs an offshore disclosure consent on 10 February 2026 and the form is silent on duration. Under the one-year default, the consent runs until 10 February 2027, which is 365 days later. That covers the 2025 return, including an extended return finished by 15 October 2026. It does not cover work the offshore team starts on 15 February 2027 for the next filing season.
| Event | Date | Covered by the Feb 2026 consent |
|---|---|---|
| Consent signed (no duration stated) | 10 Feb 2026 | Start of period |
| Extended 2025 return completed | 15 Oct 2026 | Yes |
| Consent expires under the one-year default | 10 Feb 2027 | End of period |
| Offshore preparer opens 2026 return file | 15 Feb 2027 | No, new consent needed |
To avoid this, track the consent expiry date as a field in your practice management system or engagement tracker, and pull the client out of the offshore access group when the date passes without a renewal. Firms that want consent to run longer can state a specific duration on the form.
For individual returns the rule is stricter than for business returns. Regulation 301.7216-3(b)(4) says a preparer in the United States "may not obtain consent to disclose the taxpayer's social security number (SSN) with respect to a taxpayer filing a return in the Form 1040 Series" to a preparer abroad, and "must redact or otherwise mask the taxpayer's SSN before the tax return information is disclosed outside of the United States."
There is one exception. A US preparer may obtain consent to disclose the SSN offshore "only if" it does so "through the use of an adequate data protection safeguard" and verifies that safeguard in the consent request. Rev. Proc. 2013-14, section 5.07, says this applies "only when both the tax return preparer located within the United States and the tax return preparer located outside of the United States maintain an adequate data protection safeguard at the time the taxpayer's consent is obtained and when making the disclosure." It then defines the safeguard as a management-approved security program, policy and practice that conforms to one of the privacy or data security frameworks listed in that section.
In software terms, a firm has two workable paths:
Whichever path you choose, write it into the handoff document so preparers know whether a full SSN in a file is an error to report.
Once consent and SSN handling are settled, set up the accounts themselves. The FTC Safeguards Rule at 16 CFR 314.4 requires firms to "Implement multi-factor authentication for any individual accessing any information system," and to limit "authorized users' access only to customer information that they need to perform their duties and functions." IRS Publication 4557 adds that firms should "not share password among employees" and that "Each individual with access to client accounts should have a unique password."
Use this checklist for each offshore preparer:
Our article on cloud accounting security best practices for remote teams covers the hosting and device side in more depth.
| Function in the tax software | Offshore preparer | Onshore reviewer | Firm administrator |
|---|---|---|---|
| Open and edit consented client returns | Yes | Yes | Yes |
| View full SSN on 1040 returns | Only under the safeguard path | Yes | Yes |
| Mark return as ready for review | Yes | Yes | Yes |
| Sign and release return, transmit e-file | No | Yes | Yes |
| Change EFIN, user or firm settings | No | No | Yes |
| Export or bulk print client data | No | Limited | Yes |
Adjust the matrix to your software's permission options and record it in the handoff document.
The Safeguards Rule also requires firms to "monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users." Publication 4557 recommends audit trails that record "who performed the activity, when it was performed, and what changes were made."
For an offshore tax team that means:
The offshore provider will usually manage its own staff changes, so the contract should require prompt notice of departures. Our guide to outsourcing contract key terms for CPA firms covers notice periods and security clauses.
According to Publication 4557, "tax return preparers must create and enact security plans to protect client data" under the FTC Safeguards Rule. The rule then requires firms to oversee service providers by "Requiring your service providers by contract to implement and maintain such safeguards" and "Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards."
Your written information security plan should name the offshore provider, list the systems its staff can reach, and describe how access is granted, reviewed and removed. It should also cover incidents. If a notification event (unauthorized acquisition of unencrypted customer information) involves the information of at least 500 consumers, the Safeguards Rule requires notice to the FTC "as soon as possible, and no later than 30 days after discovery of the event." Publication 4557 separately tells firms to report client data theft to their local IRS Stakeholder Liaison. Make sure the provider knows it must tell you immediately so you can meet both timelines.
For the wider regulatory picture, including AICPA and state board rules, read our overview of compliance rules for outsourcing tax and accounting work.
With access working, each assignment still needs context. Send every return with a short packet so the preparer does not have to guess:
Open items deserve their own discipline. Each one should name an owner, a date and the return or workpaper it belongs to. "Need info" helps no one. "Confirm whether the $4,800 payment to the roofing contractor was a repair or a capital improvement; invoice uploaded but scope unclear" can be answered in one client email.
Decide early whether the offshore team also performs first-level review. Our comparison of outsourced tax reviewers vs tax preparers explains how to split that work.
Run a small pilot before busy season. Pick five to ten consented clients with straightforward returns, give the offshore preparers access only to that group, and watch the full cycle from document upload to e-file. Look for missing permissions, masked fields that block entry and portal folders the preparer cannot see.
Feed what you find back into the handoff packet and the permission matrix, then widen the client group. If this is your firm's first season with outside help, our guide on how to prepare your CPA firm for its first outsourced tax season sets out a timeline, and the 30-day plan to onboard an offshore accounting team covers training and communication.
If you are also reviewing which software to standardize on, our roundup of tax preparer software for 2026 compares the main professional packages.
Do offshore preparers need their own tax software licenses or logins? They need their own named logins so every action is traceable to one person. Whether that requires extra licenses depends on how your software vendor counts users, so check your agreement before onboarding. Headcount also depends on the model covered in our comparison of dedicated staff vs per-return pricing.
Can an offshore preparer see a client's Social Security number? For Form 1040 series returns, Regulation 301.7216-3(b)(4) requires the SSN to be redacted or masked before information goes offshore, unless both firms maintain an adequate data protection safeguard under Rev. Proc. 2013-14 and the consent discloses the SSN transfer. Business returns are outside that specific SSN limitation, though consent is still required before disclosure.
Can logins be issued before client consents come back? Only if the offshore user is limited to clients whose consent is already on file. The regulation bars retroactive consent, so access to any other client's file is an unauthorized disclosure. For Form 1040 clients, Rev. Proc. 2013-14 requires the consent to be a separate written document, which can be attached to the engagement letter at the start of the season.
How often should offshore user access be reviewed? The Safeguards Rule requires access controls to be reviewed periodically and does not set a fixed interval. A monthly review during busy season, plus same-day removal when someone leaves, is a practical standard for most firms.
Who should own tax software access for offshore preparers inside the firm? Assign one workflow owner, often an operations manager or senior reviewer. That person keeps the consent tracker in step with the user list and signs off on every new account.
Madras Accountancy supports US CPA firms with offshore tax preparation, workpaper organization, open-item tracking and coordination with onshore reviewers, working inside the firm's own software and review process. To plan your access setup and handoff process before the next filing season, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
