Knowing how to choose an outsourced audit support provider starts with one fact: the CPA firm keeps every professional obligation for the audit, even when someone else prepares the workpapers. The right provider is the one whose people, controls and contract let your engagement partner meet the AICPA quality management and supervision rules without extra rework.
This guide explains how to choose an outsourced audit support provider by turning those rules into selection questions. It covers the provider qualities each rule points to, a six-step vetting process, a simple way to compare true cost and the red flags worth slowing down for. It deliberately names no vendors. Madras Accountancy publishes this page and provides audit support to CPA firms, so the criteria below are written to apply to any provider, including us.
Responsibility stays with the firm when the work moves to a provider. For nonissuer audits performed under generally accepted auditing standards, the firm's system of quality management and the engagement partner's duties stay with the firm that signs the report. For issuer audits, PCAOB standards apply instead, and you should check your provider against those requirements separately.
If you are still deciding which audit tasks to send out at all, start with our overview of outsourced audit support under AICPA standards, which explains the client notice, SQMS No. 1 and AU-C 220 duties in full, and our breakdown of which audit tasks can be delegated safely. This page assumes you have already made that decision and now need to pick the provider.
Each rule below creates a test that a candidate provider either helps you pass or makes harder.
SQMS No. 1. The AICPA's quality management standards are effective December 15, 2025, and the AICPA named "the growing use of external service providers" as one of the realities they respond to (AICPA). An outsourced team becomes a resource inside your firm's system, so prefer a provider that can document staff training, competence and its own internal review in a form your monitoring can use. Our guide to SQMS and the AICPA quality management standards covers the components.
AU-C 220. For audits of periods beginning on or after December 15, 2025, AU-C section 220 treats individuals from "another service provider" who perform audit procedures as part of the engagement team (AICPA Statements on Auditing Standards). Paragraph .26 asks the engagement partner to determine that the team has "the appropriate competence and capabilities, including sufficient time." Paragraphs .29 and .31 make the partner responsible for direction, supervision and review, with documentation reviewed "at appropriate points in time." A provider that names its staff and works inside your file makes these duties easier to meet.
AICPA Code. Under ET 1.150.040, the firm should inform the client, preferably in writing, before disclosing confidential client information to a third-party service provider. ET 1.300.040 says the firm should ensure the provider has the required professional qualifications, technical skills and other resources, and must plan and supervise its work. ET 1.700.040 asks for either a confidentiality agreement backed by reasonable assurance that the provider has procedures to prevent unauthorized release, or specific client consent (AICPA Code of Professional Conduct). Our article on talking to clients about outsourcing has practical wording ideas for the client notice.
| Rule | What it asks of your firm | What to ask the provider |
|---|---|---|
| SQMS No. 1 | Treat the outsourced team as a resource in your quality management system | How do you document staff competence, training and internal review? |
| AU-C 220 .26 | Partner confirms the team has competence and time | Who exactly will work on our files, and what US audit experience do they have? |
| AU-C 220 .29 to .31 | Partner directs, supervises and reviews the work | Will you work in our audit software with our templates and sign-offs? |
| ET 1.150.040 | Inform the client before sharing confidential data | Can you start only after we confirm client disclosure is complete? |
| ET 1.300.040 | Confirm qualifications, plan and supervise | Will you accept our planning instructions and review notes as binding? |
| ET 1.700.040 | Confidentiality contract with reasonable assurance, or client consent | Will you sign a confidentiality agreement and show the controls behind it? |
Write down the engagement types (financial statement audits, reviews, employee benefit plan audits, agreed-upon procedures), the audit areas you plan to send out and the busy season volume. A provider strong in tie-outs and lead schedules may be a poor fit for revenue testing under ASC 606 or lease work under ASC 842. A clear scope also lets you compare proposals on equal terms.
Ask each candidate for redacted sample workpapers and give them a short test file from a closed engagement. Look at tick mark legends, cross-references, sample selection documentation and whether each workpaper states a conclusion. Our guide to US GAAP workpapers for offshore audit support lists the documentation habits to look for.
Ask how review notes flow back to the preparer, whether the provider's staff work inside your audit software, and whether your managers can see sign-off history. The best setup lets your engagement partner review work as it progresses, as paragraph .31 expects, instead of receiving a finished file at the end.
Audit knowledge about a client carries from year to year. Ask whether the same people will return next year, how handovers work when someone leaves and how much notice you get. Put the answers in the contract.
Audit files hold bank confirmations, legal letters and payroll data. Ask for the provider's independent security reports and access control policies, and read our guide to SOC 2 and ISO 27001 vendor due diligence. If your firm also prepares tax returns, it is likely covered by the FTC Safeguards Rule, which requires firms to oversee service providers by "requiring your service providers by contract to implement and maintain such safeguards" and by periodically assessing them (16 CFR 314.4). Our checklist of key terms for an outsourcing contract and our list of SLA clauses that prevent quality slippage cover what to write into the agreement.
A short paid pilot on one or two closed engagements shows you the provider's real review burden before your deadlines depend on it. Our 30-day pilot engagement framework sets out how to scope and score one.
Hourly rates are a weak basis for comparison because review time sits on your side of the ledger. The figures below are hypothetical and only show the method. Assume a file needs 40 preparer hours and your in-house reviewer time costs the firm $150 per hour.
| Provider A | Provider B | |
|---|---|---|
| Preparer rate per hour | $25 | $18 |
| Preparer hours | 40 | 40 |
| Preparer cost | $1,000 | $720 |
| Extra in-house review and rework hours | 6 | 14 |
| In-house review cost at $150 per hour | $900 | $2,100 |
| Total cost for the file | $1,900 | $2,820 |
| Effective cost per preparer hour | $47.50 | $70.50 |
Provider B looks cheaper on the rate card, yet it costs the firm $920 more on this file once rework is counted. Track review hours during the pilot so you can run this comparison with your own numbers.
Some providers focus on assurance work; others offer audit support beside bookkeeping, payroll and tax. Either model can work when the specific team assigned to your files has current US audit experience and a review layer of its own. For the general criteria that apply to any outsourcing relationship, see our guide on choosing the right outsourcing partner. This page stays with the points that are specific to audit work.
Treat these as reasons to slow down:
What should a provider proposal include? A named team with each person's US audit experience, the engagement types and audit areas covered, the software and templates the team will work in, turnaround times for busy season, the handover process when staff change and the confidentiality and security terms. A proposal missing these items is hard to compare against others.
How many providers should we evaluate? Two or three candidates is usually enough. Fewer leaves you without a benchmark for sample quality and cost, and more makes it hard to run a fair test file with each one.
What is the most useful single test when choosing a provider? A paid pilot on a closed engagement, with review hours tracked, usually tells you more than any proposal. It shows workpaper quality and the real cost per file once review time is counted.
Are the rules different for public company audits? Yes. AU-C sections apply to audits of nonissuers. Issuer audits follow PCAOB standards, so confirm your provider's experience and your supervision process against those standards separately.
Madras Accountancy supports US CPA firms with outsourced audit workpaper preparation, testing support and documentation, working inside the firm's own templates and review process. If you are comparing providers and want to see how a support team would fit your quality management system, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
