An engagement letter outsourcing clause is the written notice, inside your engagement letter or an amendment to it, that your firm may use a third-party service provider to help deliver the client's bookkeeping or accounting work. The AICPA Code of Professional Conduct says a member should inform the client of this, preferably in writing, before any confidential client information goes to the provider. If the client objects, the firm either keeps that client's work in-house or declines the engagement.
When you move existing bookkeeping clients from in-house staff to an outsourced CAS team, the engagement letter outsourcing clause is the document that makes the move defensible. This guide covers what the Code requires, what the clause should say, when a separate Section 7216 consent is also needed, and how to sequence notices, letters and the first data handoff across a batch of clients. The rules cited are current as of October 2026.
Firms often plan the client conversation carefully and treat the paperwork as an afterthought. A friendly email can tell clients that a production team now handles their monthly close, but the engagement letter is the record that the client was informed before their data moved. If a client later complains or a peer reviewer asks, the signed or acknowledged letter is what you produce.
The tone of that conversation still matters, and our guide on talking to your clients about outsourcing covers framing and trust. This article stays with the written side: the clause, the consents and the timing.
The operational handover is a separate project. If you have not yet mapped each client's quirks, recurring entries and reporting preferences, start with an outsourcing knowledge transfer plan so the CAS team receives documented instructions along with system access.
Three interpretations in the AICPA Code of Professional Conduct apply when a member in public practice uses a third-party service provider. The current PDF is "Updated for all official releases through September 2026."
Inform the client (ET 1.150.040). Under the Integrity and Objectivity Rule, the Code states that "before disclosing confidential client information to a third-party service provider, the member should inform the client, preferably in writing, that the member may use a third-party service provider." It adds that if the client objects, "the member either should not use the third-party service provider to perform the professional services or should decline to perform the engagement." The interpretation excludes administrative support services such as record storage, software application hosting and authorized e-file transmittal. Bookkeeping production is professional work, so that exclusion does not cover a CAS team.
Keep the information confidential (ET 1.700.040). Before disclosing confidential client information to the provider, the member should either enter into a contractual agreement with the provider to maintain confidentiality, with reasonable assurance that the provider has procedures to prevent unauthorized release, or "obtain specific consent from the client before disclosing confidential client information to the third-party service provider." A common approach is to use the contract route and also disclose in the engagement letter.
Plan and supervise the work (ET 1.300.040). The General Standards interpretation names bookkeeping directly. It says a member using a provider for "bookkeeping, tax preparation, or consulting or attest services, including related clerical or data entry functions" must "adequately plan and supervise the third-party service provider's professional services." The client keeps the same responsible CPA, and the firm stays accountable for the output.
A workable clause is short and addresses the following:
The sample wording below is illustrative only. Have your firm's counsel and your professional liability insurer review and adapt it before you use it.
"To assist us in providing the services described in this letter, we may use third-party service providers, which may include personnel located outside the United States. We will supervise their work and remain responsible for the services and deliverables. Each provider is bound by a written agreement to keep your information confidential and to follow our data security requirements. If you object to our use of a third-party service provider, please tell us in writing before [date]. Where we disclose your tax return information to a provider located outside the United States, we will first ask you to sign a separate consent as required by federal regulations."
Place the clause in the body of the letter rather than in fine print, and name the date by which the client should respond. If your template is due for a wider update, our walkthrough of the accounting engagement letter covers scope, responsibilities and fee terms. For active engagements mid-term, a one-page amendment that the client signs or acknowledges by email can serve, and the clause then rolls into the full letter at renewal.
The clause is one of three documents, each with its own legal source.
| Document | Who signs | Source | What it covers |
|---|---|---|---|
| Engagement letter clause or amendment | Client (or acknowledges) | AICPA ET 1.150.040 | Notice that a third-party provider may be used; right to object |
| Section 7216 consent | Taxpayer | Treas. Reg. 301.7216-3; Rev. Proc. 2013-14 | Disclosure of tax return information, required before any disclosure to a preparer outside the US |
| Provider contract | Firm and provider | AICPA ET 1.700.040; FTC Safeguards Rule 16 CFR 314.4(f) | Confidentiality, data safeguards, periodic assessment of the provider |
A bookkeeping-only client generally needs the first and the provider contract behind it. A client whose individual or business return you also prepare, and whose return information the outsourced team will see, needs all three.
Section 7216 of the Internal Revenue Code governs tax return information, and the Treasury regulations are stricter than the AICPA notice standard. Under Treas. Reg. 301.7216-3, if the preparer receiving the information "is located outside of the United States, the taxpayer's consent under § 301.7216-3 prior to any disclosure is required." An engagement letter clause does not replace that consent. Several details trip firms up:
Where the line falls between bookkeeping data and tax return information depends on how the books feed the return, so take a cautious view for clients whose returns you prepare. Our explainer on Section 7216 consent covers form content and the exceptions in more depth.
The engagement letter tells the client the provider is bound by confidentiality and security terms. That statement has to be true on the day the first file moves. The Code's confidentiality interpretation points to a written agreement, and the FTC Safeguards Rule applies to tax preparers directly: 16 CFR 314.2 lists "An accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution.
Under 16 CFR 314.4(f), covered firms must oversee service providers by "Requiring your service providers by contract to implement and maintain such safeguards" and by "Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards." Our vendor risk assessment guide covers what to check before signing, and the offshore accounting SLA clauses article covers turnaround, error rates and rework terms.
The old habit of sending one announcement email and moving everyone at once creates gaps. A batch approach keeps each client's paperwork ahead of their data. Start with a small first group, ideally after a 30-day accounting outsourcing pilot on a handful of straightforward files.
Consider a hypothetical firm moving 40 monthly bookkeeping clients to an outsourced CAS team in batches of 10, one batch every 30 days. Fourteen of the 40 also have their individual returns prepared by the firm, so their return information will reach the offshore team and each needs a Section 7216 consent.
| Batch | Clients | Also tax clients (7216 consent) | Bookkeeping only | Notice and amendment sent | First data handoff |
|---|---|---|---|---|---|
| 1 | 10 | 4 | 6 | Day 0 | Day 30 |
| 2 | 10 | 3 | 7 | Day 30 | Day 60 |
| 3 | 10 | 4 | 6 | Day 60 | Day 90 |
| 4 | 10 | 3 | 7 | Day 90 | Day 120 |
| Total | 40 | 14 | 26 |
Each client gets 30 days between the notice and the first handoff. During that window the firm tracks three statuses per client: amendment acknowledged, objection received, and (for the 14 tax clients) signed consent on file. A client with no acknowledgment by day 25 of their window gets a phone call. A client who objects stays with in-house staff. A tax client without a signed consent can still move for bookkeeping, provided the outsourced team does not receive their return information until the consent arrives.
Sending notices in the slower months, away from filing deadlines, gives your team time to answer questions properly.
Answer client questions with facts you can stand behind.
Data location. Say where the work is done, that access runs through the firm's controlled systems, and that the provider is bound by a written confidentiality and security agreement. Do not cite certifications you have not personally verified in the provider's current reports.
Point of contact. The responsible CPA and the client's contact person stay the same. ET 1.300.040 requires the firm to plan and supervise the provider's work, so this answer reflects how the engagement is actually run.
Fees. Decide your position before the notices go out and give every client the same answer.
Objections. Take them at face value. The Code is explicit that an objection means the firm keeps the work in-house or declines the engagement. Record the objection in the client file so a later staff member does not move the client by mistake.
Firms that move CAS production offshore often do so to free partner and senior time for planning and advisory work. If that is part of your reason, our guide to CPA firm advisory services covers that side of the shift.
The clause appears only in new-client letters. Updating the template covers future engagements, but existing clients moving now need an amendment or a written notice before their data moves.
Consent arrives after access. The CAS team is given access to a client's full document portal, including prior returns, before the 7216 consent is signed. Limit portal access by client until consents are on file.
The front desk is not briefed. A client calls and hears about "the team overseas" for the first time from a receptionist. Brief every client-facing person on the clause and the standard answers before the first notice goes out.
The administrative-support exception is stretched. The Code's exception covers record storage, hosting and e-file transmittal. It does not cover people who reconcile accounts or post journal entries.
No record of objections. Without a log, an objecting client can end up in a later batch. Keep one list of objections and check it before each batch moves.
Before the first batch, confirm that your documentation and review capacity are ready, using an outsourcing readiness checklist for CPA firms.
Is an engagement letter outsourcing clause legally required? The AICPA Code says members should inform clients before disclosing confidential information to a third-party service provider, preferably in writing, and the engagement letter is the usual place to do that. Separately, federal regulations require a signed Section 7216 consent before tax return information is disclosed to a preparer outside the United States.
Do I need to notify clients if the provider only hosts our software? The Code excludes administrative support services, giving examples such as record storage, software application hosting and authorized e-file transmittal. Notice applies when the provider performs professional services such as bookkeeping or tax preparation.
Can the engagement letter clause double as the Section 7216 consent? No. Rev. Proc. 2013-14 requires a consent to be on a separate written document, and a consent for disclosure outside the US must include the mandatory statement set out in section 5.04 of that revenue procedure.
What should I do if a client objects to the outsourced CAS team? Keep that client's work with in-house staff or end the engagement, as the Code directs. Record the objection so the client is not moved in a later batch.
How often does a Section 7216 consent need to be renewed? If the consent does not state its own duration, it is effective for one year from the date the taxpayer signed it. One practical approach is to collect it with each annual engagement letter.
Madras Accountancy supports US CPA firms with outsourced bookkeeping, client accounting services and tax preparation production, working under the firm's supervision and review. If you are planning to move clients to an outsourced CAS team and want to talk through workflow and handoff, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
