A vendor risk assessment for accounting firms is a documented review of whether an outside provider, such as an offshore bookkeeping or tax team, can keep client data secure, followed by contract terms and periodic checks sized to that risk. For US CPA firms, the FTC Safeguards Rule requires that oversight, and Section 7216 adds consent rules when tax return information leaves the United States.
This guide explains how to run a vendor risk assessment for accounting firms in practice. It covers what to collect from the vendor, how to weigh its security reports and certificates as evidence, when GDPR enters the picture, and how to score the results so a partner can sign off on a decision.
The FTC treats tax preparation firms as financial institutions under the Gramm-Leach-Bliley Act, so most CPA firms that prepare returns fall under the Safeguards Rule at 16 CFR 314. The rule's service provider paragraph is short and specific. Section 314.4(f) tells firms to oversee service providers by "[t]aking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue," by "[r]equiring your service providers by contract to implement and maintain such safeguards," and by "[p]eriodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards" (16 CFR 314.4).
Each of those duties becomes a stage of the review described below. The same section requires your own written risk assessment, encryption of customer information in transit over external networks and at rest, multi-factor authentication for anyone accessing an information system, and a written incident response plan. Your offshore vendor sits inside that program, so its controls need to meet the same bar.
The rule also carries a notification duty. If a security event involves the information of at least 500 consumers, the firm must notify the FTC "as soon as possible, and no later than 30 days after discovery of the event" (16 CFR 314.4(j)). A breach at your vendor is still your notification event, which is why breach terms belong in the contract. For the IRS side of a breach, see our guide on data breach response for tax professionals.
Tax return information carries an extra layer. Under the Treasury regulations for Section 7216, staff of the same preparer can share return information inside the US firm without consent, but if the person receiving it "is located outside of the United States or any territory or possession of the United States, the taxpayer's consent under § 301.7216-3 prior to any disclosure is required" (26 CFR 301.7216-2). The same consent requirement applies when the offshore party is a separate preparer.
For Form 1040 series clients there is a further limit. A US preparer that obtains consent to send return information abroad "must redact or otherwise mask the taxpayer's SSN before the tax return information is disclosed outside of the United States," unless the SSN travels through an adequate data protection safeguard as defined in guidance published in the Internal Revenue Bulletin (26 CFR 301.7216-3). Your assessment should confirm how the vendor's platform handles masking and which safeguard it relies on. Our Section 7216 consent guide walks through the consent wording.
Start with your own footprint. The evidence you need depends on what the vendor will touch.
A vendor that only works inside your hosted environment through a locked-down remote desktop presents a different risk than one that downloads files to its own servers. Write this scope down first, since every later question refers back to it. A broader pre-contract list lives in our offshore accounting due diligence checklist.
A SOC 2 engagement is, in the AICPA's words, an "[a]ssertion-based examination of a service organization's description of its system and its controls," and "[c]ustomers and business partners often request a SOC 2 report from the service organization" (AICPA SOC 2 guide). The criteria cover security, availability, processing integrity, confidentiality and privacy, and the vendor chooses which categories are in scope.
The report type matters most. A Journal of Accountancy explainer notes that SOC 1 and SOC 2 both have type 1 and type 2 options, and describes a type 1 report as one that addresses "the suitability of the design of its controls" as of a specified date, while a type 2 report "contains the same opinions as a type 1 report with the addition of an opinion on the operating effectiveness of the controls" throughout a specified period (Journal of Accountancy). For a vendor that will handle client files every week, a type 2 report gives you evidence that the controls ran, while a type 1 only shows they were designed.
When the report arrives, check these points in order:
The deeper differences between report families are covered in SOC 1 vs SOC 2 audits, and firms getting their own SOC 2 should read SOC 2 for accounting firms.
ISO/IEC 27001 is the international standard for an information security management system (ISMS). Certification is issued by an independent certification body after an audit, and the certificate is only as useful as its scope statement.
What to verify:
ISO 27001 and SOC 2 answer different questions. ISO certification says the vendor runs a management system for security. A SOC 2 type 2 report tests whether specific controls operated over a period. Either can support your selection decision under 314.4(f)(1), and many firms ask for whichever the vendor holds plus targeted questions to fill the gaps.
GDPR is not automatic for a US practice. The European Commission explains that the regulation reaches a controller or processor "established outside the EU when it is offering goods/services (paid or for free) to individuals in the EU," and also covers monitoring the behaviour of people in the EU (European Commission). A CPA firm that serves EU-based clients, or works on files for EU subsidiaries, should assume it will be asked about GDPR.
Roles follow the processing. The Commission defines it this way: "The data controller determines the purposes for which and the means by which personal data is processed," while "[t]he data processor processes personal data on behalf of the controller, on that controller's documented instructions." Its own example is a company that signs a contract with a payroll provider, where the company is the controller and the payroll provider is the processor. In an outsourced accounting chain, the client is usually the controller, the CPA firm acts as a processor for routine bookkeeping, and the offshore team is a sub-processor.
When EU personal data moves to a country outside the EU or EEA, the parties need a transfer mechanism. The Commission's standard contractual clauses are "pre-approved" model clauses, and the modernised set issued on 4 June 2021 covers transfers to "controllers or processors established outside the EU/EEA" (European Commission SCC page). Ask the vendor for a signed data processing agreement, the executed clauses with annexes, its sub-processor list with locations, and its retention and deletion policy.
Certificates and reports describe the vendor at a point or over a past period. Operational questions tell you how your engagement will run day to day. Ask for evidence on each item:
Our data security checklist for offshore accounting expands each of these into specific questions, and cloud accounting security best practices for remote teams covers the settings inside common platforms.
A scorecard turns the evidence into a decision a partner can sign. The weights and pass mark below are an illustrative firm policy; set your own based on the data each vendor will see.
Each criterion is scored from 1 (weak or missing evidence) to 5 (current, specific evidence with no open issues), then multiplied by its weight.
| Criterion | Weight | Vendor A score | Vendor A weighted | Vendor B score | Vendor B weighted |
|---|---|---|---|---|---|
| Security evidence (SOC 2 type 2 or ISO 27001 scope fit) | 30% | 4 | 1.20 | 2 | 0.60 |
| Data access and location | 25% | 3 | 0.75 | 4 | 1.00 |
| Contract, DPA and 7216 terms | 20% | 4 | 0.80 | 3 | 0.60 |
| Incident response | 15% | 3 | 0.45 | 2 | 0.30 |
| Continuity and exit | 10% | 2 | 0.20 | 3 | 0.30 |
| Total | 100% | 3.40 | 2.80 |
Under a policy where a total below 3.00 or any single score of 1 sends the vendor back for remediation, Vendor A passes with a note to improve its recovery testing. Vendor B goes back with a request for a type 2 report and a stronger incident plan. Record the scores, the evidence reviewed and the reviewer's name, since 314.4(f)(3) expects the review to repeat. Many firms reassess high-risk vendors every year and lower-risk vendors on a longer cycle.
Selection is only the first of the three 314.4(f) duties. The contract carries the second. At a minimum it should require the vendor to maintain the safeguards you assessed, notify you of security events within a fixed number of hours, flow equivalent terms down to sub-processors, give you audit or evidence rights, and return or destroy data at exit. Where tax data is involved, it should reflect the client's 7216 consent and the SSN masking method.
Our article on key terms in an accounting outsourcing contract lists clause wording, and what happens when an outsourcing provider shuts down covers the exit plan in more depth.
Does the FTC Safeguards Rule require CPA firms to assess offshore vendors? Yes. Section 314.4(f) requires firms to take reasonable steps to select capable service providers, to require safeguards by contract, and to periodically assess providers based on the risk they present. An offshore bookkeeping or tax team that handles customer information falls within that duty.
What evidence should an accounting vendor provide for the assessment? Expect a current independent assurance report or certificate whose scope covers the services and locations you will use, a signed data processing agreement where personal data is involved, a sub-processor list, a written incident response plan and the date of its last recovery test. Where only a design-level report exists, firms usually add targeted questions and set an earlier reassessment date.
What does Section 7216 require before sending tax data offshore? The taxpayer must give written consent under 26 CFR 301.7216-3 before return information is disclosed to anyone located outside the United States, including staff of the same firm. For Form 1040 series clients, the SSN must also be masked unless an adequate data protection safeguard is used.
When does GDPR matter in a vendor risk assessment for accounting firms? It matters when the firm offers services to individuals in the EU, and EU-based business clients will usually require GDPR terms by contract when the firm handles their personal data. In those cases the firm needs a data processing agreement with the offshore vendor and, for transfers outside the EU or EEA, a mechanism such as the Commission's standard contractual clauses.
How often should the assessment be repeated? The rule says periodically and based on risk, without fixing a number. A common practice is an annual review for vendors that handle SSNs or full client ledgers, with an earlier review after any security incident or a change in the vendor's locations or sub-processors.
Madras Accountancy provides outsourced bookkeeping, tax preparation and accounting support for US CPA firms and their clients. If you are assessing an offshore partner and want to talk through how a delivery team would fit your security program and contract requirements, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
