Offshore Bookkeeping for CPA Firms: Cost and Controls

Offshore bookkeeping means a team outside the US keeps the books for a CPA firm’s clients, working in the firm’s or client’s cloud software. The savings come from lower labor cost. Using it safely takes four things: client notice or consent where the rules require it, a written confidentiality agreement, restricted access, and review of every close by the firm before anything reaches the client.

Why firms do it

Small and mid-size firms hit the same wall each busy season: more write-up and monthly close work than staff hours. Hiring is slow, and the new hire costs more than the wage. Offshore production lets the firm keep the client relationship, the review and the signature, while routine production moves to a partner.

What an in-house bookkeeper really costs

The median US wage for bookkeeping, accounting and auditing clerks was $50,670 a year in May 2025 (Bureau of Labor Statistics). The employer cost is higher before you add a single benefit:

Cost line (2026 rates)	Amount
Median annual wage	$50,670
Employer Social Security and Medicare (7.65%)	$3,876
Federal unemployment (FUTA, 0.6% of the first $7,000)	$42
Texas unemployment, new employer example (2.7% of the first $9,000)	$243
Subtotal before benefits	$54,831
Plus	Health and retirement benefits, paid leave, software seats, equipment, recruiting, training and review time

State unemployment rates and wage bases vary by state and by employer history; the Texas line is an example. See our bookkeeper salary by state table for local wages.

A per-client outsourced rate replaces most of that with a variable cost: you pay for clients you actually have, and capacity grows or shrinks with the season.

The rules a US firm has to plan for

1. AICPA notice and confidentiality

For AICPA members, two interpretations apply when a firm uses a third-party service provider:

ET 1.150.040 (Use of a third-party service provider): before sharing confidential client information, inform the client, preferably in writing, that a third-party service provider may be used. If the client objects, do not use the provider for that client, or decline the engagement. Pure administrative support, such as record storage or software hosting, is carved out.
ET 1.700.040 (Disclosing information to a third-party service provider): either have a contractual confidentiality agreement with the provider that gives reasonable assurance it will protect the information, or obtain the client’s specific consent before disclosing.

State boards of accountancy can have their own rules. Check yours.

2. IRC Section 7216, if tax return information is involved

Information a firm obtains in connection with preparing a tax return can be “tax return information”. Under the Section 7216 regulations, disclosing it to a tax return preparer located outside the US requires the taxpayer’s prior written consent, and the consent must carry the specific statement the regulations prescribe. For Form 1040 filers, a US preparer may not obtain consent to send the taxpayer’s full Social Security number to a preparer outside the US unless an adequate data protection safeguard is used.

Practical rule: keep offshore work to bookkeeping, sales tax and payroll tax support where possible, mask Social Security numbers, and get the 7216 consent in your engagement letter for any client whose return data may be shared. RazaPro does not prepare individual income-tax returns.

3. The FTC Safeguards Rule

Tax preparation and many accounting firms fall under the FTC’s Safeguards Rule, which requires a written information security program, a qualified individual in charge of it, risk assessment, access controls, encryption, multi-factor authentication and oversight of service providers. Covered firms must also notify the FTC as soon as possible, and no later than 30 days after discovery, of a security breach involving the unauthorized acquisition of unencrypted information of at least 500 consumers. Your offshore partner is a service provider under the rule, so your program should cover how you selected it and how you monitor it. The IRS publishes a template to help: Publication 5708, Creating a Written Information Security Plan.

Controls checklist for an offshore partner

Control	What good looks like
Written agreement	Confidentiality, data handling, no-solicitation of clients, return or deletion of data at the end
Named individuals	Every person who touches client data is named and signs a confidentiality agreement
Access	Named user per person in QuickBooks Online or Xero; no shared logins; no banking credentials
Multi-factor authentication	On every system that holds client data
Data minimization	Social Security numbers masked; only the documents needed for the task
Storage	Files stay in the firm’s portal or cloud drive, not on personal devices or email
Review	Firm reviews every close before release; reconciliations delivered with the reports
Exit	Access removed the same day the engagement ends

How the work flows across time zones

A partner 9 to 11 hours ahead can work while the firm is closed. A typical flow: the firm sends questions or source documents at the end of the US day, the partner prepares the work overnight, and the firm reviews in the morning. One shared list of open questions per client per month keeps client contact with the firm.

How to start without risk

Pick three standard clients, ideally with clean books and no tax return data in scope.
Update your engagement letter with the third-party notice and, where tax return information is involved, the 7216 consent.
Sign the confidentiality agreement and set up named-user access.
Run one month-end close and review it as you would a new staff member’s work.
Expand by client, not all at once.

RazaPro provides white-label bookkeeping, payroll tax and sales tax support to US firms from Pakistan. Work is delivered under your firm’s name, and your firm reviews and signs. See how it works for accounting firms, the sample deliverables, or how outsourced bookkeeping works for small CPA firms.

This article is general information, not legal or professional-ethics advice. Confirm your obligations with the AICPA Code, your state board of accountancy and counsel.

Last checked October 3, 2026.

Offshore Bookkeeping for US CPA Firms: Costs, Client Consent and Controls