Outsourced bookkeeping security comes down to one question that most accounting firms have never answered precisely: what, exactly, can the person on the other end of the screen see and do? Not what you intended to give them. What they can actually reach today.
A managing partner at a six-person firm gets a question from a client during a routine call.
“Who has access to my books?”
It is a fair question. The partner answers confidently. “Just us, and our bookkeeping team.”
The client pauses. “Where is your bookkeeping team?”
The partner explains that the firm works with a small outsourced team in another country. They have been reliable for four years. They are fast, inexpensive, and speak good English. The firm set them up in QuickBooks years ago, and nothing has ever gone wrong.
The client asks a third question.
“Can they move money?”
The partner does not know.
She opens the user list afterward and finds things she had forgotten. Four people from the outsourced team have accounts. Two of them have the highest permission level. One account is shared. Another belongs to someone who left the vendor two years ago. The authentication codes go to a phone she has never seen.
Nobody did anything wrong. But for the first time, the partner realizes she could not honestly say who had been inside her clients’ books, or when.
Outsourcing Is Not the Problem. Unexamined Access Is.
It is worth saying clearly at the start: there is nothing inherently wrong with outsourcing bookkeeping, and nothing inherently dangerous about doing it internationally.
Plenty of capable, honest, well-run bookkeeping teams work remotely from outside the United States, and many firms rely on them to meet demand without hiring full time. A locally based freelancer working from a personal laptop with a shared password can be a bigger risk than a well-managed overseas team working inside a locked-down system.
The distinction that matters is not location. It is access. How much access has been granted, to whom, under what controls, with what oversight, and with what legal protections if something goes wrong.
That last point is where distance does change the picture, and it is why this topic deserves a closer look.
What a Bookkeeper Can Actually Reach
Accounting software holds more than numbers. A typical client file in QuickBooks can contain bank account details, bank feeds, payroll records with Social Security numbers, vendor payment information, customer data, tax identification numbers, and years of financial history.
Depending on the permission level, a user may be able to do much more than view that information.
They may be able to export it. They may be able to edit or delete transactions. They may be able to change vendor bank details, which is the first step in a common type of payment fraud. They may be able to invite additional users. They may be able to see or alter the audit log that records what everyone has done.
QuickBooks offers a range of permission levels, from limited access to full administrative rights. Many firms grant the highest level because it is easiest, and because the bookkeeper asked for it so they would stop running into restrictions. Years later, nobody remembers the decision.
Industry guidance on outsourced bookkeeping consistently flags the same set of risks: credentials that have been compromised, access that exceeds what the work requires, unprotected file transfers, and access that is never fully removed when an engagement ends.
The Legal Layer Many Firms Have Never Considered
For accounting firms that prepare tax returns, a separate legal framework applies, and it changes the question considerably.
Internal Revenue Code Section 7216, discussed earlier in this series in the context of AI tools, restricts how tax return preparers may disclose tax return information. When the recipient is a preparer located outside the United States, additional rules apply under the regulations that implement the statute.
In general terms, for individual returns, disclosing tax return information to someone outside the United States requires the client’s written consent beforehand, using required language, and the usual exceptions that allow disclosure without consent do not apply. The consent must also include a statement that federal agencies may not be able to enforce United States privacy laws against an offshore preparer.
Social Security numbers receive even stricter treatment. The regulations generally do not allow a firm to obtain consent to send a client’s Social Security number to a preparer outside the country, and the number must be masked or redacted before the information crosses the border. A limited exception exists where both firms maintain a recognized level of data protection and verify it, but the safest course for most firms is to keep Social Security numbers out of offshore hands altogether.
These rules attach to tax return information and tax return preparation. A bookkeeper doing pure bookkeeping for a business client may not trigger them. A bookkeeper who also touches individual return information, or whose work feeds directly into return preparation, may. The line is not always obvious, which is exactly why a firm should know where it sits before the question is raised by a regulator or a client.
Firms should confirm how these rules apply to their specific arrangements with qualified tax counsel. What matters here is awareness: sending client information to a team outside the country is a regulated decision, not just an operational one.
The AICPA and the Safeguards Rule Add Their Own Expectations
Professional standards point the same direction. The AICPA’s ethics rules expect a CPA to tell clients, preferably in writing, before sharing their confidential information with a third-party service provider, and to have either a confidentiality agreement with that provider or the client’s specific consent. An engagement letter clause is the usual way to do this.
The FTC Safeguards Rule, discussed throughout this series, applies to tax preparers and accounting firms and adds a requirement that bears directly on this situation. A firm must take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess whether providers are keeping them.
In plain terms, hiring a vendor does not transfer the responsibility. The firm remains accountable for what happens to client data in the vendor’s hands, and must be able to show it exercised oversight.
The Specific Problems That Distance Makes Harder
Even with strong contracts and good intentions, working across borders and across companies introduces practical difficulties that firms should plan for.
Enforceability. If something goes wrong, recovering losses or pursuing a claim against a company in another country can be slow, expensive, and uncertain. The consent language required by the regulations exists precisely because of this limitation.
Visibility into the vendor’s own environment. Your firm controls its systems. It does not control the devices, networks, or office where the vendor’s staff work. Personal laptops, shared workstations, and unsecured home networks may all be part of the picture, and you may never see them.
Subcontracting. Some vendors pass work along to other contractors. Your agreement may be with one company while the person actually viewing your client’s books works for a different one entirely.
Turnover. Outsourced teams often experience high turnover. Every departure is an offboarding event, and an access list that nobody reviews slowly fills with people who no longer work there.
Time zones. Logins at unusual hours are normal for an overseas team, which makes it harder to distinguish legitimate activity from a compromised account.
None of these are reasons to avoid outsourcing. They are reasons to design the arrangement deliberately.
Controls That Make Outsourcing Safer
Firms that handle this well tend to put the same short list of controls in place.
Least privilege. Grant the lowest permission level that allows the work to be done, and no more. A bookkeeper entering transactions rarely needs to manage users, change bank details, or delete the audit log. Separate the ability to record from the ability to pay.
Individual named accounts. Every person gets their own login. No shared credentials. This is the same accountability principle described in an earlier article in this series on shared passwords, and it matters even more when the team is remote.
Multifactor authentication the firm controls. If authentication codes go to a device the firm has never seen, the firm has not really added a second factor. Use an approach where the firm can see, approve, and revoke the enrollment.
Restricted access paths. Where possible, limit logins to expected locations or require access through a controlled remote environment, so data stays inside the firm’s own systems rather than being downloaded to personal devices.
Bank connections made by the firm or the client. Bank feeds should be connected by the account owner. A bookkeeper should work with transactions that appear in the software, not hold the banking login itself.
Logging and review. Turn on the audit log, keep it, and review it on a schedule. Look for unusual exports, changes to vendor details, and new users.
Quarterly access reviews. Once a quarter, list every user with access to every client file and confirm each one is still needed. Remove anyone who is not.
Dual approval for payments. No single person, inside or outside the firm, should be able to create and release a payment alone.
A written agreement. The contract should require specific safeguards, notification of incidents within a defined time, restrictions on subcontracting, background checks for staff with access, return or deletion of data at the end, and cooperation with your oversight.
Bring the Work to the Data, Not the Data to the Work
One of the most effective ways to make outsourcing safer is to change where the work happens.
Instead of letting a remote team download client files to their own computers, many firms provide access through a controlled virtual desktop or managed remote environment. The bookkeeper logs into a workspace that lives inside the firm’s own systems. The files never leave. Copying, printing, and downloading can be restricted, every session can be logged, and access can be shut off in seconds if needed.
This approach does not eliminate risk, but it shrinks it considerably. The firm no longer has to wonder what sits on a distant laptop, because nothing does. A managed IT services provider can build and maintain this kind of environment so that outsourced help is a controlled extension of the firm rather than an uncontrolled copy of it.
It also supports the monitoring discussed above. With sessions flowing through your own environment, cybersecurity monitoring can flag a login from an unexpected location, a sudden bulk export, or a change to vendor bank details as it happens, instead of discovering it at the next quarterly review.
A Practical First Week
For a firm that suspects its outsourced access has drifted, the first week does not need to be elaborate.
Export the current user list for every client file and for the firm’s own systems. Identify every person you do not recognize or cannot account for. Confirm with the vendor, in writing, who currently works on your account.
Reduce each user to the lowest workable permission level, remove anyone who is no longer needed, and replace shared logins with named ones.
Check how authentication is configured, confirm who controls the devices that receive codes, and re-enroll under the firm’s control where necessary.
Turn on or retrieve the audit log and review recent activity for exports, vendor detail changes, and new users.
Finally, find the vendor agreement and read it. Note what it says about safeguards, incident notification, subcontracting, and the end of the relationship. The gaps you find are your improvement plan for the quarter.
Offboarding Is Where Outsourcing Usually Fails
Of everything on that list, ending access is the item most often neglected.
When an engagement ends, or a vendor employee leaves, every credential, invitation, and integration tied to that person must be removed. That includes the QuickBooks user, any connected apps, any shared drive access, any remote access accounts, and any authentication devices.
An earlier article in this series described how seasonal and departing staff retain access long after they leave. Outsourced teams create the same pattern at scale, because the firm often never learns when a vendor employee departs. A contract term requiring the vendor to notify you promptly of any departure, and a routine of verifying the user list yourself, closes that gap.
What This Means for Miami and South Florida Firms
South Florida accounting practices have particular reasons to think about this carefully.
The region has deep business and cultural ties to Latin America, and many firms work with bilingual bookkeeping and back-office teams in countries such as Colombia, Argentina, Mexico, and elsewhere. The shared time zones, shared language, and cost advantages are real, and they make outsourcing attractive.
Many local firms serve clients who are themselves international: business owners with operations, family, and banking in more than one country. A client who already has concerns about where their financial information travels may ask pointed questions, as in the opening scene, and expect a clear answer.
Local firms also handle large volumes of business returns, real estate transactions, and trusts for clients with cross-border structures, where the sensitivity of the information is high.
The practical lesson is the same everywhere: be able to tell a client exactly who can see their books, where those people are, and what controls apply.
Ask Your IT Provider These Questions
Can we produce a current list of every person with access to our clients’ accounting files, including vendor staff, and confirm each one is still needed?
What permission level does each outsourced user hold, and could any of them change vendor bank details or release payments?
Is multifactor authentication for outsourced users under our control, or tied to devices we cannot see?
Do we have a written agreement with each outsourcing vendor that covers safeguards, incident notification, subcontracting, and data return?
Have we determined whether Section 7216 consent is required for any of our arrangements, and are Social Security numbers kept out of offshore hands?
When did we last review the audit log for our outsourced users’ activity?
If your IT provider cannot answer these clearly, your firm may be in the partner’s position at the start of this article: confident until someone asks a precise question.
You Can Delegate the Work. You Cannot Delegate the Responsibility.
Outsourcing bookkeeping can be a smart, efficient way to run a practice. The trouble starts when the arrangement is built on trust alone, and the access granted years ago has never been revisited.
ITva Technologies provides managed IT and cybersecurity services for CPA and accounting firms across Miami-Dade and Broward, with specific experience helping firms bring outsourced teams inside a controlled, auditable environment.
Our managed IT services include user and access inventories, least-privilege permission design, and offboarding procedures that cover vendor staff as carefully as your own employees.
Our cybersecurity services include multifactor authentication that your firm controls, login monitoring that flags unusual activity, and documentation that supports your Safeguards Rule obligations to oversee service providers.
If your firm has never listed exactly who can reach your clients’ books, that is worth doing before a client asks.
Schedule a free vendor access assessment with ITva.
We will review your users, permissions, and vendor agreements, and show you where access has quietly grown beyond what the work requires.
Because the client’s question was a fair one.
Your firm should be able to answer it today.
Frequently Asked Questions
Is it safe to give an offshore bookkeeper access to QuickBooks?
It can be, when access is limited to what the work requires, each person has an individual login, multifactor authentication is controlled by your firm, activity is logged and reviewed, and the arrangement is covered by a written agreement. Safety depends on the access model more than on location.
Does Section 7216 apply to offshore bookkeeping?
It can apply when the work involves tax return information or tax return preparation, particularly for individual returns. Disclosing that information to a preparer outside the United States generally requires the client’s written consent in the required language, and Social Security numbers generally must be masked or redacted. Confirm your specific situation with qualified tax counsel.
Do we have to tell clients we use an outsourced provider?
Professional standards expect CPAs to inform clients, preferably in writing, before sharing confidential information with a third-party provider, and to have either a confidentiality agreement with the provider or the client’s consent. An engagement letter clause is the common approach.
What does the FTC Safeguards Rule require regarding vendors?
Covered firms must take reasonable steps to select service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess whether providers are maintaining them. Using a vendor does not transfer the firm’s responsibility.
What permission level should an outsourced bookkeeper have?
The lowest level that allows the work to be done. Most bookkeepers entering and reconciling transactions do not need to manage users, change vendor bank details, or alter the audit log, and the ability to record transactions should be separated from the ability to release payments.
How often should we review vendor access?
At least quarterly, and immediately whenever a vendor employee leaves or an engagement ends. Every user with access to client files should be confirmed as still needed, and any who are not should be removed.