Most published lists of accounting outsourcing challenges come from the firms selling the service, so they describe problems a vendor can solve for you. The ones that decide how an engagement ends sit on your side of the desk. In the AICPA Private Companies Practice Section's 2025 National MAP Survey, 29% of responding firms used offshoring, and the survey called participation in these practices limited.
Seven challenges change the plan. Each one carries a decision, and every decision is yours to make before the first file moves.
Accounting Outsourcing Challenges at a Glance
Here is the short version, with the call each challenge forces.
- The duties do not move with the work. Name the person inside your firm who owns the relationship.
- Consent is a calendar, not a checkbox. Build a consent register with signature dates and expiry dates.
- Review capacity is the real bottleneck. Count reviewer hours before you count preparer seats.
- Security duties come with a breach clock. Put an incident notice commitment in the contract.
- The costs that stay are yours. Price ramp, review and management time into the comparison.
- Communication is a workflow problem. Define the daily handoff, not a communication standard.
- Turnover erases what you trained. Get continuity terms in writing and own the documentation.
First, Size the Thing You Are Buying
The scale question comes first because it decides which challenges matter. Firms that outsource are mostly buying a slice, not a department, and a slice fails for different reasons than a transformation.
Adoption tracks firm size. In the 2025 National MAP Survey, which reports fiscal year 2024 results and was completed by 1,073 firms, 29% of responding firms used offshoring, rising to 74% of firms at $10 million or higher in net client fees. Among the firms the survey classes as top performers, meaning the top 25% by net remaining per partner, 46% offshore.
Depth is thinner than the adoption number suggests. The same survey found that 59% of respondents reported only 1% to 5% of their work is outsourced or completed by a global team, while 25% put it at 6% to 15%, and that firms use these arrangements primarily to increase capacity rather than as an alternative operating model.
Structure and destination follow the same pattern. Among the firms involved, 72% used the vendor model, which relies on a third party, rather than the employer-of-record model or a wholly owned offshore facility, and 65% offshored to India, followed by the Philippines at 33%.
What leaves the building is mostly tax. Among firms that outsource, the survey reports individual tax at 51%, business tax at 42%, client accounting services at 38% and audit at 28%.
Read that as a warning about generic advice. A challenge list written for a company relocating its entire finance function describes governance problems a firm sending out individual tax returns will never meet. At the depth most firms actually run, the failures are administrative.
1. The Duties Do Not Move With the Work
You can move preparation. You cannot move responsibility, and both the tax rules and the security rules put it in writing.
Circular 230, Treasury's rules of practice before the IRS, opens with diligence. Section 10.22(a)(1) requires a practitioner to exercise due diligence in preparing or assisting in the preparation of, approving, and filing returns and other papers relating to IRS matters. The reliance paragraph then sets the standard for delegated work: under section 10.22(b), a practitioner "will be presumed to have exercised due diligence" if the practitioner relies on another person's work product and "used reasonable care in engaging, supervising, training, and evaluating the person, taking proper account of the nature of the relationship between the practitioner and the person."
Note the shape of that sentence. The presumption is available, not automatic, and it is earned by four verbs you have to be able to evidence: engaging, supervising, training, evaluating. A partner who cannot describe how offshore work was vetted, directed, taught and checked has nothing to point at.
The FTC Safeguards Rule reaches the same conclusion from the security side. Where a firm meets the Qualified Individual requirement using a service provider, section 314.4(a)(1) says you retain responsibility for compliance with the rule, section 314.4(a)(2) says you must designate a senior member of your personnel responsible for direction and oversight of the Qualified Individual, and section 314.4(a)(3) says you must require the service provider to maintain an information security program that protects you.
The decision. Write down a single name inside the firm who owns the outsourcing relationship, with authority to reject work and stop the flow. If that name is the same partner who is already the bottleneck, you have not solved a capacity problem yet.
2. Consent Is a Calendar, Not a Checkbox
For tax work, the paperwork is not a one-time step. It is a recurring obligation with dates on it, and one of those dates is an expiry.
Start with the timing rule. Treasury regulation section 301.7216-3(b)(1) states that "a taxpayer must provide written consent before a tax return preparer discloses or uses the taxpayer's tax return information." There is no retroactive cure. Section 301.7216-3(a)(3)(i)(D) adds that where the preparer receiving the information is located outside the United States, the taxpayer's consent prior to any disclosure is required.
Then read the expiry rule, which is the one that turns paperwork into a calendar. Under section 301.7216-3(b)(5), a consent document may specify how long it lasts, and if it does not, the consent is effective for a period of one year from the date the taxpayer signed it. A relationship that runs for three seasons on a single consent with no stated duration is covered for the first year only.
Two mechanics catch firms out. A single written document cannot authorize both uses and disclosures under section 301.7216-3(c)(1), so a general engagement-letter paragraph often has to become two documents, and section 301.7216-3(c)(3) requires you to give the taxpayer a copy of the executed consent at the time of execution.
The split rule is narrower than it looks. Section 301.7216-3(a)(3)(iii) makes section 301.7216-3(c)(1) inapplicable to consents with respect to taxpayers not filing a return in the Form 1040 series, and lets those consents take any format, including an engagement letter to a client. So the two-document mechanic bites on Form 1040 series filers. For the rest, an engagement letter can carry the consent.
The social security number rule is separate and stricter. For clients filing in the Form 1040 series, section 301.7216-3(b)(4)(i) says a preparer located within the United States may not obtain consent to disclose the taxpayer's SSN to a preparer located outside the United States, and "must redact or otherwise mask the taxpayer's SSN before the tax return information is disclosed outside of the United States." The exception in section 301.7216-3(b)(4)(ii) is narrow: disclosure through an adequate data protection safeguard as defined by the Secretary in published guidance, with maintenance of that safeguard verified in the consent request itself.
Telling clients is its own challenge, and it has been measured. In an experiment published in the Journal of Forensic and Investigative Accounting, respondents told plainly that their returns would go overseas were less likely to say they would return to the firm than respondents who read the AICPA's recommended wording, and a fee cut did not offset the difference.
The decision. Keep a consent register with a row per client, the date signed, the stated duration, and the renewal month. Before that, confirm your software can actually mask an SSN on the file you intend to send. A workflow that cannot mask has to qualify for the narrow safeguard exception instead, which is a harder conversation than a masking setting.
3. Review Capacity Is the Real Bottleneck
Outsourcing buys preparation hours. It does not buy review hours, and review is the step it cannot take off your desk.
Every file that comes back needs someone who knows your treatments to read it, resolve the open questions, and decide what goes out. A provider's own review layers cut the number of defects that reach that person, and they do not remove the reading and the judgment calls. If your reviewer was the constraint before, adding preparers deepens their queue rather than shortening it. The arrangement then reads as a failure of the provider, when the real design flaw is that nobody added review capacity to match.
The first season is the worst version of this. Work returns with questions attached, your reviewer answers them, and the answers become the training set. Effort is front-loaded by design, which is fine if you planned it and painful if you promised yourself a quiet April.
The decision. Before signing, estimate reviewer hours per return under the new arrangement and say out loud who will spend them. If the honest answer is the partner who is already at capacity, either buy review capacity too, start smaller, or wait.
4. Security Duties Come With a Breach Clock
The Safeguards Rule turns vendor management into three ongoing obligations, then attaches a reporting deadline that starts running at discovery rather than at the end of your investigation.
The obligations are specific. Section 314.4(f) requires you to oversee service providers by taking reasonable steps to select and retain providers capable of maintaining appropriate safeguards, requiring those safeguards by contract, and "periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards." A one-time due diligence file does not satisfy the third one.
Now the clock. Under section 314.4(j)(1), where a notification event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible and no later than 30 days after discovery. Section 314.4(j)(2) defines discovery as the first day the event is known to you, and you are deemed to know when the event is known to any person, other than the person committing the breach, who is your employee, officer, or other agent.
That last clause is why an offshore incident is your calendar problem. Whether a given provider is your agent is a question for your contract and your counsel, so the safe planning assumption is that the clock may start when their staff learns of an incident, not when they finally tell you.
The trigger itself is defined, which matters because the word breach invites over-reading. Section 314.2(m) defines a notification event as acquisition of unencrypted customer information without the authorization of the individual to which the information pertains, and it presumes unauthorized acquisition from unauthorized access unless you have reliable evidence showing there has not been, and could not reasonably have been, unauthorized acquisition.
Firms already treat the underlying risk as real. In the 2025 National MAP Survey, 88% of firms had purchased cyber liability insurance and 3% planned to, while 9% had no coverage.
The decision. Put a named incident-notice commitment in the contract, fast enough to leave you room inside the reporting window, and ask the provider to describe the last incident they reported to a client. A provider who has never had one either has a short history or a short memory.
5. The Costs That Stay on Your Side of the Ledger
These get called hidden costs. They are not hidden. They are yours, and they are missing from the per-hour comparison that usually drives the decision.
Five of them recur. The ramp comes first, and it is paid in the currency you were trying to protect: your senior people spend their hours teaching your procedures to someone who has never seen them, so budget the first season at a lower net gain than the rate card implies. Reviewer hours come next, and they are per file, every file, for as long as the arrangement runs, which makes them a permanent line rather than a startup line. Then the management time of whoever owns the relationship, a standing weekly cost that belongs in the comparison at that person's own billing rate. Then tooling, because software seats, licenses and secure access get priced per person by your vendors no matter how your provider prices an hour, so count the added people before you sign. Consent administration is the one firms forget, and in a practice with hundreds of individual clients it is recurring work with renewal dates on it rather than a one-time filing task.
Price the review time rather than guessing at it. In the 2025 National MAP Survey the median net hourly billing rate rose 6.9% over two years to $170 from $159, which is a sanity check on the rate you assign to your own hours, not a substitute for your actual rate.
The decision. Build the comparison with your hours in it. A quoted rate that ignores the ramp, the review and the administration is a price, not a cost, and the gap between those two is where disappointed firms live.
6. Communication Is a Workflow Problem, Not a Language Problem
The vendor lists blame language and culture. In practice, the recurring failure is a handoff that was never designed, and it looks identical whether the team sits offshore or two towns away.
The pattern goes like this. Work arrives with unstated assumptions, the preparer guesses rather than asking, the guess survives to review, and the reviewer spends more time reconstructing intent than fixing numbers. The fix is documentation the preparer can follow and a question route that is faster than guessing.
Time zones cut both ways, and the choice is a real one. A working day that ends before yours begins gives you overnight turnaround and a full day of latency on every question. An overlapping window gives you same-day answers and fewer heads-down hours. Pick the one your work needs, then staff to it, rather than treating the mismatch as a surprise.
The decision. Write down the daily handoff before the engagement starts: what arrives, in what naming convention, with which open-question list, and by when. Vague instructions to communicate well produce vague work.
7. Turnover on Both Sides Erases What You Trained
Every hour you spend training an offshore preparer is an investment in a specific person, and people leave on both ends of the arrangement.
Your side is measurable. The 2025 National MAP Survey found primary reasons for firm-member departures included leaving the profession or making a career change at 24% and moving to another firm at 23%, while another 24% cited retirement, up from 15% in 2020. If the only person who knows how the offshore workflow runs is a senior associate, that knowledge has a churn rate.
The provider's side is harder to see, because no public survey reports attrition inside offshore accounting teams the way the MAP survey reports it inside US firms. Absent data, make it contractual: ask for the tenure of the people assigned to you, the notice period, and whether an outgoing person shadows their replacement before rolling off.
The decision. Own the documentation yourself. SOPs, checklists and treatment notes that live in your systems survive turnover on either side; the same knowledge living only in one preparer's head does not.
When Outsourcing Is the Wrong Answer
Some firms should not start, and the honest version of a challenges list includes the cases where the answer is no.
Skip it if nothing is written down. Undocumented work cannot be handed to anyone, and the discovery phase will cost more than the season it was meant to save. Skip it if the work you would send is mostly judgment: advisory, positions, and anything that is one conversation with the client rather than one procedure.
Wait if you cannot name a reviewer with time to spare, because review is the constraint that outsourcing does not relieve. Wait if your client base would object to the disclosure and you would rather not have that conversation, because the consent rules mean you will be having it anyway. And stop if you are shopping on rate alone. The cheapest hour is the one that produces work your reviewer has to redo.
How to Test the Answer Before a Client File Is at Stake
Three of the seven show up inside a fixed block of real work: the review load, the handoff, and the quality of what comes back. That is the argument for grading real work before committing to a relationship rather than after.
A useful test has four parts: a fixed block of your own representative work, your procedures and software rather than the provider's, full review by their side before it reaches you, and your own reviewer grading the output against what your firm would have produced. Define what counts as a defect before the work starts, so the debrief is a measurement rather than an argument.
That is the entry point we built. If you are a firm carrying the volume and you want proof before the commitment, run a Free 40-Hour Proof Pilot: a fixed 40-hour block of your own representative work, prepared on your SOPs and in your software, put through multi-layer review, so your reviewer grades real output before a client file is on the line. Placements ramp in roughly 3 to 4 weeks, and if a placement is not a fit in the first 30 days we replace them free. Don't trust us. Test us.
Questions Firms Ask About Accounting Outsourcing Challenges
What Are the Common Challenges Associated With Outsourcing?
Loss of control, communication, data security, quality and hidden costs are the ones every list names. For an accounting firm the sharper version is narrower: the professional and security duties that stay with you, the consent paperwork that expires, the review capacity outsourcing does not add, and the internal hours nobody put in the comparison.
Is Accounting Getting Outsourced?
Partly, and less deeply than the headlines suggest. The 2025 National MAP Survey found 29% of responding firms used offshoring, while 59% of respondents said only 1% to 5% of their work is outsourced or completed by a global team. Most firms are augmenting capacity at the margin, not relocating a function.
What Are the Biggest Challenges Facing the Accounting Industry Today?
Staffing sits at the top, and firms have responded with pay. In the 2025 National MAP Survey, the median average initial salary for new hires with master's degrees jumped nearly 17% over two years to $67,750 in fiscal year 2024, while pay for bachelor's degrees moved up about 11% to $60,834.
The federal projection is often quoted as though it counts people looking for work. It does not. The Bureau of Labor Statistics projects about 124,200 openings for accountants and auditors each year, on average, over the decade, with employment growing 5% from 2024 to 2034, and openings include roles created by workers who transfer to other occupations or leave the labor force. An opening is a seat to fill, not a candidate available to fill it.
Why Are So Many CPAs Quitting?
The survey's own answer is a mix rather than a single cause: leaving the profession or changing careers, moving to another firm, and retirement, with the retirement share up sharply since 2020, as the 2025 National MAP Survey reports. For a firm planning an offshore program, the practical reading is that your own continuity is as fragile as the provider's.
The Challenge to Solve First
The pattern across all seven is that the work sits inside your firm, not inside the vendor selection. Naming an owner, counting review hours, and fixing the consent calendar are things you can do this month, and they decide more than the shortlist does.
Do them in that order, then test one provider on a fixed block of real work and grade it yourself. A firm that has done the first three can read the result honestly. A firm that has not will be grading the vendor on a job it was never set up to do.