The clerical layer of the profession is shrinking while the hiring never stops. The Bureau of Labor Statistics projects about 170,000 openings a year for bookkeeping, accounting, and auditing clerks over the 2024 to 2034 decade, and expects every one of them to come from replacing people who leave rather than from new positions.
Back office support for CPA firms is sold against that math. It works, but only if you know which half of your back office you are moving. One half is administration, where the duty to tell the client falls away but the security and confidentiality duties do not; the other half handles client information and feeds professional judgment, and there the rules are specific about what can move, what has to be papered first, and what never leaves your firm.
What Counts as Back Office Support for CPA Firms
Back office support for CPA firms covers every function that keeps the practice running without the client ever seeing it. Inside a firm it splits into two layers: the administration behind your invoices, files, and systems, and the production work that reaches your reviewer before it reaches a client.
The profession already draws that line in its own rules. The AICPA Code of Professional Conduct gives record storage, software application hosting, and authorized e-file tax transmittal as its examples of administrative support services, and says a member is not required to inform the client when a third-party service provider supplies only those (AICPA Code of Professional Conduct, interpretation 1.150.040). Anything a provider does to assist you in delivering the professional service itself sits on the other side of that line, and the obligations start there.
The Administrative Layer
This layer never forms a view about a client's numbers.
- Record storage and document management. Scanning, filing, retention, and retrieval. The decision this drives is a security decision, not an ethics one, because the provider holds client data without interpreting it.
- Software hosting and IT support. Running your tax and practice management applications, patching them, and keeping them available in the weeks you cannot afford downtime. Judge it on uptime and on the contract terms covering your data.
- Authorized e-file transmittal. Transmitting completed returns to the taxing authority. It is a pipe, and the profession treats it as one.
- Billing, invoicing, and receivables follow-up. Raising invoices on your terms and chasing what is owed. If your receivables age while the technical work goes out on time, this is the function to move first.
- Firm-side administration. Your own payroll, recruiting paperwork, scheduling, and engagement letter administration. It touches employee data rather than client data, which changes the risk profile but not the need for a contract.
One federal rule lands on the administrative half directly. If you disclose tax return information to a person under contract in connection with the programming, maintenance, repair, testing, or procurement of equipment or software used for tax return preparation, you may disclose only what that person needs to provide the contracted services, and only if you ensure that every individual receiving it gets a written notice describing the requirements and penalties of sections 6713 and 7216 (26 CFR 301.7216-2(d)(2)). The same paragraph makes those contractors tax return preparers in their own right, because they are performing auxiliary services in connection with tax return preparation. The notice duty sits on you, not on the vendor.
The Production Layer
This layer builds the work product your reviewer has to approve.
- Bookkeeping and reconciliations. Coding transactions, reconciling accounts, and closing periods for your clients. High volume, highly repeatable, and easy to specify precisely, which makes it the safest place to start.
- Workpaper preparation. Building schedules, tying support to the trial balance, and chasing the open items list. It shortens review only when your naming and structure standards are written down.
- Return preparation to review-ready. Data entry, roll-forwards, and assembling the file so a reviewer opens it and reviews rather than rebuilds.
- Client payroll and payables processing. Recurring, deadline-bound, and rules-driven work where the rules are the client's and the calendar is unforgiving.
- Recurring reporting packages. Producing the monthly statements and schedules a client sees, which is production work wearing a client-facing label.
The test is not where the person sits or what the role is called. It is whether the work touches confidential client information, and whether it forms a judgment about a client's position.
The Line You Cannot Move: Auxiliary Work Versus Substantive Determinations
Federal tax rules draw the same line and give the two sides names. A preparer may disclose tax return information to another preparer located in the United States, for preparing or assisting in preparing a return or for auxiliary services connected to that preparation, without the taxpayer's consent, so long as the services provided are not substantive determinations or advice affecting the tax liability reported by taxpayers. The regulation then defines the term: a substantive determination involves an analysis, interpretation, or application of the law (26 CFR 301.7216-2(d)(1)).
That single definition is the architecture of the whole arrangement. Data entry, reconciliation, schedule building, and assembling a return to review-ready condition are auxiliary. Deciding whether an expense is deductible, resolving a basis question, or choosing the position a return will take is not.
A taxpayer can consent to that second kind of work reaching another preparer, and the same paragraph says so: a preparer may not disclose tax return information to another preparer for the purpose of that second preparer providing substantive determinations without first receiving the taxpayer's consent (26 CFR 301.7216-2(d)(1)). Read that as written. Consent clears the disclosure. It does not move responsibility for the return.
What Stays: Primary Responsibility for the Return
Responsibility has its own definition in the same body of rules, and it is the real answer to what stays. A signing tax return preparer is the individual tax return preparer who has the primary responsibility for the overall substantive accuracy of the preparation of the return or claim for refund (26 CFR 301.7701-15). No arrangement moves that. Whoever signs holds primary responsibility for the overall substantive accuracy of what the provider built, which is why the review has to be real enough to support the signature.
Treasury's practice rules, published as Circular No. 230, then tell you what you owe when you rely on the auxiliary work. Except as modified by sections 10.34 and 10.37, a practitioner will be presumed to have exercised due diligence, for the purposes of the diligence section itself, if the practitioner relies on the work product of another person and used reasonable care in engaging, supervising, training, and evaluating that person, taking proper account of the nature of the relationship between them (31 CFR 10.22).
Read those four verbs as a checklist, because that is how they will be read back to you. Engaging, supervising, training, evaluating. A provider can supply the people and run its own training program, and the presumption still turns on what your firm did and can show. Delegation moves the work. It does not move the duty, and a firm that hands work over and reviews it lightly has taken the delegation without earning the presumption.
What You Owe the Client Before Any Work Moves
Three separate obligations attach before a file leaves your firm, and they attach at different moments. Firms get into trouble by treating them as one clause in one document.
Notice Comes First
Before you disclose confidential client information to a third-party service provider, the AICPA Code says the member should inform the client, preferably in writing, that the member may use a third-party service provider. If the client objects, the member either should not use that provider for the professional services or should decline the engagement (interpretation 1.150.040).
That is notice, not permission. The client does not have to agree with you. You have to tell them before the disclosure, and you have to be willing to act on a refusal. The engagement letter is the natural home for that notice, which makes it the first document to change and not the last.
Confidentiality Protection Comes Second
The Confidential Client Information Rule gives a member two routes before confidential client information reaches a third-party service provider: enter into a contractual agreement with the provider to maintain confidentiality and provide reasonable assurance that the provider has appropriate procedures in place to prevent unauthorized release, or obtain specific consent from the client (Journal of Accountancy on interpretation 1.700.040).
Notice a firm can give. A confidentiality agreement with reasonable assurance behind it is something a firm has to negotiate and then verify, which is a different kind of work and usually a different week.
Tax Return Information Adds the Third
When your client furnishes that information to you in the United States and the officer, employee, or member receiving it sits outside the United States, the taxpayer's consent is required before any disclosure, so the rule reaches your own overseas office (26 CFR 301.7216-2(c)(2)). It reaches an outside provider by the same logic, because the consent-free route for disclosing to another preparer is written for a preparer located in the United States (26 CFR 301.7216-2(d)(1)).
One detail inside that consent regime changes how files are built rather than how they are papered. A preparer located within the United States generally may not obtain consent to disclose the taxpayer's Social Security number for a taxpayer filing a return in the Form 1040 Series to a preparer located outside the United States, and must redact or otherwise mask it before the return information is disclosed offshore (26 CFR 301.7216-3(b)(4)(i)).
The exception is narrow. A preparer within the United States may obtain that consent only if the number is disclosed through the use of an adequate data protection safeguard as defined by the Secretary in guidance published in the Internal Revenue Bulletin, and only if the maintenance of that safeguard is verified in the request for the taxpayer's consent (26 CFR 301.7216-3(b)(4)(ii)). A clause in an engagement letter does not get you there on its own.
Put the three together and the obligations sort cleanly by what the provider is actually doing.
| What the provider does | Tell the client first? | Confidentiality contract or client consent? | Consent needed if they sit outside the US? |
|---|---|---|---|
| Firm-side administration with no client data | Not required | Not triggered | Not triggered |
| Administrative support services such as record storage, software hosting, authorized e-file transmittal | Not required | Yes, before confidential client information is disclosed | Yes, once tax return information crosses the border |
| Production work assisting the professional service | Yes, preferably in writing, before disclosure | Yes, before confidential client information is disclosed | Yes, before any disclosure |
| Substantive determinations and advice affecting tax liability | Yes, preferably in writing, before disclosure | Specific taxpayer consent from the client, not a contract clause | Yes, with the SSN rule on top, and primary responsibility for the return stays with your signing preparer |
Sources: AICPA Code of Professional Conduct, interpretation 1.150.040, Journal of Accountancy on interpretation 1.700.040, 26 CFR 301.7216-2, 26 CFR 301.7216-3, 26 CFR 301.7701-15.
The Security Duty That Survives Every Small Firm Exemption
A firm that prepares tax returns is covered by the FTC Safeguards Rule, and the rule's service provider requirements do not scale down. The FTC's own guidance explains that section 314.2(h) lists 13 examples of entities that are financial institutions under the rule, and tax preparation firms are one of them (FTC Safeguards Rule guidance).
The rule then tells you what overseeing a provider means in practice: take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards for the customer information at issue, require those providers by contract to implement and maintain such safeguards, and periodically assess them based on the risk they present and the continued adequacy of their safeguards (16 CFR 314.4(f)).
The five thousand consumer threshold is not a small firm exemption from the rule. The exception releases financial institutions maintaining customer information concerning fewer than five thousand consumers from four provisions only, sections 314.4(b)(1), (d)(2), (h), and (i), and service provider oversight is not among them (16 CFR 314.6). The contract clause and the periodic reassessment bind a two-partner practice on the same terms as a national firm.
There is a second place the same rule speaks directly to outsourcing. The Qualified Individual who oversees your information security program may be employed by you, an affiliate, or a service provider, and if you meet the requirement through a provider you must retain responsibility for compliance, designate a senior member of your own personnel responsible for direction and oversight of that individual, and require the provider to maintain an information security program that protects you in accordance with the rule (16 CFR 314.4(a)).
The pattern is the same in all three rule sets. You can buy the work. You cannot buy your way out of overseeing it.
The Quality Management System Now Has to Describe the Arrangement
Firms performing engagements under the auditing, attestation, or accounting and review services standards picked up a newer obligation pointing the same direction. Those firms had to establish a system of quality management by the December 15, 2025 effective date of the AICPA's quality management standards, and must evaluate that system within one year of implementation or by December 15, 2026, then annually after that (Journal of Accountancy).
A back office arrangement touching those engagements is inside the system being evaluated, not beside it. If the provider's role, the review it passes through, and the risks it introduces appear nowhere in your documentation, the first evaluation is where that gap becomes visible. The practical move is to write the arrangement into the QM documentation while you are negotiating it, rather than reverse-engineering a description a year later.
What the Cost Comparison Actually Is
Price the role you are moving before you price a provider. The median annual wage for bookkeeping, accounting, and auditing clerks was $49,210 in May 2024, which the same handbook also states as $23.66 an hour (BLS Occupational Outlook Handbook).
For the layer above them, the median annual wage for accountants and auditors was $81,680 in May 2024 (BLS Occupational Outlook Handbook).
Those are wages, not what it costs to employ someone, and they are national medians rather than your market. Payroll taxes, benefits, software seats, the desk, and the supervision time all sit on top. An honest comparison prices the full loaded seat on one side against the full engagement on the other, and the engagement side includes the review and oversight hours the arrangement adds to your week.
The second half of that comparison is the easiest one to leave out of a model. Back office support does not reduce review; it delivers work to review faster. If your reviewer is already the constraint, a cheaper preparation layer just fills a queue that cannot clear any quicker, and the saving turns into a longer wait for the client.
Supply is why rebuilding the clerical layer locally is so hard. Employment of bookkeeping, accounting, and auditing clerks is projected to decline 6 percent from 2024 to 2034, a fall of 94,300 jobs, and the same projection still expects about 170,000 openings a year, all of them created by workers transferring to other occupations or leaving the labor force (BLS Occupational Outlook Handbook).
That pair of figures is also the plainest available answer to whether software is taking this work, and the answer is both things at once. The same handbook says technological change is expected to reduce demand for these workers, and that software innovations have automated many of the tasks performed by bookkeeping, accounting, and auditing clerks (BLS Occupational Outlook Handbook).
That is why the occupation shrinks. The hiring continues anyway, because people leave the occupation faster than the roles disappear. Automation is removing seats. It is not filling the ones that empty, and a firm competing for those workers is competing against every other employer replacing the same departures.
When Back Office Support Is the Wrong Answer
Four situations where buying this makes your firm worse, and the first is the one most easily misdiagnosed.
What is broken is administration, not production. If invoices go out late, receivables age, and nobody owns the client onboarding paperwork, adding preparation capacity does nothing for cash or for client experience. Name the failing function first, then buy against that name.
Your constraint is review. Work stacking up behind a partner rather than in front of preparers is a review capacity problem wearing a preparation costume. Measure where a file actually sits waiting before you buy against a guess.
The work is judgment rather than volume. A messy trust return, a nexus question, or a first-year cleanup with no reliable history is a substantive determination waiting to happen. That work stays inside the firm by rule and by common sense.
Nobody in the firm will own the oversight. Engaging, supervising, training, evaluating, contracting, and periodically reassessing are real hours belonging to a named person. If no partner or manager has capacity for that, the arrangement will produce exposure rather than relief.
How to Test a Provider Before a Client File Depends on It
The profession asks for this in its own words. Before using a third-party service provider, the member should ensure that the provider has the required professional qualifications, technical skills, and other resources, and the member must adequately plan and supervise the provider's professional services so that the member ensures the services are performed with competence and due professional care (AICPA Code of Professional Conduct, interpretation 1.300.040).
Five steps, in the order that keeps the paperwork ahead of the data.
- Name the function, the volume, and the software. "Monthly reconciliations for the recurring bookkeeping book, in your accounting platform, delivered in the first half of each month" is a scope. "Back office help" is a wish, and a wish cannot be reviewed, priced, or graded.
- Change the documents before anything moves. The client notice, the confidentiality agreement with reasonable assurance behind it, the safeguards clauses, and any offshore consent all have to exist before the first file transfers. None of them applies retroactively, which makes sequencing the one error you cannot repair later.
- Ask who supervises, trains, and evaluates, and get names. You are buying against a standard that asks exactly those questions. A provider that cannot describe its review chain, or will not put you in front of the person doing your work, is selling you a pool.
- Grade a fixed block of your own real work under your own review. Score the output the way you would score a new hire's first file: rework rate, workpaper quality, how many questions came back, how many should have. A block that fails costs you a few weeks instead of a season.
- Scale one seat at a time, and calendar the reassessment. Add the second person after the first has cleared a full cycle, and set the periodic security assessment as a recurring date rather than a good intention.
Buy the Capacity, Keep the Judgment
Back office support for CPA firms is two purchases wearing one name. The administrative half is a procurement decision with a security contract attached. The production half is a capacity decision with a compliance layer that has to be settled before any file moves, because notice, consent, and contract terms do not reach backwards.
Get the sequence right and the rest is manageable. Name the function that is actually failing, paper the notice and the confidentiality and the consent, then grade real work under your own review before a client file is on the line. What comes back tells you more than any provider's deck.
If you are carrying that volume and want proof before commitment, we run a Free 40-Hour Proof Pilot: a fixed 40-hour block of your own representative work, prepared on your procedures and in your software, put through full multi-layer review, so your reviewer grades real output before a client file is on the line. Don't trust us. Test us.