Outsourcing vs Offshoring: What Changes for Your CPA Firm

Buried in the Treasury regulations under Internal Revenue Code section 7216 are two examples that read almost identically.

In both, a US firm hands a client's tax return information to one of its own employees in another office. In one, no client consent is required. In the other, the firm must have the client's written consent before the information is disclosed.

The only thing that changed between them is which country the employee was sitting in. That is offshoring. Neither example involves outsourcing. Nobody hired a vendor. That is the whole outsourcing vs offshoring distinction in one pair of examples: the two words track different facts, and for a CPA firm the border is the variable that changes the consent answer, while the relationship barely moves it.

Accountably's CEO, Jugal Thacker, is a Washington-licensed CPA with 7+ years inside US firms, first as a reviewer, then a manager, then in advisory. Accountably places offshore accountants and tax preparers inside CPA firms.

What is the difference between outsourcing and offshoring?

Outsourcing and offshoring answer two different questions about the same arrangement. Outsourcing describes the relationship: the work is performed by someone outside your firm's payroll, under contract, rather than by your own employee. Offshoring describes the location: the work is performed in another country, whether or not the person doing it works for you.

The two are independent. A firm can outsource to a provider in the next town, offshore work to its own subsidiary abroad, or do both at once. Most business writing treats them as competing options, which is where the confusion starts.

For a US accounting firm the distinction stops being academic. Under 26 CFR §301.7216-2, the border decides whether you need the client's written consent. Your obligations under the AICPA Code of Professional Conduct turn on the relationship instead.

Here is the short version, side by side.

What is outsourcing?

Outsourcing is the practice of contracting work to a party outside your own organization. The defining fact is the employment relationship, or rather the absence of one. The people doing the work are not your employees.

Location has nothing to do with it. A New York firm that sends its bookkeeping to a provider in New Jersey has outsourced. So has a firm that sends its tax preparation to a provider in Manila. Both are outsourcing, because in both cases the work left the payroll.

What is offshoring?

Offshoring is the practice of having work performed in another country. The defining fact is geography. Who employs the worker is irrelevant to the term.

A firm that opens its own office in Bangalore and staffs it with its own employees has offshored without outsourcing anything. The employees are still on the firm's payroll, still under its supervision, still subject to its procedures. The work simply happens somewhere else.

What is an example of offshoring and outsourcing?

The clearest examples separate the two variables rather than blending them.

• Outsourcing without offshoring: a Chicago CPA firm contracts a Chicago-based bookkeeping company to handle client write-up work.
• Offshoring without outsourcing: a national firm opens a wholly owned processing center in India and staffs it with its own employees.
• Both at once: a firm contracts an independent provider whose accountants work from offices in India. This is usually called offshore outsourcing.
• Neither: a firm hires a staff accountant who works from its own office in Ohio.

Accountably is both at once. We're an outsourcing relationship, because our accountants are not on your payroll. We're offshore, because our teams work from our own offices in India. Both words apply, and a provider who tells you otherwise is managing your perception rather than answering your question.

Where do nearshoring and onshoring fit?

Nearshoring and onshoring are refinements of the location axis, not alternatives to outsourcing.

Nearshoring means moving work to a nearby country, usually one sharing a time zone or a land border. For US firms that typically means Mexico, Costa Rica or Colombia. Onshoring means keeping the work inside the country, or bringing it back.

None of these terms says anything about who employs the worker. You can nearshore to your own subsidiary or nearshore to a contractor. For a disclosure inside your own firm, 26 CFR §301.7216-2(c)(2) keys on location: what counts is whether the preparer sits inside the United States or its territories and possessions. A nearshore preparer in Mexico is outside the United States, and the consent rule treats them exactly as it treats a preparer in India.

Can a firm outsource and offshore at the same time?

Yes, and most firms buying offshore accounting capacity are doing exactly that. Because the two words describe independent variables, they produce four possible arrangements rather than two. Mapping those four against the consent rule is the fastest way to see which variable is actually load-bearing.

Compare the two in-house boxes, then the two outsourced boxes. Crossing the border flips the answer in both pairs. Changing who employs the preparer flips it in neither. The employment relationship bites in exactly one narrow case, substantive determinations, and the regulation says so in a separate paragraph.

The variable the industry argues about is not the variable the regulation responds to.

Which distinction does the IRS actually enforce?

The IRS enforces the border. Section 7216 of the Internal Revenue Code makes it a crime for a tax return preparer to knowingly or recklessly disclose or use a client's tax return information without authorization, and the Treasury regulations then carve out the disclosures that are permitted without consent. The carve-out for work performed inside your own firm stops at the water's edge.

Here is the text that proves it. In 26 CFR §301.7216-2(c)(2), a preparer may disclose tax return information to another officer, employee or member of the same firm to help prepare the return. Then the paragraph adds:

"If an officer, employee, or member to whom the tax return information is to be disclosed is located outside of the United States or any territory or possession of the United States, the taxpayer's consent under §301.7216-3 prior to any disclosure is required."

26 CFR §301.7216-2(c)(2)

The regulation illustrates the point with a paired hypothetical. In Example 2, a firm's employee in its State A office discloses a client's return information to an employee in its State B office. No consent required, because the recipient is "employed by the same tax return preparer located within the United States." In Example 3, the facts are identical except the recipient sits in the firm's Country F office. Consent is required.

Both employees work for the firm. Neither engagement is outsourced. The border, and only the border, changed the answer. The provision is in force today, at eCFR, 26 CFR §301.7216-2.

When does the outsourcing relationship trigger consent?

The relationship does matter in one place. Under §301.7216-2(d)(1), a preparer may disclose return information to a different preparer located in the United States for preparation or auxiliary services without consent, but only "so long as the services provided are not substantive determinations or advice affecting the tax liability reported by taxpayers." The regulation defines a substantive determination as one involving "an analysis, interpretation, or application of the law." Hand substantive judgment to an outside US preparer and you need consent after all.

So the honest summary: the border flips the consent answer categorically, and the outsourcing relationship flips it only when the outsider is exercising legal judgment.

What does section 7216 require when a preparer sits outside the United States?

Consent, in writing, before any disclosure. Not after. Rev. Proc. 2013-14 sets the format and the mandatory language, and section 5.04(1)(e) requires that a consent to disclose to a preparer outside the US contain a specific sentence. Where the Social Security number is masked or redacted, that sentence is:

"This consent to disclose may result in your tax return information being disclosed to a tax return preparer located outside the United States."

A few mechanics matter more than firms expect. The consent must be a separate written document, not a clause buried in the engagement letter, though it may be attached to one. It must be knowing and voluntary, and conditioning your services on a client's consent normally makes that consent involuntary. This arrangement is the exception.

Under 26 CFR §301.7216-3(a)(2), a preparer "may condition its provision of preparation services upon a taxpayer's consenting to disclosure of the taxpayer's tax return information to another tax return preparer" for preparation or auxiliary services, and the regulation's own example applies that to a preparer in the country where the work is done. If the client does not specify a duration, 26 CFR §301.7216-3(b)(5) makes the consent "effective for a period of one year from the date the taxpayer signed the consent," which means offshore-supported firms are re-papering consents every season.

Rev. Proc. 2013-14 is still the operative guidance. The IRS Section 7216 Information Center points practitioners to it, together with Rev. Proc. 2013-19, which extended its effective date. You can read the procedure itself in the IRS PDF of Rev. Proc. 2013-14.

What happens when a Social Security number crosses the border?

By default, a client's Social Security number does not cross the border. Under 26 CFR §301.7216-3(b)(4)(i), a preparer located inside the United States "may not obtain consent to disclose the taxpayer's social security number (SSN)" for a Form 1040-series taxpayer to a preparer located outside the United States. The regulation prescribes the remedy in the same breath: the US preparer "must redact or otherwise mask the taxpayer's SSN before the tax return information is disclosed outside of the United States."

Masking is therefore the ordinary route. It is also the more protective one, because it removes the question entirely.

There is a single exception, at §301.7216-3(b)(4)(ii). The US preparer may obtain that consent only if it discloses the SSN "through the use of an adequate data protection safeguard" and "verifies the maintenance of the adequate data protection safeguards in the request for the taxpayer's consent." Rev. Proc. 2013-14 §5.07 defines that safeguard, and the requirement is mutual:

"a tax return preparer located within the United States ... may disclose a taxpayer's SSN to a tax return preparer located outside of the United States ... with the taxpayer's consent only when both the tax return preparer located within the United States and the tax return preparer located outside of the United States maintain an adequate data protection safeguard at the time the taxpayer's consent is obtained and when making the disclosure."

An adequate data protection safeguard is a management-approved and implemented security program, policy and practice covering administrative, technical and physical safeguards, and it has to meet or conform to one of six privacy or data-security frameworks the procedure lists. Note the word both. Your provider's controls do not discharge your obligation, and yours do not discharge theirs.

If the number travels unmasked, section 5.04(1)(e)(ii) of the same procedure requires a longer mandatory statement that names the Social Security number explicitly, so the client knows precisely what is crossing the border.

What are the penalties under sections 7216 and 6713?

Both a criminal and a civil penalty attach, and they run in parallel.

Section 7216(a) makes an unauthorized disclosure or use a misdemeanor. On conviction, the preparer "shall be fined not more than $1,000 ($100,000 in the case of a disclosure or use to which section 6713(b) applies), or imprisoned not more than 1 year, or both, together with the costs of prosecution" (26 U.S.C. §7216).

Section 6713 adds the civil penalty: $250 for each disclosure or use, capped at $10,000 in a calendar year. Where the disclosure or use is made in connection with a crime relating to the misappropriation of another person's taxpayer identity, 26 U.S.C. §6713(b) substitutes $1,000 for $250 and $50,000 for $10,000, and the two caps run separately. Congress added that enhancement in the Taxpayer First Act of 2019, which is why the 2013 revenue procedure still prints only the lower figures.

Read that as a criminal matter rather than a paperwork slip. A misdemeanor conviction attaches to a person, and a state board of accountancy will take its own view of one. That is why the consent paperwork deserves more attention than the rate card.

Which distinction does the AICPA enforce?

The AICPA enforces the relationship. Three interpretations in the AICPA Code of Professional Conduct govern the use of a third-party service provider, and all three are triggered by a single fact: the provider is a third party. Not one of them contains a geography test.

Across the full text of ET 1.150.040, 1.300.040 and 1.700.040 in the AICPA Code of Professional Conduct, the words "offshore", "foreign", "outside the United States", "country" and "located" appear zero times. A provider three miles away and a provider on another continent are treated identically.

What do the three interpretations require?

Each one asks for something different, in the Code's own words.

1. Tell the client first. ET 1.150.040 .02 says that before disclosing confidential client information to a third-party service provider, "the member should inform the client, preferably in writing, that the member may use a third-party service provider." If the client objects, the member "either should not use the third-party service provider ... or should decline to perform the engagement."
2. Vet and supervise the provider. ET 1.300.040 .01 says the member should first ensure the provider "has the required professional qualifications, technical skills, and other resources," and that the member "must adequately plan and supervise the third-party service provider's professional services."
3. Contract for confidentiality, or get specific consent. ET 1.700.040 .02 says that before disclosing, the member "should do one of the following": enter a contractual agreement obliging the provider to maintain confidentiality with "reasonable assurance" of appropriate procedures, or obtain the client's specific consent.

Note the Code's verbs. "Should" for informing the client, for vetting the provider, and for the confidentiality contract. "Must" for planning and supervising the provider's work.

One carve-out is worth knowing. ET 1.150.040 .03 says a member need not inform the client when the provider supplies only administrative support services, and it names record storage, software application hosting and authorized e-file transmittal as examples. Preparing a return is not administrative support.

Put the two rulebooks side by side and the keyword resolves itself. Outsourcing is the word that activates the AICPA Code. Offshoring is the word that activates section 7216. If both words describe your arrangement, both rulebooks are live at once, and they impose different duties on different triggers.

Who is liable when an offshore preparer gets it wrong?

You are. When you delegate the work, the responsibility for it stays with your firm. The signature is yours, and so is the duty behind it.

Circular 230 §10.36(a) places an affirmative obligation on whoever holds principal authority over a firm's federal tax practice. That person "must take reasonable steps to ensure that the firm has adequate procedures in effect for all members, associates, and employees for purposes of complying with subparts A, B, and C of this part." Under §10.36(b), failing to do so through "willfulness, recklessness, or gross incompetence," where a pattern of non-compliance follows, exposes that individual to discipline. The text is in Treasury Department Circular No. 230 (Rev. 6-2014).

Read §10.36(a) closely and you will notice it speaks to the firm's own "members, associates, and employees." The duty to supervise a third-party provider arrives elsewhere: through AICPA ET 1.300.040, which requires the member to plan and supervise the provider's professional services, and through the plainest fact of all, your name is on the return.

That is why, at Accountably, the signature, the opinion and the final judgment stay with your firm. You sign; we make it signable. Every return moves through preparer, senior, quality and final review before it reaches your desk.

So which model should your firm choose?

Choose on capacity, control and continuity, then handle the compliance consequences of whatever you chose. Choosing on the label is backwards, because the label does not determine the outcome.

When outsourcing is the right call

Outsourcing suits a firm that needs capacity faster than it can hire, and that would rather buy a trained team than build one.

The advantages are real. You skip recruiting, onboarding and the fixed cost of a seat you might not fill in September. You can start with one or two people and add more as the work proves out. A provider carrying a bench absorbs turnover that would otherwise land on you.

The disadvantages are equally real. You give up direct employment control. Provider quality varies enormously, and a bad provider is worse than no provider, because you pay twice: once for the work and again for reviewing it properly. You take on vendor-management overhead, and you inherit whatever data-security posture the provider actually has rather than the one on its website.

When offshoring is the right call

Offshoring suits a firm with enough consistent volume to keep a team busy year-round, and enough process discipline to hand that team something repeatable.

The domestic hiring market is the honest argument for it. US schools awarded 55,152 accounting bachelor's and master's degrees in the 2023-24 academic year, a 6.6% drop from the year before, according to the AICPA's 2025 Trends report (Journal of Accountancy). Enrollment is recovering: spring 2025 reached 266,506 students in two- and four-year accounting programs, up 12.4% and the highest total since 2020. Those students are still years away from a reviewer's desk, which is the gap firms are staffing around today.

Cost is the obvious lever, and the one everybody leads with. But the real prize is removing capacity as the ceiling on what the firm can accept.

The disadvantages: section 7216 consent becomes mandatory, per-client, before any disclosure. Time-zone separation makes ad-hoc questions expensive. Your data crosses a border, and where unmasked Social Security numbers travel, the safeguard obligation is yours as much as the provider's. Client perception is a factor whether or not you think it should be.

Building your own offshore entity gives you maximum control and takes the longest. Buying capacity through a provider is faster and gives you less of it. Between those poles sit dedicated teams, white-label delivery and build-operate-transfer arrangements, and it is worth understanding how those offshore engagement models compare before you commit. Most firms do not have the volume to justify building, which is why offshore outsourcing became the standard way to add capacity.

What actually decides whether the work is any good?

Neither word predicts quality.

Offshore engagements that fail rarely fail on talent or process. They fail on trust, and specifically on a firm having no way to verify quality until a return is already carrying its signature. Nothing in the outsourcing-versus-offshoring debate touches that.

So evaluate the things that actually produce quality:

• Who reviews the work before it comes back to you, and can the provider name those people?
• How were the preparers trained on US tax, and how long does it take them to learn your software and your SOPs?
• What happens to a file when the person who owns it rolls off?
• Can you see work in progress, or only the finished product?
• Will the provider run a small block of your real work before you commit a client file to it?

A provider that cannot answer those questions is selling you resumes.

Why is offshoring controversial?

Offshoring is controversial because it moves jobs across a border, and reasonable people object to that on grounds that have nothing to do with tax regulation.

The objections worth taking seriously come in three forms. The economic one: offshore work displaces domestic employment, and the displaced do not get a vote. The perception one: some clients dislike learning that their tax data was handled abroad, and finding out from a consent form rather than from you makes it worse. The quality one: many firms tried offshore support, got poor work, spent more time fixing it than doing it, and concluded the model was broken.

We would steelman the third objection rather than dismiss it, because the firms making it are usually right about what happened to them. What failed in most of those engagements was the setup, not the geography. Untrained preparers, no SOPs, no review layer, and a vendor incentivized to fill seats rather than protect a signature will produce bad work from any postcode.

None of that resolves the economic objection. It should not. A firm should make that call with its eyes open, and it should tell its clients before a consent form does.

What should your firm do before work crosses a border?

Work out which of the four boxes you are in.

If any preparer touching your clients' return information sits outside the United States, you need the client's written consent under section 7216 before disclosure, in the mandatory language, with the Social Security number masked or, if it travels unmasked, an adequate data protection safeguard maintained on both sides. If any of those preparers is a third party rather than your employee, the AICPA Code says you should tell the client before you disclose their information, and you must adequately plan and supervise the provider's work.

Then stop litigating the label and start evaluating the provider.

Since 2022 we've placed 30+ trained accountants and tax preparers inside 20+ US firms. The Busy-Season Capacity Team ramps on your software and SOPs in 3 to 4 weeks. One mid-size firm ran 600 returns through our white-label tax team in 12 weeks, all on time, freeing 25+ hours a week.

Before any live, signature-bearing work, you can run a Free 40-Hour Proof Pilot: a fixed 40-hour block of your own representative work, prepared on your SOPs and software and put through full multi-layer review, so your reviewer grades real work before you commit a single client file. Consent and safeguards come first; the pilot does not skip them. The point is the proof.

If you're a firm carrying this volume, don't trust us. Test us. Start a Free 40-Hour Proof Pilot.

Frequently asked questions

Is offshoring the same as outsourcing?

No. Outsourcing describes who performs the work, meaning a third party rather than your own employee. Offshoring describes where the work is performed, meaning another country. An arrangement can be one, both, or neither.

Can you outsource without offshoring?

Yes. A firm that contracts a domestic bookkeeping company has outsourced without offshoring anything. Under 26 CFR §301.7216-2(d)(1), disclosing return information to that US-located provider generally does not require client consent, provided the provider is not making substantive determinations, meaning an analysis, interpretation or application of the law.

Does the IRS require client consent to send tax work offshore?

Yes. If the recipient is your own officer, employee or member located outside the United States or its territories and possessions, 26 CFR §301.7216-2(c)(2) requires the taxpayer's consent under §301.7216-3 before any disclosure. If the recipient is a third-party provider, §301.7216-2(d)(1) permits consent-free disclosure only to a preparer located within the United States, so an offshore provider needs consent under §301.7216-3 as well. Rev. Proc. 2013-14 §5.04(1)(e) prescribes the mandatory wording that consent must contain.

Does the AICPA require client consent to use a third-party service provider?

Notice in most cases, consent in some. ET 1.150.040 .02 says the member should inform the client, preferably in writing, before disclosing confidential client information to a third-party service provider. ET 1.150.040 .03 carves out providers supplying only administrative support services, such as record storage, software application hosting and authorized e-file transmittal, where no notice is required. ET 1.700.040 .02 then says the member should either contract with the provider for confidentiality with reasonable assurance of appropriate procedures, or obtain the client's specific consent.

Who is responsible if an offshore preparer makes a mistake on a return?

The signing firm. Circular 230 §10.36(a) requires whoever holds principal authority over the firm's federal tax practice to take reasonable steps to ensure adequate compliance procedures, and AICPA ET 1.300.040 .01 says the member "must adequately plan and supervise the third-party service provider's professional services." Neither obligation transfers to a provider by contract. The practical safeguard is the review layer standing between the preparer's work and your signature.

Is AI replacing offshoring?

Not the part that carries the signature. The rules do not change either way, because the AICPA duty to plan and supervise a third-party service provider under ET 1.300.040 .01 attaches to the provider being a third party, not to the tooling it uses. Whatever a firm automates, a human still signs the return, and the review standing behind that signature is still a human judgment.