Staff Augmentation vs Outsourcing for CPA Firms

There's a sentence in the Treasury regulations that settles most of this argument before you get to the vendor demos. Under Treas. Reg. §301.7216-2(c)(2), once a client furnishes tax return information to your firm in the United States, disclosing it to an officer, employee, or member of your own firm who is located outside the United States requires the taxpayer's consent first.

Not the vendor's consent. Not a clause in a services agreement. The taxpayer's, in writing, before the disclosure.

It applies to your own employee. So the standard framing, where staff augmentation means you keep control and outsourcing means you hand off responsibility for the outcome, stops working the moment the buyer is a CPA firm instead of a software company.

The staff-augmentation/outsourcing distinction was built for a technology buyer hiring engineers. That buyer can genuinely transfer responsibility for a deliverable. You can't. Your name goes on the return, and the profession has written down, in several places, exactly what stays with you.

The short version: staff augmentation and outsourcing differ on three things, which are who directs the work day to day, who owns the client relationship, and how the work is priced. Three things don't move: the signature, the primary responsibility for substantive accuracy, and the §7216 consent obligation.

On this page:

• What is the difference between staff augmentation and outsourcing?
• Is staff augmentation considered outsourcing?
• Who supervises the work under each model?
• Who signs the return, and who carries the substantive accuracy?
• Does sending tax work offshore require the client's consent?
• Who owns the client relationship?
• How is each model priced, and who carries the idle-capacity risk?
• When should a firm choose staff augmentation over outsourcing?
• What goes wrong with each model?
• What has to be in place before either model starts?
• Frequently asked questions
• What actually changes, and what doesn't?

Key takeaways

• Staff augmentation and outsourcing are both forms of outsourcing. The difference is where day-to-day supervisory control sits, not whether you've "outsourced."
• Once your client furnishes tax return information to your firm in the United States, you cannot send it to an offshore preparer to prepare or help prepare the return without the taxpayer's prior consent. The no-consent preparer-to-preparer lane reaches only a second preparer "located in the United States" (Treas. Reg. §301.7216-2(d)(1)), and paragraph (c)(2) requires consent even when the offshore person is your own firm's employee. The engagement model does not change this.
• The signing tax return preparer holds "the primary responsibility for the overall substantive accuracy" of the return (Treas. Reg. §301.7701-15(b)(1)). That person is at your firm under both models.
• AICPA Code 1.300.040 requires a member to "adequately plan and supervise the third-party service provider's professional services." The supervision duty follows you into an outsourcing arrangement.
• A US preparer generally may not obtain consent to disclose a Form 1040 Series filer's Social Security number offshore, and must redact or mask it, unless a narrow safeguard exception is met and verified (Treas. Reg. §301.7216-3(b)(4)).
• The three axes that actually differ are day-to-day supervisory control, client-relationship ownership, and pricing structure, which is also what decides who eats the cost of an idle seat in September.

What is the difference between staff augmentation and outsourcing?

Staff augmentation and outsourcing are both ways of getting work done by people you don't employ. In staff augmentation, you rent capacity: a named person works inside your firm's workflow, on your software and your standard operating procedures (SOPs), and your reviewer directs and reviews their work day to day. In outsourcing, you buy an outcome. The provider takes a defined scope of work, runs it with its own manager and its own reviewers, and hands back a deliverable.

The dividing line is day-to-day supervisory control. Staff augmentation puts it inside your firm. Outsourcing puts it at the provider.

A quick way to feel the difference: in staff augmentation you scale headcount, and in outsourcing you scale scope. If you want three more sets of hands under your existing review chain, that's augmentation. If you want 400 individual returns prepped, reviewed, and returned to you before April 15, that's outsourcing.

Those five rows are the whole of the difference, and they come down to three axes: who directs the work, who owns the client, and how it's priced (what you scale falls out of the first, and who carries the idle seat falls out of the third). The rest of what a firm cares about, the signature and the standards and the consent, is identical on both sides, and the rules say so explicitly.

Is staff augmentation considered outsourcing?

Yes. Staff augmentation is a form of outsourcing, and it's worth saying plainly because a lot of vendors (including offshore ones) sell staff augmentation as the thing that isn't outsourcing.

It is. You are paying an outside organization for labor you do not employ.

Outsourcing names the relationship. Offshore names where the person happens to sit. Staff augmentation names how the work is directed once it starts.

The reason the distinction gets marketed so hard is that "outsourcing" carries a decade of bad associations for firm owners: a black box, a queue, a returned workpaper you have to rebuild. Renaming the same relationship doesn't fix any of that. Changing where the review happens does.

Under the AICPA Code of Professional Conduct, the label doesn't buy you anything either. Read interpretation 1.300.040 and notice what it keys on. It covers a member who uses a third-party service provider "to assist the member in providing professional services such as bookkeeping, tax preparation, or consulting or attest services, including related clerical or data entry functions." The trigger is the provider's status, not the engagement's style.

And the Code's definitions settle what that status is: a third-party service provider includes "an individual not employed by the member who assists the member in providing professional services to clients" (ET §0.400.52). If the person isn't your employee, that's who you're using, and the interpretations apply.

Who supervises the work under each model?

Day to day, your reviewer supervises under staff augmentation, and the provider's manager supervises under outsourcing. In professional-standards terms, you supervise under both.

The AICPA Code is direct about this. Before using a third-party service provider, the member "should ensure that the third-party service provider has the required professional qualifications, technical skills, and other resources." And then this, which is the sentence to underline:

"the member must adequately plan and supervise the third-party service provider's professional services so that the member ensures that the services are performed with competence and due professional care."

Source: AICPA Code of Professional Conduct, interpretation 1.300.040 .01(b). The Code adds a real limit at .02, so this isn't unbounded: the responsibility for planning and supervising "does not extend beyond the requirements of applicable professional standards, which may vary depending upon the nature of the member's engagement." Note that the AICPA Code binds AICPA members; your state board may impose its own parallel rule, and you should check yours.

There's a firm-level duty sitting on top of that.

Circular 230 §10.36(a) puts an obligation on any individual who has, or individuals who have or share, "principal authority and responsibility for overseeing a firm's practice" governed by the regulation, including the preparation of tax returns, to "take reasonable steps to ensure that the firm has adequate procedures in effect for all members, associates, and employees" for purposes of complying with the regulation.

The same paragraph adds the part firms rarely read: "In the absence of a person or persons identified by the firm as having the principal authority and responsibility described in this paragraph, the Internal Revenue Service may identify one or more individuals subject to the provisions of this part responsible for compliance with the requirements of this section" (31 CFR 10.36).

So the practical question isn't "who supervises." It's whether the supervision you're duty-bound to perform is something you actually have the hours to perform.

Under staff augmentation you do it directly, which costs your reviewer's time. Under a well-built outsourcing arrangement, the provider runs a review chain first and you supervise the output of a process rather than the keystrokes of a person. Both are real answers. Only one of them is compatible with a partner who's already the bottleneck.

Who signs the return, and who carries the substantive accuracy?

Your firm signs, under both models. And the regulation is specific about what signing means.

Treas. Reg. §301.7701-15(b)(1): "A signing tax return preparer is the individual tax return preparer who has the primary responsibility for the overall substantive accuracy of the preparation of such return or claim for refund." That person is at your firm. No engagement model relocates them.

Two details from the same section matter more than they look. First, §301.7701-15(a) defines a tax return preparer as "any person who prepares for compensation, or who employs one or more persons to prepare for compensation, all or a substantial portion of any return." Your firm is a preparer because it employs preparers.

Second, the regulation draws a line further down that most offshore conversations skip entirely: at (f)(1)(viii), "an individual providing only typing, reproduction, or other mechanical assistance in the preparation of a return or claim for refund" is not a tax return preparer at all.

So where your offshore staff land, nonsigning preparer under (b)(2)(i) or not a preparer under (f)(1)(viii), depends on what they actually do, not on what the engagement is called (26 CFR 301.7701-15).

Then there is §301.7216-2(d)(1). A tax return preparer may disclose tax return information to another tax return preparer, without consent, only where that second preparer is "located in the United States (including any territory or possession of the United States)," and only "so long as the services provided are not substantive determinations or advice affecting the tax liability reported by taxpayers." The regulation then defines the term for you: "A substantive determination involves an analysis, interpretation, or application of the law."

That is the fault line for what may move without consent. Data entry, workpaper assembly, and return processing sit on one side. Deciding whether an expense is deductible sits on the other. The same paragraph closes the loop, and it is a consent rule, not a competence rule: "Except as provided in paragraph (c) of this section, a tax return preparer may not disclose tax return information to another tax return preparer for the purpose of the second tax return preparer providing substantive determinations without first receiving the taxpayer's consent in accordance with the rules under §301.7216-3" (26 CFR 301.7216-2).

So consent can open that door. What consent never moves is the primary responsibility for the overall substantive accuracy of the return, which stays with the signing tax return preparer at your firm, alongside the duty to plan and supervise the provider's work. Whatever the engagement is called, the last set of eyes before the return is filed belongs to your firm.

Does sending tax work offshore require the client's consent?

Yes. Once your US client furnishes tax return information to your firm, sending it to an offshore preparer to prepare the return requires the taxpayer's written consent first, under both models. This is the part that survives whichever model you choose.

Start with the arrangement that looks safest. Treas. Reg. §301.7216-2(c)(2) is titled "Tax return preparers located within the same firm in the United States." Where "a taxpayer furnishes tax return information to a tax return preparer located within the United States," the paragraph lets an officer, employee, or member of that preparer use the information and disclose it internally to assist in preparing the taxpayer's return.

Then it adds: "If an officer, employee, or member to whom the tax return information is to be disclosed is located outside of the United States or any territory or possession of the United States, the taxpayer's consent under §301.7216-3 prior to any disclosure is required" (26 CFR 301.7216-2).

The regulation's own Example 3, at (c)(4), spells it out. A firm's employee in State A discloses a client's tax return information to FE, an employee in the firm's Country F office, and the regulation concludes: "Because FE is outside of the United States, Firm is required to obtain T's consent under §301.7216-3 prior to E's disclosure of T's tax return information to FE" (26 CFR 301.7216-2).

Same firm. Same payroll. Consent required.

Now take the two engagement models, which are the arrangements that look riskier. A vendor's accountant is not an officer, employee, or member of your firm, so (c)(2) is not the paragraph you're in.

The paragraph that reaches an outside preparer is §301.7216-2(d)(1), and it permits disclosure without consent to "another tax return preparer (other than an officer, employee, or member of the same tax return preparer)" only where that second preparer is "located in the United States (including any territory or possession of the United States)." A dedicated staff-augmentation seat at a vendor and a white-label delivery team are both that second preparer.

Neither one is your employee. And once the seat sits abroad, neither one is located in the United States, which is exactly where the no-consent lane ends.

So all three roads run through one gate. Staff augmentation and outsourcing are identical here. If your vendor's pitch implies otherwise, that's a reason to walk.

The regulation does leave one door open, and it turns on your client rather than on your vendor. Under §301.7216-2(c)(3), if a taxpayer initially furnishes tax return information to a preparer located outside the United States, officers, employees, and members of that same preparer may use and disclose it among themselves without consent.

The regulation's Example 4 is a client temporarily living abroad who hands her file to the firm's Country F office. That is not a US client dropping a folder at your front desk.

And once the information reaches this country, the door shuts behind it: the firm "is required to receive T's consent under §301.7216-3 prior to any subsequent disclosure of T's tax return information to a tax return preparer located outside of the United States" (26 CFR 301.7216-2).

Four §301.7216-3 rules firms get wrong

Four more rules from 26 CFR 301.7216-3 that firms routinely get wrong:

1. No retroactive consent. "A taxpayer must provide written consent before a tax return preparer discloses or uses the taxpayer's tax return information" (§301.7216-3(b)(1)). A consent signed after the file left the country is not a fix. The executed consent also has to be handed back: the preparer "must provide a copy of the executed consent to the taxpayer at the time of execution" (§301.7216-3(c)(3)).
2. Uses and disclosures need separate documents. "A single written document, however, cannot authorize both uses and disclosures" (§301.7216-3(c)(1)). One document may cover multiple disclosures, or multiple uses, but it must "specifically and separately identify each disclosure or use." That paragraph is "inapplicable" to a taxpayer not filing a return in the Form 1040 series, whose consent "may be in any format, including an engagement letter to a client" (§301.7216-3(a)(3)(iii)). For a 1040 filer the default is stricter: outside that multiple-disclosure rule, consent to each separate disclosure or use "must be contained on a separate written document," though that document "may be provided as an attachment to an engagement letter furnished to the taxpayer" (Revenue Procedure 2013-14, § 5.01).
3. Consent expires. If a consent doesn't state a duration, it "will be effective for a period of one year from the date the taxpayer signed the consent" (§301.7216-3(b)(5)). That is a per-season problem, not a one-time onboarding task.
4. The Social Security number generally cannot go. Under §301.7216-3(b)(4)(i), a preparer located within the United States "may not obtain consent to disclose the taxpayer's social security number (SSN) with respect to a taxpayer filing a return in the Form 1040 Series ... to a tax return preparer located outside of the United States," and "must redact or otherwise mask the taxpayer's SSN before the tax return information is disclosed outside of the United States."

That fourth one has a narrow exception at §301.7216-3(b)(4)(ii): a US preparer may obtain consent to disclose the SSN offshore only where the disclosure goes "through the use of an adequate data protection safeguard as defined by the Secretary in guidance published in the Internal Revenue Bulletin," and where that preparer "verifies the maintenance of the adequate data protection safeguards in the request for the taxpayer's consent." The guidance that defines it is Revenue Procedure 2013-14, and its § 5.07 is a specification, not a checkbox.

An adequate data protection safeguard is "a management-approved and implemented security program, policy, and practice" with administrative, technical, and physical safeguards that conforms to one of the frameworks the revenue procedure lists, and both the US preparer and the offshore preparer must maintain it "at the time the taxpayer's consent is obtained and when making the disclosure." If you are relying on that exception, have your counsel confirm the current Internal Revenue Bulletin guidance, because that definition, not your vendor's security page, is the standard.

Two AICPA obligations on top of the tax rules

The AICPA Code adds two obligations on top of the tax rules, and neither depends on the engagement model:

• Tell the client. Before disclosing confidential client information to a third-party service provider, "the member should inform the client, preferably in writing, that the member may use a third-party service provider." If the client objects, the member "either should not use the third-party service provider to perform the professional services or should decline to perform the engagement" (1.150.040 .02). There's a carve-out at .03 for administrative support services such as record storage, software application hosting, or authorized e-file tax transmittal.
• Contract for confidentiality, or get specific consent. Before disclosing, the member should either enter into a contractual agreement with the provider "to maintain the confidentiality of the information and provide reasonable assurance that the third-party service provider has appropriate procedures in place to prevent the unauthorized release of confidential information," or "obtain specific consent from the client" (1.700.040 .02).

Who owns the client relationship?

Under staff augmentation, the offshore person works inside your workflow and, in a properly scoped engagement, never appears to the client at all, so ownership isn't in question. Under outsourcing, you own it if, and only if, the provider is genuinely white-label.

That word does real work. A white-label delivery team operates under your firm's name, on your engagement letters, invisible to your client. A provider that emails your client directly, appears on a call unbadged, or treats your firm as a channel to a relationship of its own is not white-label, whatever the contract says.

Ask three questions before you sign. Does anyone at the provider ever contact my client? Whose name is on the workpapers and the deliverable? If we part ways, what does the client experience?

If the answers are fuzzy, the model isn't the problem. The provider is.

How is each model priced, and who carries the idle-capacity risk?

Staff augmentation is priced per seat, hourly or monthly, scaled by seniority and complexity. Outsourcing is priced per engagement or per unit of output. That difference determines who eats the cost of a quiet September.

Under staff augmentation, you carry idle-capacity risk. A dedicated seat is yours in April and yours in September, which is a bargain if you have year-round work and an expensive way to store an empty chair if you don't. Under outsourcing, the provider carries that risk and prices it into the engagement. You are paying a premium for elasticity, and the premium is rational.

Neither is cheaper in the abstract. Utilization decides it, so model your real monthly volume across 12 months before you compare any two quotes.

Rate is the easiest number to compare and the least useful one. The number that decides the engagement is your effective cost per hour of work actually delivered, and a firm that switches models to shave the headline rate while still turning work away has optimized the wrong one.

When should a firm choose staff augmentation over outsourcing?

Choose staff augmentation when you have consistent, year-round work and a review chain with the capacity to direct people. Choose outsourcing when your volume is seasonal, your team is small, or you need a whole function delivered rather than hands added to yours.

The clean segmentation is by workflow, not by firm size:

• Consistent year-round work (monthly bookkeeping, recurring compliance, a steady 1040 and 1120 book): dedicated staff augmentation. The seat pays for itself, and continuity compounds because the same person learns your clients.
• Seasonal or spiky work (a January-to-April surge, a one-off cleanup, a sudden 300-return backlog): outsourcing to a white-label delivery team with its own manager and reviewers. You buy throughput, not headcount.
• A firm serious about long-term offshore control: a Build-Operate-Transfer (BOT) arrangement, where a provider builds and runs the team, then transfers it to you. This is the only one of the three where you eventually own the entity, and it's a multi-year commitment, not a busy-season decision.

Those three map to the engagement models a firm can buy, and the implication is blunt: a dedicated offshore seat is the wrong recommendation for a solo EA with four spiky months. A dedicated seat sold to a seasonal firm is how offshore gets its bad name.

Can a firm use both models at once?

Yes, and it's a common mature setup. Dedicated seats carry the recurring book year-round. A white-label team absorbs the busy-season spike on top. The seats give you continuity, the delivery team gives you elasticity, and the reviewer chain is the same either way.

The failure mode to watch is a fragmented review chain. If your dedicated seats route through your reviewer and your seasonal returns route through a provider's reviewer, decide in advance who resolves a disagreement about a position, and write it down.

What goes wrong with each model?

Both models fail, and they fail in opposite directions. Knowing which failure you're buying is most of the decision.

Staff augmentation fails when there's no review layer behind the seat. You've rented a preparer, so every error surfaces at your desk, and you become the trainer, the reviewer, and the quality-control function. The partner who offshored to buy back review time is now spending more of it. Red flags: no review layer of any kind behind the seat, "we'll adapt to your process" from a provider with no process of its own, and a resume-driven pitch that never mentions who checks the work.

Outsourcing fails when substantive determinations happen where you can't see them. A workpaper comes back with a position taken and no visible reasoning. Now you're reconstructing judgment under deadline, which is slower than doing it yourself. Red flags: no visibility into the workflow, no named reviewer you can call, no record of who decided what, and any suggestion that offshore work is somehow outside §7216 because it's structured as a service rather than a staffing arrangement. The disclosure rules at 26 CFR 301.7216-2 key on where the recipient sits and whether they work for you, never on what the engagement is called.

And the model most firm owners distrust deserves its due: outsourcing done well beats staff augmentation done badly, every time. A white-label team with a preparer, a senior, a quality reviewer, and a final reviewer standing between a mistake and your signature is a stronger control environment than one unsupervised offshore hire sitting in your workflow. A named review chain is a structure. "We'll integrate with your team" is not.

What has to be in place before either model starts?

You can execute all of it this week, and it's identical under both models.

1. Get written §7216 consent before any disclosure. Not after (Treas. Reg. §301.7216-3(b)(1)). Have counsel draft it against §301.7216-3(a)(3)'s content requirements and, for a Form 1040 series client, against the separate-document rule and the mandatory statements in Revenue Procedure 2013-14, § 5.01 and § 5.04. Give the client a copy at execution.
2. Use separate documents for uses and disclosures, and specifically and separately identify each disclosure or use (§301.7216-3(c)(1)).
3. State a duration, or plan around the one-year default (§301.7216-3(b)(5)). Calendar the renewal with your engagement letters.
4. Mask SSNs on Form 1040 Series files before they leave the US (§301.7216-3(b)(4)(i)), unless you meet and verify the adequate-data-protection-safeguard exception at (b)(4)(ii), which both you and the offshore preparer have to maintain. Confirm the current Internal Revenue Bulletin definition with counsel.
5. Inform the client, preferably in writing, that you may use a third-party service provider (AICPA 1.150.040 .02). Decide in advance what you'll do if a client objects, because the Code says you don't use the provider or you decline the engagement.
6. Contract for confidentiality with reasonable assurance of controls, or obtain specific client consent (AICPA 1.700.040 .02). Ask any provider whether its controls are SOC 2-aligned or whether an independent CPA has issued it a SOC 2 report, and ask to see whatever report backs the answer. Those are different claims.
7. Vet qualifications before you use the provider, and name your reviewer. Write down who plans and supervises the work (AICPA 1.300.040 .01), and make sure the partner with principal authority has adequate firm procedures in effect (Circular 230 §10.36(a)).
8. Prove it on work that isn't live. No client file can lawfully move before item 1 is done anyway, so run mock returns, or a fixed block of representative work, through the offshore team and your own review chain first. Grade the workpapers, not the resumes.

Item 8 is the easiest one to skip, and it's the one that tells you something a reference call can't. A reference tells you a provider has clients. A graded stack of workpapers tells you exactly what your reviewer will be handed in March.

Frequently asked questions

What is another word for staff augmentation?

There's no official term. In practice you'll see resource augmentation, team extension, contract staffing, and staff leasing used for the same arrangement, and inside the accounting profession the plainer phrase is offshore staffing or outsourced staffing. The AICPA Code uses none of them. It calls the provider a third-party service provider, and which label you pick changes nothing about which duties attach.

What are the four types of outsourcing?

There isn't an authoritative set of four, and no professional standard binding a US firm classifies outsourcing into types. What people usually mean is one of two groupings: by location (onshore, nearshore, offshore) or by scope (a discrete project, a dedicated team, or a whole managed function). Both are marketing conventions, not classifications the rules that bind you recognize.

Is outsourcing a dying concept?

No. Accounting firms are outsourcing into sustained hiring demand, not out of it. The U.S. Bureau of Labor Statistics projects about 124,200 openings for accountants and auditors each year, on average, from 2024 to 2034, and employment growth of 5% across the same decade, with many of those openings expected to replace workers who leave the field. Capacity a firm cannot hire locally has to come from somewhere.

Which model is cheaper for a CPA firm?

That depends on utilization, not on the model. Compare effective cost per hour of work actually delivered rather than the quoted rate. A seat priced per month and busy 40% of the year costs you two and a half times its headline rate for every productive hour, while a per-engagement price already has the provider's idle time built in. Run your real monthly volume across 12 months, then compare.

Can a nonsigning offshore preparer make substantive determinations?

Yes, with the taxpayer's written consent, and the responsibility still isn't theirs. §7216 is a disclosure statute: it governs whether you may send tax return information to a person, not whether that person may exercise judgment. Treas. Reg. §301.7216-2(d)(1) permits preparer-to-preparer disclosure without consent only to a preparer "located in the United States," and only "so long as the services provided are not substantive determinations or advice affecting the tax liability reported by taxpayers"; consent is what opens that door.

What consent does not move is the primary responsibility for the overall substantive accuracy of the return, which stays with the signing tax return preparer at your firm (§301.7701-15(b)(1)), along with the duty to plan and supervise the third-party service provider's work (AICPA 1.300.040 .01(b)).

What actually changes, and what doesn't?

Three things change: who directs the work day to day (and so whether you scale headcount or scope), whether client-relationship ownership is conditional, and how it's priced (and so who carries the idle seat in September). Everything else stays with your firm under both models.

So pick the model on the questions that actually differ. Do you have year-round work and a reviewer with hours to direct someone, or seasonal spikes and a review chain that's already full? Do you want to scale headcount or scale scope? Who eats the idle seat in September?

Then stop treating the rest as a variable. The signature stays with you. The substantive accuracy stays with you. The supervision duty follows you into an outsourcing arrangement.

And the §7216 consent has to be in writing, before the file moves, whether the person opening it is your own employee in Bengaluru or a vendor's employee in Bengaluru.

Any provider who blurs those lines to make their model sound safer is telling you exactly how much of your risk they intend to carry.