Switching BPO providers looks like a procurement decision and behaves like a data migration. Business process outsourcing (BPO) is the umbrella term for handing a repeatable function to an outside firm, which in an accounting practice usually means bookkeeping, tax preparation, or payables.
For a stretch of weeks two outside firms usually hold the same client files, the consent your clients signed names the provider you are leaving, and nobody has written down the date the old team's logins stop working.
Get the sequence right and the switch is dull: inventory before notice, consent before files move, access ends on a stated date. Get it wrong and you find out in April.
What Switching BPO Providers Actually Puts at Risk
Three things are exposed in a provider switch, and none of them is the incoming team's skill.
Custody. The outgoing provider holds source documents, prepared files, workpapers, software data and the email trail. What you can get back, and in what format, depends on the contract you signed at the start rather than on a right you can assert once notice has gone out.
Consent. Tax return information reaches a new recipient the day onboarding starts, and the consent your client signed identified the recipient you are leaving.
Access. For the length of the overlap, two sets of credentials reach the same client data, and the set you have stopped paying is the one nobody is watching.
The duties below bind US accounting and tax practices. Where the outsourced work is customer support or claims handling, the transition mechanics still hold, but the legal duties come from your own regulator instead.
First Decide Whether a New Provider Fixes Anything
A switch resets the relationship. It does not reset the way work leaves your office.
Some failures really are the provider's: staff rotated onto your files without notice, agreed delivery windows missed in a pattern, the same defect returning after it was raised, or a refusal to show you a review record. A new provider can fix those, because those failures belong to the provider.
Other failures follow you. Work that arrives in a lump in the second week of March overwhelms any team. Treatments that live in a partner's head rather than in a written procedure get guessed at by any team. Scope that grew without being repriced stays under-resourced with any team. Where those describe your setup, a switch buys a fresh honeymoon and the same April.
List the last five things that went wrong and mark each one theirs or yours. The split between the two columns is your answer.
One more thing decides the date rather than the decision. Starting a migration inside a filing season runs the transition and the deadline through the same people, so if the relationship is survivable, finish the season and move in the quiet months.
Build the Custody Inventory Before You Give Notice
Inventory first, notice second. Once a provider knows the account is leaving, cooperation can turn into a negotiation.
Pull the current agreement before you pull the file list. The notice period sets the earliest date the switch can finish, the termination clause says whether you can leave for convenience or only for cause, and any exit assistance and data return terms decide what the outgoing team still owes you after notice goes out. Those three answers set every other date in the plan, including the access shutdown date, so read them before you promise anyone a timeline.
Treasury's rules of practice put the record-return duty on the practitioner rather than on any vendor standing behind them. Those rules are Circular 230, which governs practice before the IRS, mainly for attorneys, CPAs and enrolled agents (IRS, Circular 230 for tax professionals).
Section 10.28 says a practitioner "must, at the request of a client, promptly return any and all records of the client that are necessary for the client to comply with his or her Federal tax obligations," and may retain copies of what is returned. A fee dispute generally does not relieve the practitioner of that duty. Where state law does allow records to be held during a fee dispute, the practitioner "need only return those records that must be attached to the taxpayer's return," and must still give the client reasonable access to review and copy the rest.
Read the direction of that duty. It runs from your firm to your client, and it hands you no claim against a vendor who never practiced before the IRS, wherever that vendor sits. What it fixes is the standard you get measured against while your clients' records sit on somebody else's server, which is why the inventory comes before the notice.
The profession also has settled vocabulary for the categories. The AICPA Code of Professional Conduct's revised "Records Requests" interpretation, effective July 31, 2021, separates client-provided records, member-prepared records, the member's work products such as tax returns, and working papers (The Tax Adviser, documentation and recordkeeping for tax practitioners). On a client request, client-provided records may not be withheld, member-prepared records and work products generally have to be provided, and working papers generally do not, subject to law and to contract terms.
That last category is where a switch bites. AICPA guidance summarized by The Tax Adviser concludes that the electronic data file inside a member's tax preparation software is a working paper rather than a member-prepared record, even though it carries data taken from the client's records. Now apply that to an arrangement where the outgoing provider prepared inside its own software instance instead of yours. The artifact you most want back is the one least likely to travel on a request. It has to be named in the contract before you need it.
Then build the list. Ask for each item in native format, with a delivery date and a named person on both sides.
- Client source documents you routed through the provider. These are the client's own records and they come back untouched. Check them against your intake log, not against the provider's index.
- Prepared files and supporting workpapers. Ask for the working file rather than an exported PDF set. A PDF shows what was concluded and hides how.
- Tax and accounting software data. Name the software and the file type in writing. If the work happened in the provider's instance, this is the item that needs a contractual hook.
- The query and correspondence trail. Client answers to open questions are the audit trail for every judgment call, and they usually live in a portal or an inbox that goes dark at cutover.
- Procedures, checklists and templates built during the engagement. Whether these are yours depends on what the contract says about work product. Read that clause before you draft the notice.
- The list of named users and their access rights. You cannot switch off what you never enumerated, and this list becomes the shutdown checklist later.
Re-Paper Client Consent Before Any File Moves
A consent naming your old provider does not authorize your new one.
Check first whether consent was the basis at all. Disclosure to a preparer located in the United States for preparing a return or for auxiliary services does not require consent, as long as the work is not a substantive determination or advice affecting the tax liability, while the same work sent to a preparer outside the United States does (eCFR, disclosures to other tax return preparers). Offshore switches sit in the second group, and so does most of what follows.
Under the section 7216 consent regulations, a taxpayer's consent to disclose tax return information has to carry the name of the preparer and the taxpayer, identify the intended purpose of the disclosure, and, outside a narrow exception, "identify the specific recipient (or recipients) of the tax return information" (eCFR, section 7216 consent rules). Change the recipient and you have changed the thing the client agreed to.
Timing is not negotiable either. The same regulation states that "a taxpayer must provide written consent before a tax return preparer discloses or uses the taxpayer's tax return information," so a consent gathered after the migration weekend repairs nothing.
Duration catches firms out in the other direction. Where a consent does not say how long it lasts, it runs "for a period of one year from the date the taxpayer signed the consent" (eCFR, duration of consent), so a switch made a season or more after the paperwork was signed can land on consents that already expired.
Individual returns add the offshore rule. Where the receiving preparer sits outside the United States, the taxpayer's consent is required before any disclosure. For Form 1040 series filers a preparer inside the United States may not obtain consent to disclose the taxpayer's social security number, and must "redact or otherwise mask" it before the information goes abroad. That exception is narrow. The number may travel only through an adequate data protection safeguard as defined by the Secretary in guidance published in the Internal Revenue Bulletin, with its maintenance verified in the consent request. Ask the incoming provider how masking works in their intake before the first file moves.
Ethics adds an earlier step that firms often skip on a switch. The AICPA's "Use of a Third-Party Service Provider" interpretation requires the firm to inform the client, preferably in writing, that a third party may be used on the engagement, and that disclosure is required before confidential information reaches the third party (Journal of Accountancy, working with third-party experts). A new provider is a new third party, so the notice comes due again.
The penalties are why this sequence earns a calendar entry. Section 7216 makes a knowing or reckless disclosure a misdemeanor, punishable by a fine of not more than $1,000, or imprisonment of not more than 1 year, or both, together with the costs of prosecution, with a higher maximum where the disclosure connects to a crime involving another person's taxpayer identity (26 U.S. Code section 7216). Section 6713 adds a civil penalty of $250 for each disclosure or use, and the total for a calendar year cannot exceed $10,000 (26 U.S. Code section 6713).
End the Old Provider's Access on a Date, Not on a Feeling
Pick the date, write it down, and give one person the job.
What the Safeguards Rule Already Requires
Firms covered by the FTC Safeguards Rule already owe this. The rule requires covered firms to implement and periodically review access controls that "authenticate and permit access only to authorized users" and that limit users to the information they need for their duties (eCFR, FTC Safeguards Rule section 314.4). A departing provider's team stops being an authorized user on a date you choose, not on the date their last invoice clears.
Coverage runs wider than the phrase "financial institution" suggests. The FTC's own guidance points to the paragraph of the rule listing 13 examples of covered entities, and tax preparation firms sit on that list (FTC, Safeguards Rule: what your business needs to know).
The rule also tells covered firms to evaluate and adjust the information security program in light of "any material changes to your operations or business arrangements" (eCFR, FTC Safeguards Rule). Replacing the outside firm that touches your clients' data is that kind of change, and the program document is where the new provider's controls, contacts and access list belong.
Oversight is a standing duty rather than a one-time check. Covered firms have to take reasonable steps to select and retain service providers "capable of maintaining appropriate safeguards," require those safeguards by contract, and periodically assess providers "based on the risk they present and the continued adequacy of their safeguards" (eCFR, oversight of service providers). A switch is the natural moment to write that assessment cadence into the new contract, instead of discovering two seasons later that nobody owned it.
Retention runs on a clock as well. The rule requires procedures for the secure disposal of customer information "no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates" (eCFR, secure disposal of customer information). Information necessary for business operations or otherwise required to be retained by law is excepted, as is information where targeted disposal is not reasonably feasible because of the way it is maintained, and the rule asks for periodic review of the retention policy. The same logic belongs on the copies the outgoing provider keeps, so get their disposal commitment in writing with a date on it.
If customer data is taken during the overlap, the reporting duty is yours. The rule defines a notification event as the acquisition of unencrypted customer information without the authorization of the individual to which the information pertains (eCFR, Safeguards Rule definitions), and it requires notifying the Federal Trade Commission of such an event involving the information of at least 500 consumers as soon as possible and no later than 30 days after discovery (eCFR, notification events). It also treats the event as discovered once it is known to any of your employees, officers or other agents, other than the person who committed the breach, so trouble inside a vendor's environment during a handover may already be running on your clock.
The written incident response plan is one of the few pieces smaller firms are excused from. Section 314.6 lifts four requirements from financial institutions that maintain customer information concerning fewer than five thousand consumers: the written incident response plan, the written risk assessment, the continuous monitoring or annual penetration testing, and the Qualified Individual's written report to the board or a senior officer. The notification duty above is not on that list, and neither are the access controls, the disposal clock or the service provider oversight, so a small firm still owes all four of those during a switch.
The Shutdown List
Run the shutdown from the user list you built during the inventory:
- Named accounts in every tax and accounting application, seat by seat
- VPN, remote desktop and any jump host
- Email accounts, aliases and shared inboxes
- Document portals, e-signature accounts and shared drives
- Practice management, workflow and time systems
- Bank portals, read-only feeds, and payroll or payables approvals
- Virtual desktops and any devices issued to their staff
One more item belongs on that list. Ask in writing what copies survive the disposal date, where they sit, and who signs the confirmation that the rest are gone.
Move the Work in Phases and Prove the New Team on Real Files
Cut over in stages, and define what "working" means before the first stage starts.
Set acceptance criteria you can actually grade: a defect definition, a turnaround window, a rework threshold, a query response time. Agreed before the move, they settle arguments. Agreed after, they are opinions.
Run a parallel period on a real, representative slice of work rather than a sample the provider picks. The point of parallel running is comparison against a known baseline, and the honest baseline is your own last cycle, in the same software, on the same client types.
Knowledge transfer has to end in replication. A recorded walkthrough proves someone watched. A file prepared unaided to your standard proves someone can do the work. Ask the incoming team for that file before their access widens.
Keep the outgoing team's rolloff overlapping the new team's ramp where the contract allows it, and keep the overlap short and dated. An open-ended overlap leaves two providers holding the same access, and one of them has no reason left to be careful.
What to Get in Writing From the Next Provider
The questions that separate providers are the ones about leaving, not the ones about arriving.
- The exit clause, in detail. What comes back, in what format, inside what window, and at whose cost. A provider who has done a clean handover before answers this quickly.
- Data location and surviving copies. Where files sit, which copies persist after termination, and what evidence of disposal you receive.
- The consent workflow. How they handle the section 7216 consent language, how social security numbers are masked on individual returns, and who verifies the consent exists before work starts.
- Subcontracting. Whether any part of your work travels to another firm or another country, and whether you approve that first.
- Named reviewers and turnover. Who reviews your work, what happens when that person leaves, and how the handover overlaps.
- Incident notice. How fast they tell you about a security event, in what detail, and to whom.
- A reference who left. A firm that left them, or left and came back, tells you more than a happy current client. A refusal tells you something too.
Questions Firms Ask About Switching BPO Providers
What Is BPO Transition Management?
It is the work of moving a business process from one provider to another without losing service quality, data, or institutional knowledge. In an accounting practice it covers the file handover, the consent and confidentiality paperwork, access changes on both sides, phased migration by work type, and an agreed way to measure whether the new team is performing.
Do I Need New Client Consent to Change Outsourcing Providers?
For tax return information, yes, wherever consent was the basis for the original disclosure. A consent has to identify the specific recipient and cannot be given retroactively, so a new recipient means a new consent signed before any file moves. Ethics guidance separately asks you to inform the client, preferably in writing, before confidential information reaches a third party.
Can My Old Provider Keep Copies of My Clients' Files?
Usually, unless your contract says otherwise. What survives is governed by that contract and by the record-keeping duties both sides carry, so agree a disposal date and a written confirmation instead of assuming deletion happened at cutover.
How Long Should the Overlap Between Providers Last?
Long enough to run one full cycle of the work type you moved and compare it against your own baseline, and short enough to carry a stated end date. Open-ended overlaps leave two providers holding live access to the same client data.
What Should I Fix Before Switching Rather Than After?
Documented procedures, a named reviewer with time to review, and the way work leaves your office. Those three travel with you, so a switch that skips them reproduces the same problem under a new name.
Cutover Day Is the One Part You Cannot Re-Run
The new team can be graded over a full cycle, and it should be. The access shutdown gets one attempt. On that day either your files are in your hands, your clients have consented to the new recipient, and the old logins are dead, or they are not.
So work backwards from that date. Inventory, then notice. Consent, then files. Access ends on the day one named person owns.
If you are switching and want the next team graded before your files move, don't trust us, test us. Our Free 40-Hour Proof Pilot runs a block of your own representative work through the full review chain on your software and your procedures, so your reviewer grades real output before a single client file changes hands.