Category: Cleanup

A 12-person agency invoiced a client $90,000 in December for a project that finished in February. Cash arrived before year-end, so the bookkeeper booked it as December revenue. The books balanced. The bank reconciled. Nothing looked wrong.

But December’s profit was overstated by $90,000. The next year started in a hole. When a lender later asked for two years of statements, the restated numbers cost the company its rate. The entry was recorded correctly. It was recognized in the wrong period, and no one above the bookkeeper was looking for that.

That is the line between the two roles. In the engagements Aaron Ressel and the Debit & Co. team run, the catches that matter are rarely typos in the ledger. They are timing, method, and control — the questions a bookkeeper is not staffed to ask and a controller is paid to. Below are the specific ones, with what each costs when it slips.

What does a controller catch that a bookkeeper can’t?

A controller catches errors of judgment, not errors of entry. A bookkeeper makes sure each transaction is recorded accurately and categorized correctly. A controller checks the layer above that. The test is different. It asks whether revenue was earned in the period it was booked, whether the accruals are complete, whether the basis is right, and whether one person can move money unseen. Those checks catch the misstatements an accurate ledger hides in plain sight.

The pattern repeats across small businesses. The bookkeeping is fine; the oversight around it never scaled. The table below pairs each catch with why the bookkeeping role structurally misses it and what the miss tends to cost.

The catch	Why a bookkeeper misses it	What it costs
Revenue in the wrong period (cutoff)	Books cash when it arrives or when the invoice posts, not when the work is delivered	Overstated profit, a restated prior year, a lost lender rate
Missing or stale accruals	Records only what has a document; the unbilled expense has no trigger to enter	A month that looks profitable until three invoices land next period
Cash-vs-accrual mismatch	Runs on the basis the software defaulted to; no one checks if the entity must accrue	Books that fail diligence and a possible IRS method problem
Control gap / one-person money flow	Does the bill-pay and the reconciliation, so the reviewer and the doer are the same person	A $141,000 median fraud loss at sub-100-employee firms
GAAP misstatement on the balance sheet	Keeps a tax-ready P&L; deferred revenue, prepaids, and fixed assets sit untouched	A balance sheet a buyer’s accountant unwinds in week one

What is a revenue cutoff error, and why is it the costliest catch?

A revenue cutoff error is revenue recorded in the wrong period — booked when cash lands or an invoice posts, rather than when the work is actually delivered. It is the costliest catch because it moves profit, and profit is the number lenders, investors, and buyers price off.

Revenue recognition was the leading cause of public-company restatements, driving roughly 38% of 919 restatements from 1997 to 2002 (GAO). It ranked first in every year of that span. Private books are not audited to that standard, so the error usually goes unnoticed until it matters most.

The rule that governs it is GAAP’s revenue standard, ASC 606. Under its five-step model, you recognize revenue when you satisfy the performance obligation — when control of the good or service transfers — not when the money moves. The agency above failed step five: the $90,000 obligation was satisfied in February, so the revenue belonged in February.

A controller runs a cutoff check at close, tying the largest invoices to delivery dates, and moves anything that crossed the line. That single review is the difference between a clean statement and a restatement.

Why does a missing accrual make a profitable month a lie?

Because the expense happened whether or not the invoice arrived, and a bookkeeper has nothing to record until a document shows up. An accrual books a known cost in the period it was incurred. Skip it, and the month reads more profitable than it was — until the bills land next month and crush a period that did nothing wrong.

Work the numbers. A construction firm closes March showing $40,000 in profit. Two subcontractors did $25,000 of March work but won’t invoice until mid-April. With no accrual, March reports $40,000; April absorbs the $25,000 and reports a near-loss. Neither figure is true.

The controller catch is to estimate and book the $25,000 in March, so March shows $15,000 and April carries only its own costs. Same cash, honest periods. This is the matching principle GAAP is built on: record effects in the periods in which transactions occur, not only when cash changes hands (FASB Concepts Statement No. 1). A bookkeeper records documents. A controller records reality.

What is the cash-vs-accrual confusion, and when does it become a legal problem?

Cash basis records money when it moves; accrual records it when it is earned or owed. The confusion starts when books run on whichever basis the software defaulted to, and no one checks whether the business is even allowed to stay on cash. Past a size threshold, accrual is not a preference. It is required.

Under the tax code, a C corporation, a partnership with a C-corp partner, or a tax shelter generally must use accrual unless it clears the gross-receipts test. As of 2026, that threshold sits at $31,000,000 in average annual gross receipts (IRS Rev. Proc. 2024-40), measured over three years. A bookkeeper may not track that line. A controller does, and converts the books before the method becomes a filing problem.

Even well under the threshold, cash-basis books distort growth — a great December that was really three customers prepaying for January. A controller flags the mismatch and keeps a clean accrual set for any decision that matters.

Why does one person handling the money create risk a bookkeeper can’t see?

Because the person doing the work cannot also be the person checking it, and in most small businesses the bookkeeper is both. When one individual bills customers, deposits cash, and reconciles the account, the books can balance perfectly while money walks out the door.

The control standard is explicit. Duties should be divided so that no one individual controls all key aspects of a transaction (GAO Green Book, Principle 10). That means separating who authorizes, who records, who reviews, and who holds the asset.

The cost is not hypothetical. Companies with fewer than 100 employees carry a median fraud loss of $141,000 per scheme, second only to the largest firms, across 1,921 cases studied (ACFE, 2024). The most common reason fraud happens at all is the absence of this oversight. Lack of internal controls was the primary weakness in 32% of cases, with control override adding 19% more.

A controller does not need to suspect anyone. The controller designs the separation — a second approval on payments, an independent reconciliation — so an honest team stays honest and an error gets caught before it compounds.

What GAAP misstatements hide on the balance sheet?

The balance sheet is where bookkeeping-only books quietly drift, because a tax-ready P&L can look right while the balance sheet behind it is wrong. Deferred revenue from prepaid contracts sits as if it were earned. Prepaid insurance hits one month instead of twelve. Fixed assets get expensed instead of capitalized and depreciated. None of these break the bank reconciliation, so none of them surface in day-to-day bookkeeping.

They surface in diligence. When a buyer or lender’s accountant reads the statements, deferred revenue booked as current revenue is the first thing they unwind, and it can reprice a deal. A controller maintains GAAP-aligned books as a standing discipline.

That means reconciling the balance sheet line by line each month, not just the bank, so the statements hold up when someone who knows what to look for finally looks. Catching it at close costs an hour. Catching it in diligence costs leverage.

How do you add controller-level review without a full-time hire?

You layer it on top of the bookkeeping you already have. The day-to-day recording stays where it is; a controller sits above it and owns the checks — cutoff, accruals, basis, controls, and the balance sheet. Most 5-to-80-employee businesses generate 10 to 15 hours a week of that work, not a full seat, which is why the fractional model fits.

The practical setup pairs an accurate bookkeeper in small-business accounting with an outsourced controller running QuickBooks Online to a defined close each month. The bookkeeper keeps the ledger current. The controller catches what the ledger can’t show on its own. You get the oversight that prevents the $90,000 restatement and the $141,000 leak without building a finance department to do it.

Common questions about what a controller catches

Can’t a good bookkeeper catch these errors too?

A strong bookkeeper keeps an accurate ledger, but cutoff, accruals, method, and segregation of duties are judgment and oversight tasks outside that role. The structural problem is independence: the person recording the transactions cannot also be the person reviewing whether they belong. That second set of eyes is the controller function.

What is a revenue cutoff error?

It is revenue recorded in the wrong accounting period, booked when cash arrives or an invoice posts rather than when the work is delivered. Under GAAP’s ASC 606, revenue belongs in the period the performance obligation is satisfied. Recognizing $90,000 in December for work finished in February overstates December.

When is my business legally required to use accrual accounting?

Under IRC §448, a C corporation, a partnership with a C-corp partner, or a tax shelter generally must use accrual once average annual gross receipts pass the threshold. That threshold is $31,000,000 for 2026 (IRS Rev. Proc. 2024-40). Below it, accrual is optional for tax but still recommended for decision-grade books.

Why does segregation of duties matter at a small company?

Because one person who bills, deposits, and reconciles can move money while the books still balance. Federal internal-control standards (GAO Green Book, Principle 10) require dividing duties so no individual controls a full transaction. With a median fraud loss of $141,000 at sub-100-employee firms, the separation is a control, not a vote of no confidence.

A founder we met had a P&L showing a $42,000 profit for the quarter. The bank wanted accrual financials before extending a line. When we re-cut the same QuickBooks Online file on an accrual basis, that profit became an $18,000 loss.

Nothing was late. Every account reconciled. The books were “done,” and also wrong, and the founder had steered on them for nine months. That gap, between books that are finished and books that are right, is where “good enough” quietly bills you.

This is a different failure than books that fall behind. Behind is a timing problem. This is an accuracy problem that hides in plain sight, because the file looks tidy.

What does “good enough” bookkeeping actually mean?

It means the books are current and reconciled, yet the numbers underneath are categorized wrong, posted to the wrong period, or kept on a basis that misstates profit. The work is present. The accuracy is not. A bank feed that auto-categorizes a $9,000 equipment purchase as “office supplies” still reconciles to the penny. The trial balance balances. The owner trusts the clean report. That trust is the trap.

The IRS does not measure your books by whether they are finished. Under 26 U.S. Code § 6001, every taxpayer must keep records that substantiate what the return reports. IRS Publication 583 is blunter: records must let you “prepare accurate financial statements” and stand up to inspection. Miscategorized books fail that test even when they reconcile. Done is not the bar. Supportable is.

How much does inaccurate bookkeeping actually cost?

It costs you three ways: a direct tax penalty, lost deductions, and decisions priced on the wrong numbers. The penalty is the cleanest to quantify, because under IRC § 6662 an inaccurate return triggers a 20% accuracy-related penalty on the underpaid portion, and the IRS names “not checking the accuracy of a deduction” as negligence outright.

This is not a rare edge case. The Government Accountability Office found sole proprietors who underreport income account for about $80 billion a year in unpaid tax, roughly 16% of the $496 billion federal tax gap, with 27.8 million sole-proprietor returns filed in 2019.

Most of that is recordkeeping, not fraud. A deduction you earned but miscoded gets lost. A deduction you took but cannot support gets disallowed, then penalized. Both bleed from the same wound: books that were filed before they were verified.

Why do cash-basis books mislead a growing company?

Cash-basis books record money only when it moves, so they routinely lie about which period actually earned the profit. A customer prepays $60,000 in March, and that month looks like a banner quarter even though the work ships across the next two.

Unpaid vendor bills sit invisible, so the month reads more profitable than it is. The founder above had exactly this: cash in the door read as profit while delivery costs had not yet posted.

Accrual fixes this by matching revenue to the period it was earned and expenses to the period they were incurred. That is the basis GAAP expects, and the basis lenders and investors assume when they read your statements.

There is also a hard legal line. Under IRC § 448 and IRS Publication 538, a company that passes the gross-receipts test, indexed to about $31 million for 2025, can no longer use the cash method and must convert to accrual on Form 3115. Let “good enough” cash books ride toward that line and you rebuild the foundation during diligence, the worst possible moment.

What are the signs your books are wrong, not just late?

Late books announce themselves. Wrong books do not, which is why this checklist matters. Run your last closed month against it.

Warning sign	What it usually means
The same expense lands in a different category month to month	No categorization rules; reports are not comparable period to period
“Ask my accountant” or “uncategorized” holds more than a rounding amount	Transactions parked, not classified; margins are a guess
The P&L swings wildly month to month with no real change in operations	Cash-basis timing, or revenue and costs landing in the wrong periods
Equipment and software purchases hit expense, never the balance sheet	Capitalization missed; assets and profit both misstated
Owner draws, loans, and revenue are tangled in the same accounts	Business and personal not separated, the exact § 6001 failure
A lender or investor asked for accrual financials you could not produce	Books cannot support the capital decision they were built for

Two or more of these is not a clerical nuisance. It means the reports you price decisions on cannot be trusted, and the file needs a review pass before the next close locks.

How do bad books sabotage funding and growth?

They break exactly when the stakes are highest: when you ask for money. The Federal Reserve’s 2024 Small Business Credit Survey found 51% of employer firms cite uneven cash flow as a challenge, and 88% rely on the owner’s personal credit to secure financing.

Roughly 37% applied for financing in the prior year. Every one of those moments runs on financial statements, and a lender reading distorted books either prices the risk against you or declines.

The cost compounds past the bank. BLS Business Employment Dynamics data show only about half of new establishments survive to year five. Trustworthy books are the instrument panel for that stretch. When the panel reads wrong, an owner cuts the wrong line, hires into a loss, or misses eroding margin until cash runs thin.

How do you fix books that are done but wrong?

You add review, not more software. A new tool categorizes faster; it does not catch a $9,000 asset miscoded as supplies. A second set of eyes does. The fix is a defined chart of accounts with categorization rules, accrual treatment of revenue and costs, and a reviewer who checks the work before the month locks.

“In the engagements we run, the most expensive errors are almost never the obvious ones,” says Aaron Ressel. “They are the quiet miscategorizations that reconcile cleanly and still steer a business wrong for months.” That review discipline is what turns good bookkeeping into Financial Clarity™, and it is the core of our small business accounting services.

For founders racing toward a raise, the accrual-and-review work belongs in place early, which is the case for outsourced startup bookkeeping before diligence, not during it. As of 2026, the gross-receipts threshold sits near $31 million; build for accrual well before you reach it.

Frequently asked questions

Can books be reconciled and still be wrong?

Yes. Reconciliation proves the bank balance matches the ledger. It says nothing about whether each transaction landed in the right category, period, or account. A $9,000 asset coded as office supplies reconciles perfectly and still misstates both your balance sheet and your profit.

What is the penalty for inaccurate bookkeeping on a tax return?

Under IRC § 6662, the IRS can assess a 20% accuracy-related penalty on the portion of tax underpaid through negligence or a substantial understatement. The agency cites failing to check a deduction’s accuracy as negligence, so sloppy categorization is exposure, not just a tidiness issue.

When does a business have to switch from cash to accrual?

Under IRC § 448, a C corporation or partnership with a C-corp partner generally must use accrual once average annual gross receipts pass the indexed threshold, about $31 million for 2025. The switch is filed on Form 3115. Most growth-stage companies should adopt accrual well before the limit because lenders and investors expect it.

Is QuickBooks Online enough to keep books accurate?

QuickBooks Online is a strong ledger, but it executes the rules you give it. It will auto-categorize a transaction to the wrong account and reconcile it without complaint. Accuracy comes from a defined chart of accounts, accrual treatment, and a reviewer, not from the software alone.

How do I know if my reports are trustworthy enough to make decisions?

Run the signs-your-books-are-wrong checklist above. If categories drift, “uncategorized” carries real money, or you could not hand a lender clean accrual statements tomorrow, treat the reports as unverified and get a review pass before the next close locks.

The median small business in America holds 27 days of cash. That figure comes from JPMorgan Chase Institute, which read 470 million transactions across 597,000 firms. Run that 27-day margin while your QuickBooks file is three months stale, and you are making payroll calls, pricing calls, and hiring calls against numbers that describe a quarter that already ended.

In the engagements Kevin Cahill and the Debit & Co. team run, the cost of behind books is never the bookkeeping fee. It is the decisions, the penalties, and the scramble that pile up while no one is reconciling.

What does it actually cost to run QuickBooks behind?

The cost shows up in four places, and none of them is the monthly bookkeeping charge. First, you decide on stale numbers. Second, you take on tax penalties and interest. Third, you lose deductions you can no longer prove. Fourth, you pay for a catch-up project later, at a worse price, under deadline.

The fee for keeping books current is visible and small. The cost of skipping it is invisible, larger, and it compounds the longer the file sits.

None of these costs announce themselves. A late penalty arrives as an IRS notice. A bad hire traces back to a margin you misread two quarters ago. A denied loan reads as a credit decision, not a bookkeeping one. The damage is real, yet it hides inside other line items, so the books rarely get the blame they earned.

How do stale numbers lead to bad decisions?

Stale numbers fail at the exact moment you need them. Every operating decision leans on a current figure: what a job actually costs, where margin is leaking, whether cash covers next month. When the books trail by 60 or 90 days, those figures describe a business that no longer exists. You are not flying without instruments. You are flying with instruments that read last quarter.

The Federal Reserve’s 2025 Small Business Credit Survey found 51% of small employer firms named uneven cash flow as a financial challenge, and 56% pointed to paying operating expenses. Those are precisely the calls current books exist to inform. Misprice one large job because last month’s costs never posted, and a single decision can erase a quarter of margin. The error is not in the spreadsheet. It is in the input.

What does falling behind cost you at tax time?

It costs penalties, interest, and deductions you can no longer defend. The penalties are mechanical, and they stack. The IRS charges a failure-to-file penalty of 5% of unpaid tax for each month a return is late, capped at 25%. A separate failure-to-pay penalty adds 0.5% per month, also capped at 25%.

Interest runs on top. As of mid-2026, the underpayment rate for non-corporate taxpayers is 7% per year, compounded daily, and it resets quarterly. The numbers below are the published IRS figures.

Cost at tax time	Rate (IRS, as of mid-2026)	What triggers it
Failure-to-file penalty	5% of unpaid tax per month, max 25%	Return filed late because the books were not ready
Failure-to-pay penalty	0.5% per month, max 25%	Tax owed but unpaid by the deadline
Underpayment interest	7% per year, compounded daily, resets quarterly	Any unpaid balance, accruing until paid
Accuracy-related penalty	20% of the understatement	A wrong return from negligence or a substantial understatement
Lost deductions	Up to 100% of the deduction	Expenses you cannot substantiate when asked

The last two rows do the quiet damage. The IRS failure-to-file penalty is the headline, but the accuracy-related penalty adds 20% of any understatement that traces to negligence or sloppy records.

Worse is what you simply cannot claim. The burden of proof to substantiate every deduction sits with the taxpayer, not the agent. Mileage, meals, equipment, contractor payments: if the records are a year behind and the receipts are gone, the deduction is gone with them. You end up paying tax on income you spent.

How behind is “too behind”?

A useful rule: 30 days behind is normal, 90 days behind is a problem, and a year behind is a cleanup project. The point is not the exact day count. It is that the cost curve bends upward fast.

A month of unreconciled transactions is a morning’s work. A year of them is a forensic exercise, because memory fades, vendors change, and the bank only stores so much history. The gauge below is the one we use to triage a new file.

How far behind	What it means	What it costs to fix
0–30 days	Normal. Last month is closing now.	Routine. A standard monthly close.
30–90 days	Drifting. You are deciding on old numbers.	A focused catch-up, still measured in days.
90 days–1 year	A problem. Tax positions and cash are now guesses.	A scoped cleanup, often a few weeks.
1 year or more	A project. Filings are likely late and penalties may be accruing.	A full reconstruction, priced as a project.

Two signals matter more than the calendar. The first is a missed or extended filing, because that is when penalties begin to run. The second is a decision you postponed because you did not trust the numbers. When you stop asking the books questions, you are already flying blind.

Why is catching up yourself the expensive option?

Because the DIY catch-up usually costs more than it saves, in time and in errors. The work looks like data entry and is not. A year of catch-up means reconstructing cutoff, separating owner draws from real expenses, fixing miscategorized transactions that have compounded for months, and untangling a bank feed that auto-matched wrong.

Each mistake propagates. A misclassified loan deposit booked as income inflates revenue, inflates the tax, and hides the actual cash picture all at once.

Then there is the opportunity cost. The weekends an owner spends rebuilding a QuickBooks Online file are weekends not spent selling, hiring, or serving customers. About one in three businesses survives its first decade; only 34.7% of establishments born in 2013 were still operating in 2023, per Bureau of Labor Statistics data.

Financial blindness is a recurring thread in the ones that fail. The cheapest version of catch-up is the one done by someone who reconciles for a living, before the backlog turns into a reconstruction.

When does behind become a cleanup, not a chore?

It crosses the line when the file can no longer be trusted to produce a decision or a filing. Once you are past 90 days, or once a deadline has slipped, the work is no longer maintenance. It is recovery. At that point the goal is not to “do the bookkeeping.” It is to rebuild a clean baseline you can stand on. Then you keep it current so the gap never reopens.

That recovery is exactly the work our QuickBooks cleanup and catch-up services are built to own: reconstruct the period, fix the categorizations, reconcile every account, and return books that tie. Keeping them current afterward is what our small business accounting services handle month to month.

Lenders make this concrete. The Federal Reserve found 60% of small employer firms applied for financing in the prior year, and every one of those applications needs current, defensible financials. Behind books do not just cost penalties. They cost the loan you needed to grow.

Frequently asked questions

How many months behind on bookkeeping is too many?

As a working rule, 30 days behind is normal, 90 days is a problem, and a year or more is a cleanup project rather than a chore. The harder signal than the calendar is a missed filing or a decision you postponed because you did not trust the numbers.

What are the IRS penalties for filing taxes late because my books were not ready?

The IRS charges a failure-to-file penalty of 5% of unpaid tax per month, up to 25%, plus a failure-to-pay penalty of 0.5% per month, also capped at 25%. Interest accrues on top, at 7% per year for non-corporate taxpayers as of mid-2026, compounded daily and reset quarterly.

Can behind books actually cause me to lose tax deductions?

Yes. The burden of proof to substantiate a deduction sits with the taxpayer. If your records are a year behind and the receipts are gone, you cannot defend the expense, and the deduction is lost. A wrong return from sloppy records can also draw a 20% accuracy-related penalty.

Should I catch up QuickBooks myself or hire someone?

A month or two of backlog is reasonable to handle yourself. A year of catch-up is a reconstruction, where a single miscategorized entry can distort revenue, tax, and cash at once. Past 90 days, the cheaper path is usually someone who reconciles for a living and can rebuild a clean baseline.

A CPA firm we spoke with last year had vetted an outsourcing partner on price, turnaround, and references, then signed. Six weeks in, a client asked a single question the firm could not answer: where, physically, does my tax data live, and who can see it? No one at the firm knew, because they had reviewed the work and never the controls. That gap is the one that quietly ends partnerships.

When your firm hands client records to an outside provider, you do not hand off the responsibility. Under the AICPA Code of Professional Conduct and most state board rules, the duty to protect client confidentiality stays with your firm. A vendor’s mistake becomes your firm’s liability.

So the question before you sign is not whether the partner can do the work. It is whether you can defend the relationship if a client, a regulator, or your malpractice carrier ever asks.

What is the difference between SOC 2 Type I and Type II?

A SOC 2 Type I report confirms the controls were designed correctly on a single date. A Type II report confirms those controls actually operated over a period of time, typically three to twelve months. Type II is the one that matters. It is the difference between a partner who drew up a sound security plan and one who proved they followed it for a year.

SOC 2 is an independent examination defined by the AICPA, measured against five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is the baseline; Confidentiality is the criterion most relevant to your clients’ records.

Ask for the report under NDA, not the badge on the website. Check that the period is recent, confirm which criteria it covers, and read the exceptions section. You want minor findings with a remediation plan, not a report that looks suspiciously spotless.

How should a partner protect data in transit and at rest?

Both. Encryption in transit protects data moving between your firm and the partner; encryption at rest protects the data sitting inside their systems. Both answers should come back as an immediate yes. Encryption is the floor, not the ceiling.

Then ask where the files actually live, because reputable cloud infrastructure carries its own security certifications and a shared drive nobody has audited in years does not. The exposure is measurable. Verizon’s 2025 Data Breach Investigations Report found the median time to remediate a leaked secret in a public code repository was 94 days. That is more than three months of open exposure.

When a partner treats these questions as a technicality, that reaction reveals how seriously security lives in the daily work rather than the sales deck.

Who on the partner’s team can see your clients’ files?

Fewer people than you would guess, in a well-run shop. Most real breaches are not sophisticated hacks; they happen when too many people hold access to too much. Verizon’s 2025 report found third-party involvement in confirmed breaches doubled from 15% to 30% in a single year, much of it through credential exposure and misconfigured systems at partners.

Ask how access is granted and removed. You want role-based access, where people see only what their job requires, multi-factor authentication on every account, and a documented process that cuts off access the day someone leaves.

If the partner offshores any part of the work, ask where the people touching the data are located and whether the same controls follow them there. Geography is not the issue; consistent controls everywhere the data travels is the issue.

What does IRS Section 7216 require for outsourced tax work?

If your firm prepares returns, IRS Section 7216 applies. It requires the taxpayer’s prior written consent before return information is disclosed to or used by a third party such as an outsourcing partner. This is not optional, and the penalty is criminal.

Under 26 CFR 301.7216-1, a knowing or reckless violation is a misdemeanor carrying a fine of up to $1,000, up to one year in prison, or both, per violation. A separate civil penalty under IRC 6713 adds $250 per improper disclosure, capped at $10,000 a year.

Your contract should reflect this. It needs a confidentiality clause and, ideally, a data processing agreement. That agreement should spell out what the partner may do with the data, what they may not, how long they keep it, and what happens when the engagement ends. A partner who knows exactly what Section 7216 means without you explaining it has handled regulated tax data before.

Separately, the FTC Safeguards Rule treats tax and accounting firms as financial institutions and requires a written information security program, including written contracts requiring service providers to protect customer information. Your vendor is one of those service providers.

The eight controls to vet before you sign

The diligence splits cleanly across eight controls, each paired below with the question to ask and the reason it matters. Run it as a checklist, and keep a short record of what you asked and what they answered. That file is cheap insurance if anyone ever questions the relationship.

Control	What to ask	Why it matters
SOC 2 report	Can we review your SOC 2 Type II report under NDA?	An independent auditor verified the controls held over time, not just on paper
Encryption	Is client data encrypted in transit and at rest?	The baseline that protects data in motion and data at rest in their systems
Data location	Where do the files physically live, and on what infrastructure?	Certified cloud infrastructure beats an unaudited shared drive
Access controls	Who can see our files, and how is access granted and removed?	Role-based access plus MFA is where most breaches are won or lost
Offshore controls	If work is offshored, do the same controls apply there?	Controls must follow the data wherever it travels
Section 7216 and contract	How do you handle Section 7216 consent and a data processing agreement?	Tax data carries a criminal-penalty disclosure rule your firm owns
Data use	Do you use our data to train models or build benchmarks?	Anything beyond the work you hired them for needs to be in writing
Incident response	Do you carry cyber liability insurance and notify us within a set window?	A partner who planned for the bad day is safer than one who insists it will not come

Why does the partner’s posture tell you as much as the answers?

Because the posture is a preview of the relationship. A partner who treats your security questions as a welcome, expected part of diligence is showing you how they will steward your clients’ data after the contract is signed. A partner who turns impatient is signaling the opposite.

The cost of misjudging that is no longer abstract: IBM’s 2025 Cost of a Data Breach report put the U.S. average breach at $10.22 million, the highest of any region in the study.

In the engagements our senior controller Aaron Ressel runs, the firms that push hardest on security end up the easiest to serve, because the expectations are written down before the first file moves. When firms partner with us for white-label bookkeeping or white-label tax preparation, we would rather you push hard on the security conversation than skip it.

Every workflow runs through our Continuous Close Method™, documented into a Custom Playbook so the controls survive staff turnover and travel with the engagement, not with one person. As of 2026, that is the standard your clients should expect any partner to meet.

Questions firms ask before they outsource

Is SOC 2 Type I good enough, or do we need Type II?

Ask for Type II. A Type I report rates control design on a single day. A Type II report tests whether those controls operated over a three-to-twelve-month period, which is the evidence that the partner actually follows its own security plan. If a partner holds only a Type I, treat it as a starting point and ask when the Type II examination completes.

Do we need client consent to send tax data to an outsourcing partner?

Yes, in most cases. IRS Section 7216 requires the taxpayer’s prior written consent before a preparer discloses or uses return information through a third party. The penalty for a violation is a misdemeanor, up to $1,000 and up to one year in prison per violation. Build the consent into your engagement process, not as an afterthought once the work has already moved.

Who is liable if the outsourcing partner has a breach?

Your firm carries the duty to clients regardless of the vendor’s role. The AICPA Code of Professional Conduct and state board rules place confidentiality on the CPA, and the FTC Safeguards Rule requires you to bind service providers by written contract. A partner’s cyber liability insurance helps, but it does not transfer your professional obligation, which is why the vetting and the contract terms matter.

What if the partner offshores the work?

Offshoring is not the risk; inconsistent controls are. Ask where the people touching your clients’ data are located and whether role-based access, multi-factor authentication, and encryption apply equally to them. If the partner cannot describe how its controls follow the data offshore, treat that as a red flag.