Category: Cleanup

  • QuickBooks Cleanup: A Step-by-Step Guide to Fixing Messy Books

    QuickBooks Cleanup: A Step-by-Step Guide to Fixing Messy Books

    Key takeaways

    • A QuickBooks cleanup is sequenced by evidence, never by screen. Reconstruct a provable opening balance, reconcile forward, classify residual transactions, and dispose of stale balances last. Teams beginning at the deletions finance a second remediation.
    • Aged uncleared checks are seldom voidable. Florida presumes unpaid wages abandoned after 1 year, and most additional intangible property after 5 years, as of 2026.
    • Stale accounts payable converts to income exclusively once the underlying obligation is extinguished. Within one $47,300 aged A/P balance, $34,500 qualified and $12,800 did not.
    • Retention rules establish the floor beneath any discard decision: 3 years ordinarily, 6 years where omitted income exceeds 25% of the gross income shown on the return, and 4 years for employment tax documentation.
    • The Form 1099-NEC and 1099-MISC reporting threshold moved from $600 to $2,000 for payments made after December 31, 2025, so consolidating duplicate vendor records now determines a different reporting population.

    A QuickBooks cleanup is a legal exercise before a bookkeeping one. Most guides sequence the work by screen. The sequence deciding your outcome is evidentiary: establish the final date the file can be proven correct, then dispose of every stale item under whichever rule genuinely governs it. Across one 14-month engagement, $47,300 of aged accounts payable resolved three separate ways. Only $34,500 belonged in income. The remainder was money still owed, and erasing it would have proved expensive.

    Two finance staff reviewing and marking up printed transaction reports spread across a desk during a books cleanup

    What does a QuickBooks cleanup actually involve?

    Four passes, run in order. Rebuild a provable opening balance. Reconcile every account forward from it. Classify whatever remains uncoded. Dispose of the stale items last, each under the rule that governs it.

    Sequence constitutes the entire methodology. Classification performed ahead of reconciliation gets repeated, because reconciliation relocates items between periods and surfaces transactions nobody had coded previously. Disposal executed ahead of classification destroys the documentation on which the disposition itself depends.

    Remediation also differs from catch-up. Catch-up populates missing months. Remediation repairs months already recorded incorrectly, so every correction lands inside a period a filed return, a lender submission, or a board packet may already characterize. That constraint governs the sequence below.

    Where do you start when the books are a mess?

    At the last date the file can be proven, not at the oldest visible error. Find the most recent month where every bank and card account tied to its statement. That month is the anchor, and everything after it is the work.

    Substantiating that anchor requires statements, never screens. Retrieve the PDF statements covering the anchor month and every subsequent month, because banking portals expire history and an import truncated at 90 days will silently define your starting position for you.

    Two balances warrant attention ahead of everything else: Opening Balance Equity, and any suspense or undeposited-funds account carrying activity older than the anchor. Both function as holding pens. Whatever accumulates inside them was never assigned a genuine classification, so every dollar represents an unresolved question about the balance sheet.

    How do you handle old uncleared checks in QuickBooks?

    Age them first, then test them against the unclaimed property rules before voiding anything. A check that never cleared is not an error. It is a liability the company still owes, and in most states an unclaimed one eventually belongs to the state rather than to the payee or the issuer.

    Florida sets a short clock on payroll. The statute is specific about unpresented checks:

    “Unpaid wages, including wages represented by unpresented payroll checks, owing in the ordinary course of the holder’s business that have not been claimed by the owner for more than 1 year after becoming payable are presumed unclaimed.”

    Fla. Stat. § 717.115, 2025 Florida Statutes

    Everything else follows the general clock. Florida presumes intangible property abandoned once its owner fails to claim it “for more than 5 years after the property becomes payable or distributable,” under Fla. Stat. § 717.102(1). Florida rewrote chapter 717 in 2026, retaining both the 1-year wage period and the 5-year default. Every jurisdiction maintains separate schedules and reporting calendars, so consult the payee’s state rather than yours. Voiding a stale instrument inside QuickBooks Online alters your ledger and alters nothing whatsoever about that obligation.

    How do you clear old accounts payable in QuickBooks?

    Only by proving the obligation ended. Payment terminates it. A legal release terminates it. So does expiry of the creditor’s right to sue. Age alone terminates nothing, which explains why bulk-deleting aged bills remains the commonest route from remediation to restatement.

    Florida gives a creditor 5 years to sue on an obligation “founded on a written instrument” under Fla. Stat. § 95.11(2)(b), and 4 years on an open account or a contract not founded on a written instrument. Test each stale bill against that clock, then run the arithmetic. From the 14-month engagement above, a $9M professional-services company with 38 open vendor bills:

    1. Aged A/P at cutover. $47,300 across 38 bills, every one of them dated more than five years back.
    2. Carve out what is still owed. $12,800 represented checks the company had already issued and the payees never presented. That is unclaimed property, not income. It stays a liability and gets reported to the state.
    3. Test the remainder. $47,300 − $12,800 = $34,500 of bills never paid, never disputed, and now past the limitation period, so the creditor’s claim is no longer enforceable.
    4. Write back, do not delete. The $34,500 posts to other income in the current period, with the aging analysis attached. At the flat 21% corporate rate, that is $34,500 × 0.21 = $7,245 of federal tax on a cleanup entry.

    That $7,245 surprises founders, which is why the write-back gets modeled before posting rather than discovered at filing. Corporations figure tax by multiplying taxable income by 21%, per IRS Publication 542; a pass-through owner absorbs identical income personally.

    How do you stop duplicate entries and fix the ones already there?

    Merge the records, void the duplicates with a dated memo, then close the input path that produced them. Fixing duplicates without closing the path guarantees they return by the next quarter.

    Duplicates nearly always originate in two entry routes serving one transaction. An invoice arrives through Bill.com while the disbursement arrives independently from the banking import. A deposit gets recorded manually, then matched a second occasion. A single supplier exists three times, spelled three ways, so the aging report displays three balances describing one commercial relationship.

    Consolidation carries a compliance edge this year. The Form 1099-NEC and 1099-MISC reporting threshold rose from $600 to $2,000 for payments made after December 31, 2025. Calendar year 2026 sits at a flat $2,000, and the first inflation adjustment arrives for calendar year 2027, per the IRS instructions for Forms 1099-MISC and 1099-NEC, as of August 2026. Disbursements fragmented across duplicate records understate whichever total crosses that line, so deduplication and information-return preparation constitute one exercise.

    What should you never delete during a cleanup?

    Anything inside an open retention window, and anything a filed return already relies on. The IRS keeps the ordinary window at 3 years, extends it to 6 years where omitted income exceeds 25% of the gross income shown on the return, holds employment tax records for at least 4 years after the tax becomes due or is paid, and allows 7 years for a worthless-securities or bad-debt claim, per IRS guidance on record retention.

    The table below maps what a cleanup turns up to what it actually is. Treat the last column as the exposure a delete creates.

    What the file showsWhat it actually isCorrect dispositionWhat a delete costs you
    Uncleared check to an employee, over 1 year oldUnpaid wagesKeep the liability; report as unclaimed property on the state scheduleThe void clears the ledger and leaves the escheat exposure intact
    Uncleared vendor check, over 5 years oldUnclaimed intangible propertyReport to the payee’s state; never route it to incomeIncome overstated, and a state claim still outstanding
    Bill never paid, never disputed, past the limitation periodObligation no longer enforceableWrite back to other income in the current period, aging analysis attachedIncome understated and the A/P roll-forward cannot be proven
    Duplicate bill already paid under a second vendor recordRecording errorMerge the vendor records; void with a dated memo1099 totals split below the $2,000 threshold
    Transaction sitting in a closed, filed tax yearPrior-period itemCorrect in the open period; amend only when the change is materialThe ledger and the filed return stop agreeing
    Balance in undeposited funds older than the anchor monthUnmatched receipt or unposted depositTrace to the bank record and reclass to the real accountA journal entry to zero it buries the variance for the next reader

    How do you keep the file clean after the cleanup?

    Lock the closing date, then relocate reconciliation inside the month. Remediation concluding without a locked period and a standing cadence deteriorates within two quarters, because the identical three entry routes remain unattended.

    Three controls preserve the result. Enforce a closing date so corrected periods stay corrected. Adopt weekly reconciliation instead of a monthly scramble, a difference our note on reconciliation cadence quantifies. Examine aged payables and outstanding instruments quarterly, resolving the next stale item at 90 days instead of 5 years.

    Aaron Ressel structures Debit & Co. engagements so the cleanup ends where the recurring close begins, which is what the Continuous Close Method™ formalizes. Tooling carries part of the load: Puzzle keeps the transaction data clean going forward, and a team turns that data into a close that ties. For the case that gets a cleanup funded in the first place, our breakdown of what running QuickBooks behind actually costs puts numbers on the delay, and the month-end close process is the cadence a clean file makes possible.

    Frequently asked questions

    How do I fix a negative bank balance in QuickBooks?

    Trace it before adjusting it. A negative book balance is a symptom carrying four usual causes: duplicated payments, an unrecorded deposit, checks dated into the wrong period, or a defective opening balance. Reconcile against the statement for the earliest affected month and the cause identifies itself. Forcing the figure positive through a journal entry relocates the discrepancy instead of resolving it.

    How do you merge two vendors in QuickBooks?

    Determine which record survives first, since merges relocate transaction history permanently. Confirm both describe one legal entity under one taxpayer identification number, then retain whichever name matches the W-9. Compare aged payables and year-to-date disbursements before and afterward; both totals should agree precisely. Differing identification numbers indicate genuinely separate suppliers, whose balances belong apart.

    Can you clear the audit trail in QuickBooks Online?

    Plan remediation as though every edit is logged permanently, because an examiner, a lender, or an acquirer reads the file precisely that way. The defensible correction is a dated adjusting entry carrying a memo that explains the analysis. Change history showing deliberate corrections substantiates your numbers; history showing erased aged balances invites the very question the project was commissioned to answer.

    How do I prepare a balance sheet by month summary?

    Set the columns to months, then read across rather than downward. Month-over-month movement exposes what a single-date report conceals: an account jumping and reverting, a liability that never moves, a suspense balance surviving every close. During remediation this becomes the fastest diagnostic available, since a flat accrued-payables line spanning 14 months signals stale aging rather than settled obligations.

    How do you delete a vendor in QuickBooks Online?

    Inactivate it instead whenever the record carries posted activity. Deleting a supplier with history severs the trail connecting a disbursement to its payee, and that trail substantiates both the deduction and the information return. Inactivation removes the record from working lists while its history remains intact and reportable. Reserve outright removal for entries created mistakenly, carrying nothing.

  • Startup Accounting 101: How to Set Up Your Books From Day One

    Startup Accounting 101: How to Set Up Your Books From Day One

    Key takeaways

    • Startup accounting resolves into six day-one decisions: entity and tax election, accounting method, chart of accounts, bank and card feeds, payroll registration, and the document trail.
    • Keep the ledger on accrual even where the return uses cash. For tax years beginning in 2026 the IRS sets the cash-method gross receipts test at $32,000,000, averaged across three years.
    • A taxonomy of numbered blocks plus a department dimension survives three years of growth. An account list assembled by autocomplete does not.
    • In the engagement modeled below, day-one setup runs 18 hours and $1,710. Deferred to month 22, the identical six decisions consume 294 hours and $27,930.
    • Two payroll dates belong on the calendar before the first paycheck: the deposit schedule assigned by the $50,000 lookback test, and the January 31 filing deadline covering Forms W-2 and 1099-NEC.

    Six decisions in a company’s first 30 days determine whether its books withstand diligence three years later. Startup accounting is the discipline of resolving them deliberately, before transactions accumulate against a structure nobody designed. Postponed, the identical work costs roughly ten times more, as of July 2026.

    Structural framework standing in for the six day-one decisions behind startup accounting

    What does startup accounting require in the first 30 days?

    Six structural choices, each inexpensive to resolve correctly and punitive to reverse. None demands a full-time hire. Each demands a decision rather than a default, because accounting software supplies defaults free of charge until roughly month 22, when the invoice arrives all at once.

    The reversal hours describe one anonymized engagement, not an industry benchmark. What generalizes is the ratio between the final two columns.

    DecisionThe day-one versionDeadlineDay-one hoursHours to reverse at month 22
    Entity and tax electionConfirmed with a CPA in writing; the election governs every filing beneath itBefore the first payroll run112
    Accounting methodAccrual in the ledger, whatever the return requires at filingBefore the first invoice134
    Chart of accountsNumbered blocks plus a department dimension, sized for three years outBefore month 1 closes426
    Bank and card feedsEvery account linked in QuickBooks Online or Puzzle, reconciled monthlyMonth 16154
    Payroll registrationFederal and state accounts opened, deposit schedule confirmedBefore the first paycheck320
    Document trailReceipts and contracts attached to the transaction, never filed to a driveContinuous348

    The six rows total 18 hours against 294. Reconciliation dominates the reversal column because unreconciled months compound: each inherits its predecessor’s unexplained balance, then contributes one of its own.

    Should a startup use cash or accrual accounting?

    Maintain the ledger on accrual from month one, then let the return adopt whichever method the company qualifies for. Cash-basis books portray a business as profitable in whatever month a customer pays and unprofitable in the month it delivers, which renders gross margin unreadable and net burn misleading.

    The IRS defines both methods in Publication 583 and attaches a standard governing either choice:

    “You must use the same accounting method to figure your taxable income and to keep your books. Also, you must use an accounting method that clearly shows your income.”

    Internal Revenue Service, Publication 583, Starting a Business and Keeping Records

    Accrual presentation also accommodates the revenue-recognition judgments any subscription business eventually confronts under ASC 606. Deferred revenue, contract assets, and multi-element arrangements each require somewhere to reside. That architecture is cheap to erect empty and expensive to retrofit.

    What is the cash-method size limit for 2026?

    Thirty-two million dollars of average annual gross receipts, measured across the preceding three taxable years. The ceiling is inflation-indexed, and the IRS published the current figure at section 4.30 of Revenue Procedure 2025-32:

    “For taxable years beginning in 2026, a corporation or partnership meets the gross receipts test of § 448(c) for any taxable year if the average annual gross receipts of such entity for the 3-taxable-year period ending with the taxable year which precedes such taxable year does not exceed $32,000,000.”

    Internal Revenue Service, Rev. Proc. 2025-32 § 4.30

    Virtually every early-stage company clears that threshold comfortably, so the ceiling rarely binds. Its usefulness is conceptual. A tax election and a management-reporting method are distinct choices, and conflating them produces statements that satisfy neither an investor nor an auditor.

    How do you build a chart of accounts that survives three years?

    Construct it in numbered blocks, restrain its size, and locate analytical detail in a department or class dimension rather than in additional accounts. A workable opening taxonomy spans 45 to 70 accounts: 1000s for assets, 2000s for liabilities, 3000s for equity, 4000s for revenue, 5000s for cost of revenue, 6000s for operating expense.

    The characteristic failure is sprawl. A founder codes an expense, autocomplete proposes a near-match, and another account materializes. Twenty-two months on, the ledger carries 240 accounts, four of which signify “software,” and consecutive months no longer compare.

    Three conventions preserve the structure. Add a department, never an account, whenever the question concerns who spent it. Segregate cost of revenue from operating expense absolutely, since gross margin is the metric every investor interrogates first. Rename nothing mid-year; remap at the reporting layer instead.

    What does it cost to fix books that were set up wrong?

    Roughly ten times the day-one figure on the two dominant line items, and more than sixteen times across the complete remediation. Take the modeled company: $8M direct-to-consumer, 22 months on QuickBooks Online, three bank accounts and two credit cards, none reconciled since the file was created.

    • 5 accounts × 22 months = 110 reconciliations owed.
    • 110 × 1.4 hours apiece = 154 hours of tie-out.
    • Plus the 26-hour chart of accounts rebuild: 180 hours across the two dominant items.
    • At a blended $95 hourly rate: 180 × $95 = $17,100.
    • All six rows together: 294 × $95 = $27,930, billed once.
    • Those same decisions in month 1: 18 × $95 = $1,710.

    Dollars understate the damage. Remediation of that magnitude occupies four to six calendar weeks, and it typically surfaces during a raise or a lender review, precisely when the schedule holds no slack. Our examination of where a slow close loses days traces identical rework through a single operating month.

    What compliance dates belong on the calendar before the first paycheck?

    Two, both knowable in advance. The first is the payroll deposit schedule, which the IRS assigns by size rather than by preference. Under Publication 15 (2026), section 11, employers reporting $50,000 or less of taxes during the lookback period are monthly schedule depositors. Those reporting more than $50,000 are semiweekly schedule depositors. Note the boundary: exactly $50,000 stays monthly.

    That lookback window spans four quarters, opening July 1 of the second preceding calendar year and closing June 30 of the preceding one; for 2026 it covers July 1, 2024 through June 30, 2025. Monthly schedule depositors remit by the 15th day of the following month. Semiweekly filers cover Wednesday through Friday wages by the subsequent Wednesday, and Saturday through Tuesday wages by the subsequent Friday.

    The second date is January 31. The IRS requires Forms W-2 to reach employees and the Social Security Administration by then, with Form 1099-NEC reaching recipients and the agency under the same deadline. Where January 31 lands on a weekend, the obligation rolls to the following business day. Companies paying contractors collect a Form W-9 at onboarding for exactly this reason, since pursuing taxpayer identification numbers in late January wastes an avoidable week.

    When does a startup outgrow do-it-yourself bookkeeping?

    At the point where the numbers stop answering questions and begin raising them. Three signals mark the transition: a first employee on payroll, a first material customer contract spanning periods, and a first outside capital event. Any one converts bookkeeping into an accounting function.

    The staffing progression is well worn. A bookkeeper records and reconciles. A controller owns the close, the judgments, and statement accuracy. A fractional CFO builds the forecast, the board packet, and the capital plan. Our breakdown of what a bookkeeper, controller, and CFO each own establishes where one mandate ends.

    Software selection matters less than the operating cadence surrounding it. Aaron Ressel reviews every close packet at Debit & Co. before it reaches a founder, the discipline the Continuous Close Method™ formalizes: reconcile continuously, close within 5 to 7 days, leave no month unexplained. Founders weighing build against outsource can compare startup accounting options side by side.

    Frequently asked questions

    When does a startup need to start bookkeeping?

    At the first transaction, which ordinarily means the first bank account rather than the first customer. Formation costs, software subscriptions, and founder reimbursements all post to the ledger, and reconstructing them afterward from card statements costs more than capturing them once. The practical trigger is opening the business bank account: link the feed that same week, then reconcile month one on schedule.

    How much accounting knowledge does a founder actually need?

    Enough to read three statements and interrogate them. A founder should trace revenue from the income statement to cash on the statement of cash flows, articulate why the two diverge, and name the largest reconciling item. Journal entries, depreciation schedules, and ASC 606 judgments belong to a controller. Interpretation belongs to the founder and cannot be delegated.

    When do startups need GAAP financials?

    Once an outside party relies on them. A priced equity round, a bank facility carrying covenants, an acquisition process, or an initial audit all bring GAAP financials into scope. Accrual books maintained from month one convert to GAAP presentation within days. Cash-basis books maintained for two years convert over weeks, arriving on the buyer’s or lender’s timeline instead of the company’s.

    What is the best bookkeeping software for a small company?

    QuickBooks Online covers most early-stage companies, and NetSuite becomes relevant at multi-entity scale. Automation layers including Puzzle and Bill.com sit above the ledger and handle categorization and payables. Software supplies clean data. A team converts that data into a close, a set of judgments, and a statement somebody will sign.

    How should a founder record the company’s initial financing?

    Never as revenue. Founder contributions, priced rounds, SAFEs, convertible notes, and loans all belong on the balance sheet, each carrying a different classification. Whether an instrument sits in equity or in liabilities is a documented judgment rather than a default, and it alters what the balance sheet reports about solvency. Record the instrument, attach the executed document, and have a controller review the classification before the round closes.

  • What a Controller Catches That a Bookkeeper Can’t

    What a Controller Catches That a Bookkeeper Can’t

    Key takeaways

    • A bookkeeper records the transaction in front of them accurately. A controller checks whether it landed in the right period, under the right method, with a second set of eyes — which is where the costly errors hide.
    • Revenue in the wrong period is the most expensive miss. Revenue recognition drove about 38% of 919 public-company restatements from 1997 to 2002 — the single leading cause (GAO).
    • When one person bills, deposits, and reconciles, the books look clean and still leak money. A median fraud loss at companies under 100 employees runs $141,000 (ACFE, 2024).
    • A controller catches the cutoff error, the missing accrual, the cash-vs-accrual mismatch, and the control gap before they reach a statement a lender or buyer reads.

    A 12-person agency invoiced a client $90,000 in December for a project that finished in February. Cash arrived before year-end, so the bookkeeper booked it as December revenue. The books balanced. The bank reconciled. Nothing looked wrong.

    But December’s profit was overstated by $90,000. The next year started in a hole. When a lender later asked for two years of statements, the restated numbers cost the company its rate. The entry was recorded correctly. It was recognized in the wrong period, and no one above the bookkeeper was looking for that.

    That is the line between the two roles. In the engagements Aaron Ressel and the Debit & Co. team run, the catches that matter are rarely typos in the ledger. They are timing, method, and control — the questions a bookkeeper is not staffed to ask and a controller is paid to. Below are the specific ones, with what each costs when it slips.

    What does a controller catch that a bookkeeper can’t?

    A controller catches errors of judgment, not errors of entry. A bookkeeper makes sure each transaction is recorded accurately and categorized correctly. A controller checks the layer above that. The test is different. It asks whether revenue was earned in the period it was booked, whether the accruals are complete, whether the basis is right, and whether one person can move money unseen. Those checks catch the misstatements an accurate ledger hides in plain sight.

    The pattern repeats across small businesses. The bookkeeping is fine; the oversight around it never scaled. The table below pairs each catch with why the bookkeeping role structurally misses it and what the miss tends to cost.

    The catchWhy a bookkeeper misses itWhat it costs
    Revenue in the wrong period (cutoff)Books cash when it arrives or when the invoice posts, not when the work is deliveredOverstated profit, a restated prior year, a lost lender rate
    Missing or stale accrualsRecords only what has a document; the unbilled expense has no trigger to enterA month that looks profitable until three invoices land next period
    Cash-vs-accrual mismatchRuns on the basis the software defaulted to; no one checks if the entity must accrueBooks that fail diligence and a possible IRS method problem
    Control gap / one-person money flowDoes the bill-pay and the reconciliation, so the reviewer and the doer are the same personA $141,000 median fraud loss at sub-100-employee firms
    GAAP misstatement on the balance sheetKeeps a tax-ready P&L; deferred revenue, prepaids, and fixed assets sit untouchedA balance sheet a buyer’s accountant unwinds in week one

    What is a revenue cutoff error, and why is it the costliest catch?

    A revenue cutoff error is revenue recorded in the wrong period — booked when cash lands or an invoice posts, rather than when the work is actually delivered. It is the costliest catch because it moves profit, and profit is the number lenders, investors, and buyers price off.

    Revenue recognition was the leading cause of public-company restatements, driving roughly 38% of 919 restatements from 1997 to 2002 (GAO). It ranked first in every year of that span. Private books are not audited to that standard, so the error usually goes unnoticed until it matters most.

    The rule that governs it is GAAP’s revenue standard, ASC 606. Under its five-step model, you recognize revenue when you satisfy the performance obligation — when control of the good or service transfers — not when the money moves. The agency above failed step five: the $90,000 obligation was satisfied in February, so the revenue belonged in February.

    A controller runs a cutoff check at close, tying the largest invoices to delivery dates, and moves anything that crossed the line. That single review is the difference between a clean statement and a restatement.

    Why does a missing accrual make a profitable month a lie?

    Because the expense happened whether or not the invoice arrived, and a bookkeeper has nothing to record until a document shows up. An accrual books a known cost in the period it was incurred. Skip it, and the month reads more profitable than it was — until the bills land next month and crush a period that did nothing wrong.

    Work the numbers. A construction firm closes March showing $40,000 in profit. Two subcontractors did $25,000 of March work but won’t invoice until mid-April. With no accrual, March reports $40,000; April absorbs the $25,000 and reports a near-loss. Neither figure is true.

    The controller catch is to estimate and book the $25,000 in March, so March shows $15,000 and April carries only its own costs. Same cash, honest periods. This is the matching principle GAAP is built on: record effects in the periods in which transactions occur, not only when cash changes hands (FASB Concepts Statement No. 1). A bookkeeper records documents. A controller records reality.

    What is the cash-vs-accrual confusion, and when does it become a legal problem?

    Cash basis records money when it moves; accrual records it when it is earned or owed. The confusion starts when books run on whichever basis the software defaulted to, and no one checks whether the business is even allowed to stay on cash. Past a size threshold, accrual is not a preference. It is required.

    Under the tax code, a C corporation, a partnership with a C-corp partner, or a tax shelter generally must use accrual unless it clears the gross-receipts test. As of 2026, that threshold sits at $31,000,000 in average annual gross receipts (IRS Rev. Proc. 2024-40), measured over three years. A bookkeeper may not track that line. A controller does, and converts the books before the method becomes a filing problem.

    Even well under the threshold, cash-basis books distort growth — a great December that was really three customers prepaying for January. A controller flags the mismatch and keeps a clean accrual set for any decision that matters.

    Why does one person handling the money create risk a bookkeeper can’t see?

    Because the person doing the work cannot also be the person checking it, and in most small businesses the bookkeeper is both. When one individual bills customers, deposits cash, and reconciles the account, the books can balance perfectly while money walks out the door.

    The control standard is explicit. Duties should be divided so that no one individual controls all key aspects of a transaction (GAO Green Book, Principle 10). That means separating who authorizes, who records, who reviews, and who holds the asset.

    The cost is not hypothetical. Companies with fewer than 100 employees carry a median fraud loss of $141,000 per scheme, second only to the largest firms, across 1,921 cases studied (ACFE, 2024). The most common reason fraud happens at all is the absence of this oversight. Lack of internal controls was the primary weakness in 32% of cases, with control override adding 19% more.

    A controller does not need to suspect anyone. The controller designs the separation — a second approval on payments, an independent reconciliation — so an honest team stays honest and an error gets caught before it compounds.

    What GAAP misstatements hide on the balance sheet?

    The balance sheet is where bookkeeping-only books quietly drift, because a tax-ready P&L can look right while the balance sheet behind it is wrong. Deferred revenue from prepaid contracts sits as if it were earned. Prepaid insurance hits one month instead of twelve. Fixed assets get expensed instead of capitalized and depreciated. None of these break the bank reconciliation, so none of them surface in day-to-day bookkeeping.

    They surface in diligence. When a buyer or lender’s accountant reads the statements, deferred revenue booked as current revenue is the first thing they unwind, and it can reprice a deal. A controller maintains GAAP-aligned books as a standing discipline.

    That means reconciling the balance sheet line by line each month, not just the bank, so the statements hold up when someone who knows what to look for finally looks. Catching it at close costs an hour. Catching it in diligence costs leverage.

    How do you add controller-level review without a full-time hire?

    You layer it on top of the bookkeeping you already have. The day-to-day recording stays where it is; a controller sits above it and owns the checks — cutoff, accruals, basis, controls, and the balance sheet. Most 5-to-80-employee businesses generate 10 to 15 hours a week of that work, not a full seat, which is why the fractional model fits.

    The practical setup pairs an accurate bookkeeper in small-business accounting with an outsourced controller running QuickBooks Online to a defined close each month. The bookkeeper keeps the ledger current. The controller catches what the ledger can’t show on its own. You get the oversight that prevents the $90,000 restatement and the $141,000 leak without building a finance department to do it.

    Common questions about what a controller catches

    Can’t a good bookkeeper catch these errors too?

    A strong bookkeeper keeps an accurate ledger, but cutoff, accruals, method, and segregation of duties are judgment and oversight tasks outside that role. The structural problem is independence: the person recording the transactions cannot also be the person reviewing whether they belong. That second set of eyes is the controller function.

    What is a revenue cutoff error?

    It is revenue recorded in the wrong accounting period, booked when cash arrives or an invoice posts rather than when the work is delivered. Under GAAP’s ASC 606, revenue belongs in the period the performance obligation is satisfied. Recognizing $90,000 in December for work finished in February overstates December.

    When is my business legally required to use accrual accounting?

    Under IRC §448, a C corporation, a partnership with a C-corp partner, or a tax shelter generally must use accrual once average annual gross receipts pass the threshold. That threshold is $31,000,000 for 2026 (IRS Rev. Proc. 2024-40). Below it, accrual is optional for tax but still recommended for decision-grade books.

    Why does segregation of duties matter at a small company?

    Because one person who bills, deposits, and reconciles can move money while the books still balance. Federal internal-control standards (GAO Green Book, Principle 10) require dividing duties so no individual controls a full transaction. With a median fraud loss of $141,000 at sub-100-employee firms, the separation is a control, not a vote of no confidence.

  • When ‘Good Enough’ Bookkeeping Starts Costing You

    When ‘Good Enough’ Bookkeeping Starts Costing You

    Key takeaways

    • “Good enough” books are closed on time yet still wrong: expenses miscategorized, cash-basis where accrual belongs, reports that read clean but mislead.
    • The IRS standard is accurate and supportable, not merely complete. An inaccurate return carries a 20% accuracy-related penalty under IRC § 6662.
    • Sole proprietors underreporting income account for roughly $80 billion a year, about 16% of the $496 billion federal tax gap (GAO, TY2019).
    • Cash-basis books distort profitability and become illegal once average gross receipts pass ~$31 million for 2025 (IRC § 448).
    • The fix is review, not more software: GAAP-accrual books with a second set of eyes before the file locks.

    A founder we met had a P&L showing a $42,000 profit for the quarter. The bank wanted accrual financials before extending a line. When we re-cut the same QuickBooks Online file on an accrual basis, that profit became an $18,000 loss.

    Nothing was late. Every account reconciled. The books were “done,” and also wrong, and the founder had steered on them for nine months. That gap, between books that are finished and books that are right, is where “good enough” quietly bills you.

    This is a different failure than books that fall behind. Behind is a timing problem. This is an accuracy problem that hides in plain sight, because the file looks tidy.

    What does “good enough” bookkeeping actually mean?

    It means the books are current and reconciled, yet the numbers underneath are categorized wrong, posted to the wrong period, or kept on a basis that misstates profit. The work is present. The accuracy is not. A bank feed that auto-categorizes a $9,000 equipment purchase as “office supplies” still reconciles to the penny. The trial balance balances. The owner trusts the clean report. That trust is the trap.

    The IRS does not measure your books by whether they are finished. Under 26 U.S. Code § 6001, every taxpayer must keep records that substantiate what the return reports. IRS Publication 583 is blunter: records must let you “prepare accurate financial statements” and stand up to inspection. Miscategorized books fail that test even when they reconcile. Done is not the bar. Supportable is.

    How much does inaccurate bookkeeping actually cost?

    It costs you three ways: a direct tax penalty, lost deductions, and decisions priced on the wrong numbers. The penalty is the cleanest to quantify, because under IRC § 6662 an inaccurate return triggers a 20% accuracy-related penalty on the underpaid portion, and the IRS names “not checking the accuracy of a deduction” as negligence outright.

    This is not a rare edge case. The Government Accountability Office found sole proprietors who underreport income account for about $80 billion a year in unpaid tax, roughly 16% of the $496 billion federal tax gap, with 27.8 million sole-proprietor returns filed in 2019.

    Most of that is recordkeeping, not fraud. A deduction you earned but miscoded gets lost. A deduction you took but cannot support gets disallowed, then penalized. Both bleed from the same wound: books that were filed before they were verified.

    Why do cash-basis books mislead a growing company?

    Cash-basis books record money only when it moves, so they routinely lie about which period actually earned the profit. A customer prepays $60,000 in March, and that month looks like a banner quarter even though the work ships across the next two.

    Unpaid vendor bills sit invisible, so the month reads more profitable than it is. The founder above had exactly this: cash in the door read as profit while delivery costs had not yet posted.

    Accrual fixes this by matching revenue to the period it was earned and expenses to the period they were incurred. That is the basis GAAP expects, and the basis lenders and investors assume when they read your statements.

    There is also a hard legal line. Under IRC § 448 and IRS Publication 538, a company that passes the gross-receipts test, indexed to about $31 million for 2025, can no longer use the cash method and must convert to accrual on Form 3115. Let “good enough” cash books ride toward that line and you rebuild the foundation during diligence, the worst possible moment.

    What are the signs your books are wrong, not just late?

    Late books announce themselves. Wrong books do not, which is why this checklist matters. Run your last closed month against it.

    Warning signWhat it usually means
    The same expense lands in a different category month to monthNo categorization rules; reports are not comparable period to period
    “Ask my accountant” or “uncategorized” holds more than a rounding amountTransactions parked, not classified; margins are a guess
    The P&L swings wildly month to month with no real change in operationsCash-basis timing, or revenue and costs landing in the wrong periods
    Equipment and software purchases hit expense, never the balance sheetCapitalization missed; assets and profit both misstated
    Owner draws, loans, and revenue are tangled in the same accountsBusiness and personal not separated, the exact § 6001 failure
    A lender or investor asked for accrual financials you could not produceBooks cannot support the capital decision they were built for

    Two or more of these is not a clerical nuisance. It means the reports you price decisions on cannot be trusted, and the file needs a review pass before the next close locks.

    How do bad books sabotage funding and growth?

    They break exactly when the stakes are highest: when you ask for money. The Federal Reserve’s 2024 Small Business Credit Survey found 51% of employer firms cite uneven cash flow as a challenge, and 88% rely on the owner’s personal credit to secure financing.

    Roughly 37% applied for financing in the prior year. Every one of those moments runs on financial statements, and a lender reading distorted books either prices the risk against you or declines.

    The cost compounds past the bank. BLS Business Employment Dynamics data show only about half of new establishments survive to year five. Trustworthy books are the instrument panel for that stretch. When the panel reads wrong, an owner cuts the wrong line, hires into a loss, or misses eroding margin until cash runs thin.

    How do you fix books that are done but wrong?

    You add review, not more software. A new tool categorizes faster; it does not catch a $9,000 asset miscoded as supplies. A second set of eyes does. The fix is a defined chart of accounts with categorization rules, accrual treatment of revenue and costs, and a reviewer who checks the work before the month locks.

    “In the engagements we run, the most expensive errors are almost never the obvious ones,” says Aaron Ressel. “They are the quiet miscategorizations that reconcile cleanly and still steer a business wrong for months.” That review discipline is what turns good bookkeeping into Financial Clarity™, and it is the core of our small business accounting services.

    For founders racing toward a raise, the accrual-and-review work belongs in place early, which is the case for outsourced startup bookkeeping before diligence, not during it. As of 2026, the gross-receipts threshold sits near $31 million; build for accrual well before you reach it.

    Frequently asked questions

    Can books be reconciled and still be wrong?

    Yes. Reconciliation proves the bank balance matches the ledger. It says nothing about whether each transaction landed in the right category, period, or account. A $9,000 asset coded as office supplies reconciles perfectly and still misstates both your balance sheet and your profit.

    What is the penalty for inaccurate bookkeeping on a tax return?

    Under IRC § 6662, the IRS can assess a 20% accuracy-related penalty on the portion of tax underpaid through negligence or a substantial understatement. The agency cites failing to check a deduction’s accuracy as negligence, so sloppy categorization is exposure, not just a tidiness issue.

    When does a business have to switch from cash to accrual?

    Under IRC § 448, a C corporation or partnership with a C-corp partner generally must use accrual once average annual gross receipts pass the indexed threshold, about $31 million for 2025. The switch is filed on Form 3115. Most growth-stage companies should adopt accrual well before the limit because lenders and investors expect it.

    Is QuickBooks Online enough to keep books accurate?

    QuickBooks Online is a strong ledger, but it executes the rules you give it. It will auto-categorize a transaction to the wrong account and reconcile it without complaint. Accuracy comes from a defined chart of accounts, accrual treatment, and a reviewer, not from the software alone.

    How do I know if my reports are trustworthy enough to make decisions?

    Run the signs-your-books-are-wrong checklist above. If categories drift, “uncategorized” carries real money, or you could not hand a lender clean accrual statements tomorrow, treat the reports as unverified and get a review pass before the next close locks.

  • The Hidden Cost of Running QuickBooks Behind

    The Hidden Cost of Running QuickBooks Behind

    Key takeaways

    • Behind books cost money in four places at once: decisions made on stale numbers, tax penalties and interest, cash you cannot see, and the catch-up scramble itself.
    • A late return runs a 5% per month failure-to-file penalty, capped at 25%, plus 0.5% per month to pay and 7% annual interest (IRS, as of mid-2026). Sloppy records that produce a wrong number can add a 20% accuracy penalty.
    • The median small business holds 27 cash buffer days (JPMorgan Chase Institute). Run the books 90 days behind and you are steering a month-to-month cash position blind.
    • A rough rule: 30 days behind is normal, 90 days behind is a problem, and a full year behind is a cleanup project, not a weekend.

    The median small business in America holds 27 days of cash. That figure comes from JPMorgan Chase Institute, which read 470 million transactions across 597,000 firms. Run that 27-day margin while your QuickBooks file is three months stale, and you are making payroll calls, pricing calls, and hiring calls against numbers that describe a quarter that already ended.

    In the engagements Kevin Cahill and the Debit & Co. team run, the cost of behind books is never the bookkeeping fee. It is the decisions, the penalties, and the scramble that pile up while no one is reconciling.

    What does it actually cost to run QuickBooks behind?

    The cost shows up in four places, and none of them is the monthly bookkeeping charge. First, you decide on stale numbers. Second, you take on tax penalties and interest. Third, you lose deductions you can no longer prove. Fourth, you pay for a catch-up project later, at a worse price, under deadline.

    The fee for keeping books current is visible and small. The cost of skipping it is invisible, larger, and it compounds the longer the file sits.

    None of these costs announce themselves. A late penalty arrives as an IRS notice. A bad hire traces back to a margin you misread two quarters ago. A denied loan reads as a credit decision, not a bookkeeping one. The damage is real, yet it hides inside other line items, so the books rarely get the blame they earned.

    How do stale numbers lead to bad decisions?

    Stale numbers fail at the exact moment you need them. Every operating decision leans on a current figure: what a job actually costs, where margin is leaking, whether cash covers next month. When the books trail by 60 or 90 days, those figures describe a business that no longer exists. You are not flying without instruments. You are flying with instruments that read last quarter.

    The Federal Reserve’s 2025 Small Business Credit Survey found 51% of small employer firms named uneven cash flow as a financial challenge, and 56% pointed to paying operating expenses. Those are precisely the calls current books exist to inform. Misprice one large job because last month’s costs never posted, and a single decision can erase a quarter of margin. The error is not in the spreadsheet. It is in the input.

    What does falling behind cost you at tax time?

    It costs penalties, interest, and deductions you can no longer defend. The penalties are mechanical, and they stack. The IRS charges a failure-to-file penalty of 5% of unpaid tax for each month a return is late, capped at 25%. A separate failure-to-pay penalty adds 0.5% per month, also capped at 25%.

    Interest runs on top. As of mid-2026, the underpayment rate for non-corporate taxpayers is 7% per year, compounded daily, and it resets quarterly. The numbers below are the published IRS figures.

    Cost at tax timeRate (IRS, as of mid-2026)What triggers it
    Failure-to-file penalty5% of unpaid tax per month, max 25%Return filed late because the books were not ready
    Failure-to-pay penalty0.5% per month, max 25%Tax owed but unpaid by the deadline
    Underpayment interest7% per year, compounded daily, resets quarterlyAny unpaid balance, accruing until paid
    Accuracy-related penalty20% of the understatementA wrong return from negligence or a substantial understatement
    Lost deductionsUp to 100% of the deductionExpenses you cannot substantiate when asked

    The last two rows do the quiet damage. The IRS failure-to-file penalty is the headline, but the accuracy-related penalty adds 20% of any understatement that traces to negligence or sloppy records.

    Worse is what you simply cannot claim. The burden of proof to substantiate every deduction sits with the taxpayer, not the agent. Mileage, meals, equipment, contractor payments: if the records are a year behind and the receipts are gone, the deduction is gone with them. You end up paying tax on income you spent.

    How behind is “too behind”?

    A useful rule: 30 days behind is normal, 90 days behind is a problem, and a year behind is a cleanup project. The point is not the exact day count. It is that the cost curve bends upward fast.

    A month of unreconciled transactions is a morning’s work. A year of them is a forensic exercise, because memory fades, vendors change, and the bank only stores so much history. The gauge below is the one we use to triage a new file.

    How far behindWhat it meansWhat it costs to fix
    0–30 daysNormal. Last month is closing now.Routine. A standard monthly close.
    30–90 daysDrifting. You are deciding on old numbers.A focused catch-up, still measured in days.
    90 days–1 yearA problem. Tax positions and cash are now guesses.A scoped cleanup, often a few weeks.
    1 year or moreA project. Filings are likely late and penalties may be accruing.A full reconstruction, priced as a project.

    Two signals matter more than the calendar. The first is a missed or extended filing, because that is when penalties begin to run. The second is a decision you postponed because you did not trust the numbers. When you stop asking the books questions, you are already flying blind.

    Why is catching up yourself the expensive option?

    Because the DIY catch-up usually costs more than it saves, in time and in errors. The work looks like data entry and is not. A year of catch-up means reconstructing cutoff, separating owner draws from real expenses, fixing miscategorized transactions that have compounded for months, and untangling a bank feed that auto-matched wrong.

    Each mistake propagates. A misclassified loan deposit booked as income inflates revenue, inflates the tax, and hides the actual cash picture all at once.

    Then there is the opportunity cost. The weekends an owner spends rebuilding a QuickBooks Online file are weekends not spent selling, hiring, or serving customers. About one in three businesses survives its first decade; only 34.7% of establishments born in 2013 were still operating in 2023, per Bureau of Labor Statistics data.

    Financial blindness is a recurring thread in the ones that fail. The cheapest version of catch-up is the one done by someone who reconciles for a living, before the backlog turns into a reconstruction.

    When does behind become a cleanup, not a chore?

    It crosses the line when the file can no longer be trusted to produce a decision or a filing. Once you are past 90 days, or once a deadline has slipped, the work is no longer maintenance. It is recovery. At that point the goal is not to “do the bookkeeping.” It is to rebuild a clean baseline you can stand on. Then you keep it current so the gap never reopens.

    That recovery is exactly the work our QuickBooks cleanup and catch-up services are built to own: reconstruct the period, fix the categorizations, reconcile every account, and return books that tie. Keeping them current afterward is what our small business accounting services handle month to month.

    Lenders make this concrete. The Federal Reserve found 60% of small employer firms applied for financing in the prior year, and every one of those applications needs current, defensible financials. Behind books do not just cost penalties. They cost the loan you needed to grow.

    Frequently asked questions

    How many months behind on bookkeeping is too many?

    As a working rule, 30 days behind is normal, 90 days is a problem, and a year or more is a cleanup project rather than a chore. The harder signal than the calendar is a missed filing or a decision you postponed because you did not trust the numbers.

    What are the IRS penalties for filing taxes late because my books were not ready?

    The IRS charges a failure-to-file penalty of 5% of unpaid tax per month, up to 25%, plus a failure-to-pay penalty of 0.5% per month, also capped at 25%. Interest accrues on top, at 7% per year for non-corporate taxpayers as of mid-2026, compounded daily and reset quarterly.

    Can behind books actually cause me to lose tax deductions?

    Yes. The burden of proof to substantiate a deduction sits with the taxpayer. If your records are a year behind and the receipts are gone, you cannot defend the expense, and the deduction is lost. A wrong return from sloppy records can also draw a 20% accuracy-related penalty.

    Should I catch up QuickBooks myself or hire someone?

    A month or two of backlog is reasonable to handle yourself. A year of catch-up is a reconstruction, where a single miscategorized entry can distort revenue, tax, and cash at once. Past 90 days, the cheaper path is usually someone who reconciles for a living and can rebuild a clean baseline.

  • Is Your Outsourcing Partner Safe With Client Data?

    Is Your Outsourcing Partner Safe With Client Data?

    Key takeaways

    • When your firm outsources bookkeeping or tax prep, the duty to protect client confidentiality stays with you. A vendor breach becomes your firm’s liability, not theirs.
    • Ask for a SOC 2 Type II report, not Type I. Type I rates control design on one day; Type II tests whether those controls actually held over a 3-to-12-month window.
    • If the partner touches tax data, IRS Section 7216 requires the taxpayer’s prior written consent before that data is disclosed or used. A violation is a misdemeanor: up to a $1,000 fine and up to one year in prison.
    • The stakes are rising. Verizon’s 2025 report found third-party involvement in breaches doubled to 30%, and IBM put the 2025 U.S. average breach at $10.22 million, the highest of any region.

    A CPA firm we spoke with last year had vetted an outsourcing partner on price, turnaround, and references, then signed. Six weeks in, a client asked a single question the firm could not answer: where, physically, does my tax data live, and who can see it? No one at the firm knew, because they had reviewed the work and never the controls. That gap is the one that quietly ends partnerships.

    When your firm hands client records to an outside provider, you do not hand off the responsibility. Under the AICPA Code of Professional Conduct and most state board rules, the duty to protect client confidentiality stays with your firm. A vendor’s mistake becomes your firm’s liability.

    So the question before you sign is not whether the partner can do the work. It is whether you can defend the relationship if a client, a regulator, or your malpractice carrier ever asks.

    What is the difference between SOC 2 Type I and Type II?

    A SOC 2 Type I report confirms the controls were designed correctly on a single date. A Type II report confirms those controls actually operated over a period of time, typically three to twelve months. Type II is the one that matters. It is the difference between a partner who drew up a sound security plan and one who proved they followed it for a year.

    SOC 2 is an independent examination defined by the AICPA, measured against five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is the baseline; Confidentiality is the criterion most relevant to your clients’ records.

    Ask for the report under NDA, not the badge on the website. Check that the period is recent, confirm which criteria it covers, and read the exceptions section. You want minor findings with a remediation plan, not a report that looks suspiciously spotless.

    How should a partner protect data in transit and at rest?

    Both. Encryption in transit protects data moving between your firm and the partner; encryption at rest protects the data sitting inside their systems. Both answers should come back as an immediate yes. Encryption is the floor, not the ceiling.

    Then ask where the files actually live, because reputable cloud infrastructure carries its own security certifications and a shared drive nobody has audited in years does not. The exposure is measurable. Verizon’s 2025 Data Breach Investigations Report found the median time to remediate a leaked secret in a public code repository was 94 days. That is more than three months of open exposure.

    When a partner treats these questions as a technicality, that reaction reveals how seriously security lives in the daily work rather than the sales deck.

    Who on the partner’s team can see your clients’ files?

    Fewer people than you would guess, in a well-run shop. Most real breaches are not sophisticated hacks; they happen when too many people hold access to too much. Verizon’s 2025 report found third-party involvement in confirmed breaches doubled from 15% to 30% in a single year, much of it through credential exposure and misconfigured systems at partners.

    Ask how access is granted and removed. You want role-based access, where people see only what their job requires, multi-factor authentication on every account, and a documented process that cuts off access the day someone leaves.

    If the partner offshores any part of the work, ask where the people touching the data are located and whether the same controls follow them there. Geography is not the issue; consistent controls everywhere the data travels is the issue.

    What does IRS Section 7216 require for outsourced tax work?

    If your firm prepares returns, IRS Section 7216 applies. It requires the taxpayer’s prior written consent before return information is disclosed to or used by a third party such as an outsourcing partner. This is not optional, and the penalty is criminal.

    Under 26 CFR 301.7216-1, a knowing or reckless violation is a misdemeanor carrying a fine of up to $1,000, up to one year in prison, or both, per violation. A separate civil penalty under IRC 6713 adds $250 per improper disclosure, capped at $10,000 a year.

    Your contract should reflect this. It needs a confidentiality clause and, ideally, a data processing agreement. That agreement should spell out what the partner may do with the data, what they may not, how long they keep it, and what happens when the engagement ends. A partner who knows exactly what Section 7216 means without you explaining it has handled regulated tax data before.

    Separately, the FTC Safeguards Rule treats tax and accounting firms as financial institutions and requires a written information security program, including written contracts requiring service providers to protect customer information. Your vendor is one of those service providers.

    The eight controls to vet before you sign

    The diligence splits cleanly across eight controls, each paired below with the question to ask and the reason it matters. Run it as a checklist, and keep a short record of what you asked and what they answered. That file is cheap insurance if anyone ever questions the relationship.

    ControlWhat to askWhy it matters
    SOC 2 reportCan we review your SOC 2 Type II report under NDA?An independent auditor verified the controls held over time, not just on paper
    EncryptionIs client data encrypted in transit and at rest?The baseline that protects data in motion and data at rest in their systems
    Data locationWhere do the files physically live, and on what infrastructure?Certified cloud infrastructure beats an unaudited shared drive
    Access controlsWho can see our files, and how is access granted and removed?Role-based access plus MFA is where most breaches are won or lost
    Offshore controlsIf work is offshored, do the same controls apply there?Controls must follow the data wherever it travels
    Section 7216 and contractHow do you handle Section 7216 consent and a data processing agreement?Tax data carries a criminal-penalty disclosure rule your firm owns
    Data useDo you use our data to train models or build benchmarks?Anything beyond the work you hired them for needs to be in writing
    Incident responseDo you carry cyber liability insurance and notify us within a set window?A partner who planned for the bad day is safer than one who insists it will not come
    Sources: AICPA Trust Services Criteria; IRS Section 7216 (26 U.S.C. 7216); FTC Safeguards Rule.

    Why does the partner’s posture tell you as much as the answers?

    Because the posture is a preview of the relationship. A partner who treats your security questions as a welcome, expected part of diligence is showing you how they will steward your clients’ data after the contract is signed. A partner who turns impatient is signaling the opposite.

    The cost of misjudging that is no longer abstract: IBM’s 2025 Cost of a Data Breach report put the U.S. average breach at $10.22 million, the highest of any region in the study.

    In the engagements our senior controller Aaron Ressel runs, the firms that push hardest on security end up the easiest to serve, because the expectations are written down before the first file moves. When firms partner with us for white-label bookkeeping or white-label tax preparation, we would rather you push hard on the security conversation than skip it.

    Every workflow runs through our Continuous Close Method™, documented into a Custom Playbook so the controls survive staff turnover and travel with the engagement, not with one person. As of 2026, that is the standard your clients should expect any partner to meet.

    Questions firms ask before they outsource

    Is SOC 2 Type I good enough, or do we need Type II?

    Ask for Type II. A Type I report rates control design on a single day. A Type II report tests whether those controls operated over a three-to-twelve-month period, which is the evidence that the partner actually follows its own security plan. If a partner holds only a Type I, treat it as a starting point and ask when the Type II examination completes.

    Do we need client consent to send tax data to an outsourcing partner?

    Yes, in most cases. IRS Section 7216 requires the taxpayer’s prior written consent before a preparer discloses or uses return information through a third party. The penalty for a violation is a misdemeanor, up to $1,000 and up to one year in prison per violation. Build the consent into your engagement process, not as an afterthought once the work has already moved.

    Who is liable if the outsourcing partner has a breach?

    Your firm carries the duty to clients regardless of the vendor’s role. The AICPA Code of Professional Conduct and state board rules place confidentiality on the CPA, and the FTC Safeguards Rule requires you to bind service providers by written contract. A partner’s cyber liability insurance helps, but it does not transfer your professional obligation, which is why the vetting and the contract terms matter.

    What if the partner offshores the work?

    Offshoring is not the risk; inconsistent controls are. Ask where the people touching your clients’ data are located and whether role-based access, multi-factor authentication, and encryption apply equally to them. If the partner cannot describe how its controls follow the data offshore, treat that as a red flag.