Key takeaways
- What can a CPA firm outsource? Nearly all recurring production. Licensure restricts a narrow band, and Florida states plainly that non-licensees may prepare tax returns and financial statements without an opinion.
- Three rulebooks govern the boundary, and each answers a different question. The state practice act decides who issues the report. AICPA interpretation 1.295 decides what production work does to independence, and federal law decides who signs.
- The AICPA Code publishes the task map directly. Interpretation 1.295.120 lists 9 bookkeeping and payroll acts that keep independence intact and 8 that impair it.
- Approval is the hinge, not the keystroke. A provider may post entries and prepare reconciliations; the firm approves the coding, authorizes the payments, and evaluates the results.
- In the 240-return example below, 576 prep hours a season move out and 144 review hours stay in, or 20.0% of total delivery time.
Ask what can a CPA firm outsource, and the answer covers nearly all recurring production work. The restricted band is narrow, and it is written down. Florida reserves two categories of service to license holders, and the same statute then confirms that non-licensees may prepare tax returns and financial statements that carry no opinion. Everything upstream of the report is a scoping decision rather than a legal one.
What complicates the question is that three separate rulebooks apply, and firms tend to read only one. A state practice act governs who may issue an attest report. The AICPA independence rules govern what happens when production work is performed for an attest client. Federal tax law governs who signs a return and how return information moves.
What can a CPA firm outsource?
Recurring production, in almost every category. Transaction coding, reconciliation, payables preparation, payroll input, workpaper assembly, financial statement preparation, and tax return preparation all transfer to an external team without touching a licensure restriction.
What does not transfer is a short list: the attest report itself, the approvals that sit inside the ledger work, the return signature, and the firm’s own quality management system. Firms performing engagements under the auditing, attestation, or accounting and review standards had to design and implement that system by December 15, 2025. No provider arrangement satisfies it on the firm’s behalf. Every rule cited here is current as of August 2026.
Geography is the axis most often confused for the legal one. Delivery from Tampa, Manila, or a firm’s own back office changes the operating model and the security posture. It does not move any of the three boundaries below.
Where does state licensure draw the line?
At the opinion. State practice acts reserve attestation and the expression of an opinion on financial statements to license holders, and treat the surrounding accounting work as open. Florida’s statute is unusually explicit about the second half.
“Perform or offer to perform any services described in s. 473.302(8)(a) or (d) unless such person holds an active license under this chapter and is a licensed firm, provides such services through a licensed firm, or complies with ss. 473.3101 and 473.3141. This paragraph does not prohibit the performance by persons other than certified public accountants of other services involving the use of accounting skills, including the preparation of tax returns and the preparation of financial statements without expression of opinion thereon”
Fla. Stat. § 473.322(1)(c)
The two cross-referenced paragraphs define the restricted band. Section 473.302(8)(a) covers the expression of an opinion and attestation as an expert in accountancy to the reliability or fairness of financial information. Paragraph (8)(d) covers attestation engagements performed under the Statements on Standards for Attestation Engagements.
Read the sentence that follows the prohibition closely. It is an affirmative permission, and it names the two services firms most often assume are restricted. State language varies, so a firm licensed in several jurisdictions checks each board rather than generalizing from one. The structure holds across the Florida practice act and its counterparts: the report is licensed, the preparation is not.
Which tasks move, and which stay inside the firm?
Almost every task splits rather than moves whole. A provider performs the production step, and a named person inside the firm performs one specific act that the provider cannot perform for them.
| Task | Moves to a provider | Stays with the firm | Rule that draws the line |
|---|---|---|---|
| Transaction coding, ledger maintenance in QuickBooks Online or Xero | Yes | Approval of account classification | ET 1.295.120 .03(a) |
| Bank, card, and clearing reconciliation | Yes | Evaluation of the reconciling items | ET 1.295.120 .02(i) |
| Payables coding and payment preparation in Bill.com | Yes | Payment authorization and check signature | ET 1.295.120 .03(e), (f) |
| Payroll input assembly and transmission | Yes | Approval of time records and the release authority | ET 1.295.120 .02(g), (h) |
| Financial statement preparation without an opinion | Yes | Nothing reserved by licensure | Fla. Stat. 473.322(1)(c) |
| Individual and business return preparation | Yes | The signature and primary responsibility | 26 CFR 301.7701-15(b)(1) |
| Audit, review, and compilation reports | No | Issuance of the report | Fla. Stat. 473.302(8)(a), (d) |
| Engagement acceptance and the firm’s quality management system | No | Design, implementation, and operation | SQMS No. 1, effective December 15, 2025 |
Two patterns run through the right-hand columns. Approval is retained wherever a judgment sets an accounting outcome. Authority is retained wherever money or a filing leaves the client. Neither is a volume commitment, which is why the retained work rarely justifies the headcount the production work does.
What changes when the client is an attest client?
The same production work becomes a nonattest service, and independence rules attach to it. The work is still permitted. It now carries conditions, and those conditions run to the client rather than to the provider.
Interpretation 1.295.040 of the AICPA Code of Professional Conduct sets four agreements the attest client must make before the work begins. The client agrees to:
“assume all management responsibilities… oversee the service, by designating an individual, preferably within senior management, who possesses suitable skill, knowledge, and/or experience… evaluate the adequacy and results of the services performed… accept responsibility for the results of the services.”
ET §1.295.040 .01(a), AICPA Code of Professional Conduct
The designated individual does not need to be able to perform the work. The Code says so directly, which keeps the requirement practical for a controller overseeing a specialist team.
A second interpretation defines the hard stop. Under 1.295.030, assuming a management responsibility for an attest client creates a threat so significant that no safeguard reduces it, and independence is impaired. The Code lists 12 example activities, including preparing source documents, having custody of client assets, authorizing transactions, and accepting responsibility for the preparation and presentation of the financial statements.
Interpretation 1.295.120 then does something unusual for an ethics standard. It publishes the task map itself, naming 9 bookkeeping, payroll, and disbursement acts that keep independence intact and 8 that impair it.
The permitted side covers posting client-coded transactions, building statements from the client’s trial balance, generating unsigned checks, and preparing a reconciliation that flags items for the client’s evaluation. The impairing side is where firms drift. It names determining or changing journal entries and account coding without the client’s prior approval, authorizing transactions, preparing source documents, signing checks, and approving vendor invoices for payment.
The distinction is procedural. A provider may prepare and propose; the firm and its client approve. Firms that document that sequence keep the file clean, and the ones that treat approval as implied are the ones a peer reviewer questions.
Who signs the work, and who answers for it?
The individual with primary responsibility, and that individual is defined by federal regulation rather than by the engagement letter. Preparation may be distributed across a team; the signature is not.
“A signing tax return preparer is the individual tax return preparer who has the primary responsibility for the overall substantive accuracy of the preparation of such return or claim for refund.”
26 CFR § 301.7701-15(b)(1)
A team member who prepares a substantial portion of a return without signing it is a nonsigning preparer under the following paragraph. Both roles carry preparer obligations. Only one carries the signature, and the definition at 26 CFR 301.7701-15 is what makes review a staffing line rather than a courtesy.
The information transfer carries its own rules. Moving tax return information outside the permitted purposes is a criminal offense under 26 U.S.C. 7216. The statute sets a fine of up to $1,000, imprisonment of up to 1 year, and the costs of prosecution. Because the offense is a Class A misdemeanor, 18 U.S.C. 3571 lifts the effective maximum fine to $100,000 for an individual. A parallel civil penalty under 26 U.S.C. 6713 runs $250 for each disclosure or use, capped at $10,000 per calendar year.
Consent mechanics belong in the workflow design rather than in the provider contract. Our walkthrough of outsourced tax return preparation covers that sequence step by step.
What does the split cost in hours?
Roughly a fifth of delivery time stays inside the firm. The figures below illustrate the method on a single season of individual returns, and they describe an hours model rather than any rate card.
- Individual returns in the season: 240.
- Preparation time per return: 2.4 hours.
- Preparation hours in total: 240 × 2.4 = 576 hours.
- Review and signature time per return: 0.6 hours.
- Review hours retained: 240 × 0.6 = 144 hours.
- Delivery hours in total: 576 + 144 = 720 hours.
- Share the firm keeps: 144 ÷ 720 = 20.0%.
- Preparation load across an 11-week season: 576 ÷ 11 = 52.4 hours a week, or 1.31 full-time schedules at 40 hours.
The 1.31 figure is what forces a seasonal hire. The 144-hour figure is a calendar commitment for someone who already knows the clients, and it does not shrink when the preparation moves. Firms that scope the first number without staffing the second are the ones whose review quality slips in the last two weeks of the season.
Recording work through the month rather than at period end changes the same arithmetic on the accounting side, which is the premise of the Continuous Close Method™. Aaron Ressel reviews the retained-hours line with a firm before scope is agreed, because a split that looks efficient on production hours can quietly understaff review. The comparable structure on the branding side is covered in white-label accounting services, and the delivery-geography question in offshore bookkeeping and CPA firm outsourcing.
Frequently asked questions about CPA firm outsourcing
Can audit and attest work be outsourced?
The report cannot. Supporting production inside an attest engagement is a different question, and firms routinely use external resources for scheduling, confirmations, and workpaper assembly under the engagement team’s direction. What stays fixed is that the licensed firm plans the engagement, forms the conclusion, and issues the report. Florida reaches that result by restricting the services at s. 473.302(8)(a) and (d) to licensees.
Can a non-CPA prepare a client’s financial statements?
Yes, provided the statements carry no opinion. Fla. Stat. 473.322(1)(c) states the permission directly, naming both tax return preparation and the preparation of financial statements without expression of opinion. The moment an opinion, review conclusion, or compilation report attaches, the work returns to the licensed firm. This is the provision that makes production outsourcing workable at all.
Does outsourcing change the firm’s responsibility to its client?
No. Responsibility attaches to the firm that signed the engagement letter and stays there regardless of who performed the underlying work. That is why the retained approvals in the table above are structural rather than optional. A firm that documents its review steps can demonstrate how a deliverable was checked; a firm that assumed the provider handled it has no such record.
Do state boards restrict sending accounting work offshore?
Requirements vary by jurisdiction, and the variation is in disclosure and consent rather than in what may be performed. Some boards impose notification duties beyond the AICPA position, and firms licensed in multiple states apply the strictest applicable rule. Confirm the current rule with each board before an engagement starts, since board rules change more often than the underlying practice acts.
Does peer review cover work performed by an outside provider?
It covers the firm’s system and the engagements that system produced, which includes work an outside team performed. The AICPA Peer Review Program examines a firm’s quality management system every 3 years. A reviewer evaluates how the firm supervised and reviewed the work, so the documented approval trail is the evidence that matters.
