A practical outline of the access, working-file, personnel, retention and incident-response questions to settle before client information is shared.
Accounstone’s delivery centre is in India, so U.S. firms should assess cross-border access and any client, tax-return-information, privacy or contractual requirements before granting access. Accounstone does not currently represent that it holds SOC 2 or ISO 27001 certification. A client should not treat use of QuickBooks Online, Xero or another established platform as a substitute for reviewing the service provider’s own people, devices, access practices and handling of temporary files.
Security requirements vary by client and workflow. The items below are matters to document and confirm for the actual engagement; they are not a statement that every control is already independently certified or applies identically to every account.
A clear written scope should identify the information involved, the people and systems that can handle it, and what happens when the work is paused or ends.
Agree which accounting, tax or property-management systems are in scope, which named people need access, the minimum permissions required, how access is approved and how it is revoked when a person or engagement changes.
Working inside a client platform does not mean every source document stays there. Identify whether exports, downloads, email attachments, spreadsheets or other working files are needed, where they may be handled, who may access them and which tools are approved.
Before access is granted, confirm the authentication requirements, device protections, remote-work arrangements and any client-specific restrictions that apply to the people performing the work. Do not assume these controls from the software platform alone.
Identify who is permitted to perform the work, what confidentiality commitments apply, what personnel checks are actually completed, and whether any subcontracting is permitted. Any change to the approved personnel or subcontracting arrangement should follow the written engagement terms.
Set the retention period for temporary files and working papers, the approved storage location, the method for returning records and how deletion will be confirmed when the work or engagement ends. Revoking system access does not delete copies held elsewhere.
Name the incident contacts, notification timeframe, escalation route, evidence-preservation steps and each party’s responsibilities. The agreement should cover suspected as well as confirmed incidents and explain how updates will be provided while facts are being established.
Your accounting platform may remain the primary system of record, while source documents or temporary working files may pass through other approved locations. The engagement should map each step—from receipt and access through preparation, review, return and deletion—rather than rely on a broad statement that work is performed inside your software.
The same review should cover any cross-border transfer or disclosure of regulated information, client consent requirements, contractual restrictions and applicable professional obligations. The responsible firm should confirm those requirements with its qualified legal or professional adviser before sharing client information.
The engagement should state who owns each approval, payment, filing, client communication and professional review decision. Preparation support does not itself confer authority to move money, submit a return, make a tax or legal judgment, or approve a client transaction. Access to any such function should be excluded unless separately and lawfully authorized in writing.
Security review is one part of deciding whether an outsourced accounting workflow is suitable. Review the service scope and the professional-responsibility boundaries alongside the controls required by your firm.
Tell us which systems, records and controls your vendor review requires. We will distinguish what can be confirmed now from what must be documented for the proposed engagement.
Share the requirements that apply to the proposed workflow so the scope and open questions can be addressed before access is granted.
