Short answer: before you sign with an offshore accounting provider, find out who will actually do the work and how it is reviewed, whether they will sign a UK GDPR Article 28 contract and a valid transfer mechanism, how they handle HMRC access, what your AML supervisor and PI insurer need to know, and what it costs to leave. A provider worth using answers all ten questions below in writing, without needing to be chased.
Most practices pick an offshore provider on price and a good first call. The problems show up three months later: a different person on every file, a contract that says nothing about deleting your data, or an insurer who was never told. None of those are hard to check. They just aren’t the questions a sales call tends to cover.
We get asked these questions by UK practices every week, and we think every provider, including us, should be held to them. If you haven’t yet decided what to outsource, start with what to hand over first. If you are still weighing offshore against a UK provider, see in-house vs UK outsourcing vs offshore.
Do your own homework first
Two things sit with your practice whichever provider you choose.
Your engagement letters and privacy notice. Client confidentiality is your duty under the ICAEW and ACCA codes, and it doesn’t pass to the provider. Check that your engagement letter allows work to be subcontracted, including outside the UK, and that your privacy notice lists subcontractors among the people who receive client data. Clients don’t need the provider’s name. They need to have agreed to the arrangement.
Your own data map. List what the provider will see: bank statements, payroll records, director details, National Insurance numbers. That list decides how strong the contract and security answers need to be.
The 10 questions
Who exactly will work on our files, and what are their qualifications?
Ask for the names, roles and qualifications of the people who will do your work, not the firm’s headcount. Then ask whether they will be the same people next month. A named team learns your clients. A rotating pool relearns them on every file, and that cost lands on your reviewers. We set out the difference in dedicated team vs ticketing.
Will you work in our software, with your own logins?
The answer you want is yes on both. Work done inside your Xero, QuickBooks, Sage, IRIS or BrightPay stays in your audit trail, and named users with multi-factor authentication mean every entry has a person attached and access can be removed in minutes. Be wary of a provider who wants client data exported to their own systems, or who asks to share one login across a team.
Will you sign a UK GDPR Article 28 contract, and who are your sub-processors?
Your practice is the controller and the provider is your processor. UK GDPR requires a written contract covering instructions, confidentiality, security, deletion at the end and audit rights. It also says a processor must not bring in a sub-processor without your prior written authorisation (ICO: what needs to be included in the contract). Ask for their draft agreement before the second call. If they have to go away and write one, they haven’t done this before.
What transfer mechanism covers our data?
Personal data accessed from outside the UK is a restricted transfer. India is not on the UK’s adequacy list, so the arrangement needs an appropriate safeguard, usually the ICO’s International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with a transfer risk assessment on file (ICO: international transfers). A provider should name the mechanism without having to look it up.
How is work reviewed before it reaches us?
Ask who reviews each file, at what level, and what a review leaves behind. A second qualified person checking the working papers is very different from the preparer checking their own output. Ask to see a sample review checklist. Your own review stays, at least in the early months, but a provider’s first-level review decides how much of your reviewer’s time the arrangement saves.
How do you handle HMRC access?
The right answer is that they never ask for your HMRC sign-in details. HMRC prohibits sharing them for any purpose (GOV.UK: use of HMRC sign-in details). The common split is that the provider prepares the return in your software and your practice reviews and files it. Where a provider does submit, it should be on your written instruction and by a route that doesn’t involve your credentials.
How will this fit our anti-money laundering procedures?
ICAEW’s guidance is direct: all the money laundering responsibilities for subcontracted work remain with your firm. It recommends making the subcontractor contractually bound to your procedures, giving them AML training and including them in your staff screening (ICAEW: using a subcontractor). Ask the provider how they report a suspicion to your MLRO. If they look puzzled, that is your answer.
What does our PI insurer need to know?
The same ICAEW helpsheet notes that for the anti-subrogation clause of your professional indemnity policy to extend to a subcontractor, their name and status have to be given to your insurer. Tell your broker before work starts, not at renewal. Some insurers add conditions for offshore work, and it is far better to know those up front.
What is the full cost, and what is the notice period?
The hourly rate is the least interesting number. Ask about onboarding fees, minimum hours or minimum terms, whether complex work is charged at a higher rate, how hours are recorded, and how much notice either side has to give. Ask for a timesheet sample. A twelve-month minimum term makes sense for the provider. It rarely makes sense for a practice that is still testing the arrangement. For typical numbers, see what accounting outsourcing costs in the UK.
What happens to our data and working papers when we leave?
Article 28 requires the contract to cover deleting or returning personal data at the end. Ask how that is done, how quickly, and how you get confirmation in writing. Because the work lives in your software, leaving should mean removing a few users rather than recovering files. If leaving would mean a data migration, think again before you start.
Good answers and red flags
| Question | Good answer | Red flag |
|---|---|---|
| Who does the work | Named people, qualifications stated, the same team each month | “A pool of experienced accountants” |
| Software access | Your software, named users, multi-factor authentication | A shared login or an export to their systems |
| Data contract | Article 28 agreement sent before you ask | “We’re fully GDPR compliant” with nothing in writing |
| Transfers | Names the IDTA or the UK Addendum | “India has adequacy” (it doesn’t) |
| Review | A second qualified reviewer, with a checklist you can see | The preparer checks their own work |
| HMRC | Never asks for your sign-in details | Asks for your Government Gateway login |
| Exit | Short notice, written confirmation of deletion | Long minimum term, data held in their systems |
References tell you a provider has happy clients. They don’t tell you how the provider handles your clients. Two or three weeks of real work on simple, complete files will show you turnaround, review quality and how many questions come back. Our first-month checklist sets out how to run it and what to measure.
Three mistakes practices make when choosing
Choosing on the hourly rate. A provider charging £2 an hour less who needs twice the review time costs you more. The hours your senior reviewer spends correcting work are the most expensive hours in the arrangement.
Treating the contract as a formality. The data agreement is where you find out whether the provider has thought about sub-processors, breaches and exit. A thin contract usually reflects thin processes.
Forgetting the people outside the deal. Your MLRO, your PI broker and whoever maintains your engagement letters all need to know before the first file moves. Bringing them in afterwards is much harder.
How EarthOne answers these questions
Qualified Indian Chartered Accountants work inside your own software from their own named logins. A second CA reviews every file before it comes back to you, and weekly timesheets show who did what. We sign a UK GDPR Data Processing Agreement before the first file moves, and nothing goes to HMRC without your instruction: we submit on your instruction, or hand the return back for you to review and file. Ad hoc work is £10.50 to £16.50 an hour, or a dedicated bookkeeper or accountant from £750 a month, with no onboarding fee and one month’s notice. See offshore accounting services for UK firms or published pricing.
Put these ten questions to us
Send us the work you want to outsource, your software and roughly how many clients. We reply within one business day with written answers, our draft Data Processing Agreement and the cost.
Send an enquiry
