The useful security questions for an offshore provider are not "Are you secure?" They are questions whose answers can be checked. How is each person's access to client systems granted, limited and removed? Which devices touch client data, and how are they controlled? What happens on a staff member's last day? Who is told, and how fast, if something goes wrong? Which independent report or certificate covers these controls, and for what period? A provider that answers with specifics and evidence is easier to rely on than one that answers with assurances.
This list is written from the provider's side. These are the questions we would expect an accounting firm to ask us, grouped so they can be used as a due-diligence checklist.
1. Independent assurance
Ask first what independent evidence exists, then read it rather than relying on the label.
- SOC 2 report. SOC 2 is one of the AICPA's SOC reports, issued by CPA firms on a service organisation's controls relevant to security, availability, processing integrity, confidentiality or privacy. Reports are issued as Type 1 or Type 2. Ask for the report itself, and check which type it is, which of the five categories it covers, the date or period it covers, and what exceptions the auditor reported.
- ISO/IEC 27001 certificate. This certifies an information security management system. The current edition is ISO/IEC 27001:2022. Ask for the certificate, the edition it refers to, the certification body, the scope and the expiry date. A certificate whose scope excludes the team or location that will do your work does not cover your work.
- No formal report. A provider may have neither. That is not disqualifying in itself. It means the questions below need fuller answers, and you may want the right to review the controls yourself.
2. Access to client systems
- How does each staff member access a client's ledger? Through an accountant invitation in the client's software, a firm-level console, or shared credentials? Shared credentials should be a firm "no".
- Is multi-factor authentication enforced on every account used for client work?
- Is access granted per client and per person, and only to the clients each person works on?
- Who approves access, and is there a record of who had access to which client, and when?
- How quickly is access removed when someone moves off a client or leaves? Ask for the actual procedure, not the policy statement.
- Does any staff member have access to client bank accounts or payment approval? For bookkeeping work, the answer should normally be read-only access at most.
3. Devices and networks
- Is client work done only on company-managed devices, or are personal devices allowed?
- Are devices encrypted, patched, and protected by endpoint security that the provider manages centrally?
- Can client data be downloaded, printed, copied to USB storage, or sent to personal email? What prevents it?
- Is work done in an office, at home, or both? What applies to home working: secure network, screen privacy, no shared devices?
- Is client work done in the client's cloud systems, or is data moved into the provider's own storage? If the latter, where is it stored, and who can reach it?
4. People
- What background checks are done before hiring?
- Does every staff member sign an individual confidentiality agreement, not just the company?
- What security and confidentiality training is given, and how often?
- What happens on the last day: access removal, device return, a reminder of continuing confidentiality?
- Is work subcontracted to anyone else, including freelancers or other firms? If so, under what terms?
5. Incidents
- How does the provider define a security incident involving client data?
- How fast will it tell you, and who will it tell?
- Has it had any incidents affecting client data in the last few years, and what changed afterwards?
- Who on the provider's side is responsible for security, by name?
6. Contract and law
- Confidentiality and data protection clauses in the agreement, covering staff, subcontractors, data return and deletion at the end of the engagement.
- Non-solicitation of your clients and staff.
- Insurance. Does the provider carry professional indemnity or cyber insurance, and on what terms?
- Data protection law on your side. UK and EU firms sending personal data to India must meet the international transfer rules of the UK GDPR or EU GDPR. US tax practices need the taxpayer's consent under section 7216 of the Internal Revenue Code before tax return information is disclosed to a preparer outside the United States.
- Data protection law on the provider's side. India's Digital Personal Data Protection Act, 2023 contains an exemption, in section 17(1)(d), where personal data of people outside India is processed by a person based in India under a contract with a person outside India. Where it applies, Chapter II of the Act, except sections 8(1) and 8(5), Chapter III and section 16 do not apply. Section 8(5) requires reasonable security safeguards to prevent a personal data breach. Sections 8 and 17 come into force eighteen months after 13 November 2025. The Digital Personal Data Protection Rules, 2025 were notified in November 2025, with an eighteen-month period for phased compliance. Ask the provider how it meets, or is preparing to meet, the safeguards requirement.
How to use the answers
- Ask for evidence, not adjectives. A screenshot of the access log, the procedure for removing access, the SOC 2 report or the ISO certificate.
- Weight the answers by your data. Payroll and personal tax data deserve stricter answers than a business's vendor list.
- Start with one file. Grant access to one client, review how it is used, and expand from there. A small pilot shows how the controls work in practice.
- Review annually. Staff, devices and certifications change. Ask the questions again each year.
Where this fits
Security is one part of onboarding an offshore provider. The rest, including access, conventions, prior-period records and client consents, is covered in what your offshore bookkeeper needs from you before day one. How the provider is presented to your clients is covered in white-label or named.
If you are assessing an offshore provider, Wissen Solutions can take you through how it handles each of these points, through our QuickBooks Online and offshore accounting services.
Sources (checked 26 October 2026)
- AICPA: System and Organization Controls, SOC suite of services: SOC 2 categories, SOC services provided by CPAs
- CPA Canada: SOC 2 guide: type 1 and type 2 reports
- Standards Council of Canada: ISO/IEC 27001:2022: current edition
- India Code: Digital Personal Data Protection Act, 2023: sections 8(5) and 17(1)(d), commencement notes to section 1
- PIB: Digital Personal Data Protection Rules, 2025 notified (November 2025): eighteen-month phased compliance
- ICO: A brief guide to international transfers
- IRS: Revenue Procedure 2013-14: section 7216 consent before disclosure to a preparer outside the United States