Offshore Accounting Services and TPB Rules

Offshore accounting services let your practice delegate preparation while keeping responsibility for client permission, confidential information and the finished work. Obtain permission before disclosure, limit provider access and record your review before the registered agent signs off and lodges.

What Accounting Outsourcing is and How It Works

Accounting outsourcing means a registered practice gives defined tasks to a third party, including return preparation, bookkeeping, reconciliations or workpapers. Your practice remains responsible for the service it delivers to the client.

Bookkeeper outsourcing usually covers transaction records, bank reconciliations, payables and payroll processing. Financial accounting outsourcing covers year-end journals, workpapers and draft financial statements. Review both kinds of output before releasing it to the client or using it in an ATO lodgement.

Model	Where the file sits	Who prepares	Who reviews and lodges
Local outsourcer	In your controlled workspace or the provider’s agreed Australian workspace	The provider’s staff use their individual accounts	Your practice reviews the returned work. The registered agent signs off and lodges.
Offshore provider using its own systems	In the provider’s workspace, with agreed storage and backup locations	The provider’s staff prepare from the authorised file package	Your practice receives workpapers and reviews the draft. The registered agent signs off and lodges.
Dedicated offshore staff using your systems	In your workspace, with overseas remote access	Each authorised staff member signs in separately	Your supervisor reviews recorded changes. The registered agent signs off and lodges.

Remote viewing still gives someone access to client information. A file remaining on your server does not, by itself, resolve confidentiality or overseas disclosure obligations.

Use this order for the first outsourced job:

1. Define the task, source records and output. Name the practitioner who will review it and reserve time for that review.
2. Check the provider and agree the access, confidentiality and file-return terms. Resolve unclear storage locations before sharing anything.
3. Explain the arrangement to each affected client and record permission. A client without permission stays outside the outsourced queue.
4. Give individual access to the minimum records needed. Return unnecessary TFNs to the restricted file before sending the work package.
5. Review the output and resolve queries. Keep the reviewer’s approval with the final version, then lodge through the registered practice.

Define the Client’s Work Package

The following packages are illustrative instructions for an outsourced preparer. They do not describe any provider’s experience or establish which tax treatment applies.

For a small-business client, delegate invoice entry, payables matching and bank or card reconciliations against the agreed ledger. Obtain permission to disclose the records and authority for access to the client’s accounting software. Your reviewer checks unmatched transactions and proposed GST treatment before releasing reports or preparing the BAS.

A restaurant package needs daily takings, merchant statements and delivery-platform settlements. Include supplier invoices, food-stock records and approved payroll inputs. Require the preparer to reconcile each source to the ledger, showing commissions and timing differences separately. Unexplained cash shortfalls or settlement gaps go back to your practice for investigation.

For a retail client, hand over point-of-sale takings and card settlements with stock records, supplier credits and returns. Reconcile each sales channel to deposits. Explain stock movements and differences between recorded returns and refunds before your reviewer checks GST and financial-reporting output.

Management accounting outsourcing produces monthly budgets, cash-flow forecasts and variance packs. Agree the source ledger and assumptions for sales, margins and collection timing. Your reviewer investigates unusual movements and separates actual figures from forecasts. The principal approves the interpretation before advice reaches the client. Tax-return preparation remains a separate task.

For a real estate agency, keep operating books separate from client trust-money ledgers. Identify the state or territory rules before assigning trust work. Give the provider only the permitted ledger access and reserve payment authority for authorised people. The responsible practitioner reviews reconciliations, and the agency’s responsible licensee retains its own duties.

For example, Western Australia’s trust-account guidance applies to money held for others in real estate transactions. Do not treat ordinary operating-account bookkeeping as a substitute for the jurisdiction’s trust records and reconciliations.

Your Confidentiality Duty Under the TPB Code

Section 30-10(6) of the Tax Agent Services Act 2009 requires client permission before you disclose information about their affairs to a third party. A legal duty to disclose is the exception. The TPB’s confidentiality guidance explains that obligation.

An external provider is a third party. Offshore workers employed through another entity remain part of that external arrangement, even when they use your workspace. Direct employees within your practice’s legal entity are a different arrangement. Identify the employer and contracting entity before deciding which disclosures occur.

Get permission before the provider sees the file. Explain the work being delegated, the recipient and country, the information shared and the client’s choice to refuse. Take reasonable steps to keep the provider’s handling confidential.

The TPB’s outsourcing guidance recommends a positive authorisation step. General consent can be acceptable in particular circumstances, but buried wording and client silence give you weak evidence of an informed choice.

A clearer record is a notice the client reads, followed by an explicit acceptance linked to that version. Keep the affected entities, authorised person and time of acceptance with the file. If the country or provider changes outside that permission, obtain permission for the changed disclosure before sending further work.

Use the Code of Professional Conduct guide for obligations beyond this outsourcing arrangement.

Tfns, the Privacy Act and Sending Data Overseas

Client permission does not authorise every use of a Tax File Number (TFN). The Privacy (Tax File Number) Rule 2015 limits collection, use and disclosure of individuals’ TFN information to permitted purposes. It also requires reasonable safeguards against misuse and unauthorised access.

The OAIC’s TFN guidance explains these limits. The Rule concerns individuals’ TFNs, including those appearing in payroll or member records. Separate taxation-law restrictions also protect entity TFNs.

Make TFN access a task-specific decision. A preparer reconciling a bank account usually needs transactions, not the client’s TFN. Mask it in that package. If tax-return preparation requires TFN information, establish the permitted purpose and recipient access before sharing it.

For a practice covered by the Australian Privacy Principles (APPs), APP 8 generally requires reasonable steps before disclosure to an overseas recipient. Those steps address the recipient’s compliance with the APPs. Section 16C can make the practice accountable for the overseas recipient’s handling. See the OAIC’s cross-border disclosure explanation.

A transfer inside the same legal entity differs from disclosure to an overseas contractor. Limited arrangements where information remains under the practice’s effective control can also differ. Remote access alone does not establish that exception. Assess who can handle the information and what your agreement actually permits.

The OAIC’s small-business guidance defines a small business as having annual turnover of $3 million or less. Some are still covered by the APPs, including AML/CTF reporting entities. A TFN recipient’s obligations do not disappear because most APPs are inapplicable.

Use a controlled portal with individual permissions for the authorised records. Keep TFNs out of email attachments and unnecessary workpapers. Restrict downloading where possible, review access records and remove access when the job or relationship ends. Agree how retained copies and backups will be handled.

Supervision and Sign-Off of Outsourced Returns

Your registered practice remains responsible for the competence of tax services provided on its behalf. The TPB’s supervision guidance applies to remote arrangements as well as work in your office. Qualifications, experience and the task’s complexity affect the supervision needed.

Use a review routine with an assigned reviewer for every return. A sensible practice policy is full review for new provider staff, unfamiliar entities and complex tax positions. Adjust review depth only after documented evidence of competence. This is a review policy you set, not a universal TPB sampling percentage.

For each job, the reviewer checks source records against the draft, tests unusual amounts and resolves the preparer’s questions. Record review notes, corrections and the final approval against the version being lodged. An unresolved treatment or missing record stops release until the responsible practitioner decides how to proceed.

Give Each Worker Their Own Access

ATO Online services for agents is for registered agents and authorised staff. Preparation in your accounting software does not automatically require access to that service. Keep offshore preparers out of ATO systems when the assigned job can be completed without it.

Where access is needed, each person needs their own Digital ID (such as myID) and the appropriate Relationship Authorisation Manager (RAM) authorisation. Grant only the necessary service permissions. RAM’s authorisation instructions distinguish Standard and Basic users. Basic identity strength is accepted by limited services, and an agency can require further identity evidence.

An offshore location does not establish that a person can access every ATO service. Resolve their accepted identity strength and authorisation before allocating a job needing that access. Remove the authorisation and relevant software permissions when the person leaves or their task ends.

Never share the principal’s login or a pooled staff login. Individual credentials let your practice trace changes to the person who made them.

A virtual assistant can chase documents or arrange appointments with access limited to that job. Bookkeeping and payroll work need suitable competence and supervision. Give the assistant a clear escalation route for tax questions or unusual records. The principal reviews advice and retains the practice’s responsibility.

Telling Clients and Recording Consent in the Engagement Letter

Tell clients which outsourced services you use before their information reaches the provider. Identify the provider, country and information shared, then describe the safeguards that apply. Put the disclosure in the engagement letter or a separate notice and ask for explicit permission.

The following fictional example assumes a provider in the Philippines and a defined return-preparation package. Replace those facts with your actual arrangement before requesting consent.

We use an external provider in the Philippines to prepare draft tax returns and supporting workpapers. With your permission, we share the financial records and tax information needed for that work. Authorised provider staff use individual accounts with restricted access. They must keep your information confidential and cannot use it for other purposes. Our practice reviews the work and remains responsible for the tax service. Our registered agent signs off and lodges your return. You can refuse this disclosure. If you refuse, we keep your work onshore and discuss any effect on delivery with you.

Add the actual provider’s identity and storage locations to the notice. Explain any permitted subcontracting and TFN handling. Record a separate positive answer, such as an acceptance of the identified notice, rather than assuming the engagement signature resolves an unexplained disclosure.

For clients engaged before outsourcing began, send the notice and request permission before the next outsourced job. Flag refusals in the client record and block those files from the provider’s queue. Keep the work onshore through your agreed alternative.

The engagement letter guide explains the rest of the engagement. Use a separate client consent form when that makes the disclosure and answer easier to record.

Due Diligence on an Offshore Accounting Provider

Compare accounting outsourcing companies on how they handle your actual work package. The same questions apply to a large provider or a smaller accounting outsourcing firm. A provider’s country affects the disclosure you explain to clients, but does not prove competence or security.

Ask each prospective provider for written answers to these questions:

• Which legal entity contracts with you, and where do its staff work?
• Where is client information stored, backed up or viewed remotely?
• Who has access to the file, and can the provider use subcontractors?
• What device restrictions, encryption and network protections apply?
• How are staff confidentiality agreements enforced and access removed?
• Who reviews the preparation, corrects errors and escalates uncertain treatment?
• How quickly must the provider notify you of a suspected breach?
• Can you inspect access records and obtain your workpapers when the arrangement ends?

For finance and accounting outsourcing companies in the Philippines or India, compare the same task and output. Request evidence of Australian tax or bookkeeping competence for the assigned work. Record individual staff access and the route for questions to your reviewer. Agree error correction and file return before allocating client jobs.

Put confidentiality and permitted TFN handling into the contract. Include subcontractor restrictions, an agreed breach-notice period and audit rights. Specify the file formats you receive and how the provider returns or destroys data when the arrangement ends. Reconcile destruction terms with any lawful retention requirement.

APES GN 30 Outsourced Services guides members in public practice on outsourced arrangements. It covers provider competence, risk and retained responsibility. It also points members to APES 305’s requirements to document and communicate the provider details, location and nature of the outsourced services.

For outsourced financial-report preparation, state the applicable reporting framework and deliverables in the work instructions. Identify source-record access and who decides accounting policies or estimates. Require journals and draft statements to trace to workpapers. Your practice approves the final reporting treatment before release.

A demand for your ATO credentials is a reason to stop the proposed handover. Resolve requests for emailed client files through the agreed controlled exchange. If the provider cannot identify where data sits, withhold access until it supplies that information.

A provider breach can also create notification obligations for your practice. Assess your own exposure under the OAIC’s notifiable breach guidance. Activate your data breach response plan without waiting for the provider to declare that it has notified everyone.

Compare total outsourcing cost using the same scope. Allow for review time, software access, rework and handover costs alongside the provider’s fee. Lower preparation cost saves money only if the work returns in a form your reviewer can use.

Outsourcing SMSF Accounting Work

You can outsource SMSF bookkeeping, reconciliations and annual-account preparation within a defined engagement. Keep trustee decisions, regulated financial advice and the independent audit separate from the preparation package. ASIC’s SMSF guidance explains that trustees remain responsible even when they use professional advisers.

Compare providers on SMSF staff expertise and their access to fund and member records. Require complete workpapers, an error-correction process and a clear handover to your reviewer. Your registered practice reviews and signs off its accounting and tax work. An appropriately authorised adviser handles regulated advice, and the independent auditor performs the audit.

Apply client permission and offshore disclosure checks to the fund’s engagement and the member information being shared. Restrict individual TFN access to the permitted task. A provider preparing fund accounts does not need unrestricted access to every member’s personal tax file.

Before releasing the first fund package, confirm recorded permission and individual access. After preparation, expect reconciled balances, traceable workpapers and resolved review queries. If any are missing, return the job for correction before sign-off or lodgement.