Keeping client data safe when you offshore accounting work 

Offshoring is safe when the offshore accountant works inside your software through logins you issue and can remove, sees only the clients they work on, works under confidentiality terms, and never moves client data to their own systems. The firm keeps every control it already has. Review and sign-off stay with the partners.

What is the question every partner asks first?

Before cost, before skill, a partner asks one thing: if someone in another country can see my clients' files, what happens when something goes wrong? It is the right question, and it deserves a plain answer.

Client data safety in offshoring means the set of controls that limit who can see client information, where it is stored and how quickly access can be removed.

The honest answer comes in two parts. First, risk does not depend on the country. It depends on how the arrangement is built. Second, a well-built arrangement can be as controlled as a hire in your own office, and in some ways more so, because every action sits in a system log. A badly built one is risky wherever the person sits.

Where does the data live, and where does it not?

The central design choice is where client data is stored. In the model we recommend, it stays in the firm's own systems. The offshore accountant connects to those systems with a login you issue, and the files never move.

In the other model, the provider receives files, works on them in its own systems and sends results back. That creates a second copy of client data, in a place you do not control. You then have to ask who can see it, how long it is kept and how it is deleted.

The first model is easier to defend. Fewer copies mean fewer places for something to go wrong. It also means that ending the arrangement is simply a matter of switching off a login.

Which controls matter most?

The Office of the Australian Information Commissioner describes the reasonable steps under APP 11 as technical and organisational measures applied in layers, so that no single control is a point of failure. The five controls below follow the same thinking.

Named logins you control

Each person gets their own login in each system, and nobody shares a password. You create the login, you can see what it does, and you can switch it off. Where your software offers extra sign-in checks, turn them on.

Least access

Give access only to the clients and tools the work needs. Someone preparing bank reconciliations for twelve clients has no reason to see every client on your books. Review access every quarter and remove whatever is no longer needed.

Screen and device rules

Put rules for the device and the workplace in writing. For example: no client files saved to the local device, no screenshots shared outside the firm, no personal email for client work, a locked screen when away from the desk, and a private place to work. Ask the provider how it checks that these rules are followed.

Confidentiality terms

The person signs written confidentiality terms before the first login goes live. The terms should cover client information both during the arrangement and after it ends. Have your own adviser read them, and ask who is actually bound by them - the person, the provider, or both.

Removal in minutes

Test that you can remove access. Know who can do it, where the switch is and how quickly it takes effect. Agree a written exit step for when the person leaves: logins off, devices checked and a note on file.

What should you tell your clients?

Many firms choose to tell clients plainly that part of the preparation work is done by a dedicated team member in another country, inside the firm's own systems, and that partners review all of it. Clients usually take a clear statement better than a later discovery.

What you must say depends on your engagement terms, your privacy notices and your professional obligations. Do not guess. Ask your own adviser, and update your engagement letter and privacy notice if they tell you to.

What are seven questions to ask any offshore provider?

1. Will the person work inside my systems, or will client data be copied to yours?
2. Who else at your end can see my client data?
3. What confidentiality terms does the person sign, and can I read them?
4. What rules apply to the person's device and workspace, and how do you check them?
5. How do you handle a mistake or a suspected breach, and how quickly will I hear about it?
6. What happens to my data and access when the person leaves or the arrangement ends?
7. What will you put in writing about all of the above?

A provider that answers in clear words, and agrees to put those answers in writing, is a better sign than one with a long list of badges. Treat vague replies with caution.

What does this guide not cover?

This guide describes practical controls. It is not legal advice, and it does not cover your professional obligations. Those stay with your firm.

On privacy, the Office of the Australian Information Commissioner publishes guidance on APP 8, which deals with cross-border disclosure, and APP 11, which deals with security. Under APP 8, an entity that discloses personal information to an overseas recipient must take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, and the entity can remain accountable for the recipient's acts. Whether your arrangement counts as a disclosure is a question of fact.

For your registration, quality management and confidentiality duties, check the current position with your professional body and your own adviser. Keep a written record of the controls you chose, and the reasons for each.

What does a short data policy for offshore staff contain?

Keep the rules to one or two pages so that everyone actually reads them. A short policy is far more likely to be followed than a long one. It should cover who may access which systems, what the person must not do, and what to do when something goes wrong.

• Which systems and which clients the person may access.
• No copying of client files to personal devices, personal email or personal cloud storage.
• Rules for the device and the workspace, including locked screens and a private space.
• What counts as a problem, such as a lost device or an email sent to the wrong person, and who to tell straight away.
• What happens at the end: logins off, devices checked, and confidentiality continuing.

Review the policy once a year, or whenever the work changes. Ask the person to confirm in writing that they have read it, and keep the signed copy on file with the confidentiality terms.

How do you check that the controls are working?

A control that nobody checks soon stops working. Choose a small number of regular checks and put them in the calendar. Each quarter, list every login the person holds and remove any that are not needed. Look through the activity log in your main system for unusual hours or unusual clients.

Ask the provider to confirm in writing, from time to time, that the device and workspace rules are being met. Run a short test of the removal step, so you know it works before you need it. Record each check, its date and the result.

Frequently asked questions

These are the questions practice owners ask most often about data safety.