This accounting outsourcing RFP checklist gives you 40 questions to put to any provider before you sign, grouped into security, people, process, software, pricing and references. Score each answer, insist on evidence rather than assurances, and drop any provider that cannot show you a named person, a written security plan and a client you can call.
Why use a checklist instead of a sales call?
Finance and accounting outsourcing is a $76.5 billion market growing at 9.3% a year (Grand View Research, 2026), and most of the providers in it sound the same on a call. Two well-known US bookkeeping providers shut down or stranded thousands of clients between December 2024 and February 2026 (RadCity and indinero, 2026). Neither event was visible from a sales deck.
A written checklist forces the answers into a form you can compare and keep. It also changes the conversation. Providers who do the work well are glad to show the close checklist and the security plan; providers who do not will offer a call instead.
Score each item 0 (no evidence), 1 (partial) or 2 (evidence provided). Weight security and people at double. Any 0 in the security section is a fail regardless of the total.
What should you ask about security and compliance?
- Written information security plan. Ask for the document, not a summary. In the US the FTC Safeguards Rule requires one for anyone handling tax data (FTC, 2026), and IRS Publication 4557 gives the checklist (IRS, 2026).
- Multi-factor authentication. Is it enforced on every system the team uses, including email and your accounting software, with no exceptions for senior staff?
- Access control. How is access granted, by whom, at what permission level, and how quickly is it removed when a person leaves the engagement? Ask for the joiner and leaver procedure.
- Data location and transfer. Where is your data stored and processed, and under what agreement? UK clients need international transfer safeguards under UK GDPR (ICO, 2026); US firms sending tax data abroad need section 7216 consent (26 CFR 301.7216-3).
- Device and download policy. Are staff on managed devices, and is downloading, printing or local storage of client data prevented rather than discouraged?
- Background checks and NDAs. Are all staff background-checked, and does each sign a confidentiality agreement specific to your account?
- Incident response. What is the notification time to you if there is a breach, who is the contact, and when was the plan last tested?
- Certifications and audits. Which are held, and can you see the report? Score the evidence, not the logo.
What should you ask about the people?
- Named accountant. Who, by name, will do your work, and can you interview them before signing?
- Backup and team lead. Who covers leave and peaks, and who reviews the named accountant’s work? Pooled or rotating staff are the most common cause of quality drift.
- Qualifications and experience. What accounting training does the named accountant have, and how many years on your software and in your industry?
- Working hours overlap. Which of your business hours will the team be online, and how do you reach them: chat, email or phone?
- Staff turnover. What was the provider’s annual staff turnover last year, and what happens to your engagement if your accountant leaves?
- Training on your business. How is your chart of accounts, your approvals and your reporting taught to a new team member, and is it written down?
- Language and communication. Will the people you deal with write and speak clearly enough to explain a reconciliation exception to your CPA or your board?
What should you ask about the process?
- Onboarding plan. What happens in the first 30 days, in what order, and who owns each step?
- Month-end close checklist. Ask to see it. A provider without a written close checklist will close inconsistently.
- Reconciliation coverage. Which accounts are reconciled monthly, to what evidence, and where is the sign-off recorded?
- Second review. Is every close reviewed by a second person before reports go out, and is that review logged? Ask how many errors it caught last quarter.
- Reporting cadence and format. Which reports arrive, on which business day, in which format, and can you see a sample pack from a comparable client?
- Exception handling. How are uncategorized transactions, missing documents and disputed items raised to you, and what is the turnaround on your answers?
- Money movement. Confirm in writing that the provider never initiates or releases payments, and that you approve every one.
- Catch-up and cleanup. If your books are behind, how is the backlog scoped, priced and sequenced relative to ongoing work?
What should you ask about software and data?
- Works in your stack. Does the provider work inside your QuickBooks Online, Xero, Sage, Bill.com or practice management file, or move you onto its own platform?
- Data ownership. Confirm that the file, the documents and the reconciliations are yours, and that admin rights stay with you.
- Exit and data return. If you leave, what is returned, in what format, in how many days, and at what cost?
- Integrations. Which payment processors, payroll systems and industry tools has the team reconciled before? Ask for examples close to your own.
- Software changes. How does the provider handle a migration, and who pays for it?
What should you ask about pricing and the contract?
- Pricing basis. Per month, per transaction, per dedicated person or per project? Ask for the same scope priced the same way by every bidder.
- What is included. Which deliverables, how many accounts and entities, and how much transaction volume before the price changes?
- Onboarding and catch-up fees. Are they separate, and are they fixed or estimated?
- Price change triggers. What moves the price, by how much, and with how much notice? Market benchmarks help here: US outsourced bookkeeping runs from about $150 to $1,600 a month depending on service level (indinero, 2026).
- Contract term and notice. Month-to-month, annual or multi-year, and what notice ends it?
- Guarantees and remedies. What happens if a deadline is missed or an error costs you money? Vague answers here are common; written ones are rare and valuable.
What should you ask about references and stability?
- References in your industry. Two, at least one on your software, and you choose which questions to ask.
- Client tenure. What is the average client relationship length, and how many clients left last year and why?
- Ownership and funding. Who owns the company, how long has it operated, and is it dependent on outside funding that could end? Recent provider shutdowns make this a fair question (RadCity and indinero, 2026).
- Insurance. Does the provider carry professional indemnity or errors-and-omissions cover, and can you see the certificate?
- Professional-standards awareness. Does the provider understand the notice rules your own profession imposes, such as the AICPA third-party service provider interpretation for CPA firms (AICPA, ET 1.150.040)?
- A mistake they made. Ask the provider, and then the references, to describe a real error and how it was handled. The answer tells you more than any certificate.
How do you run the RFP process?
Shortlist three or four providers, not ten. Send each the same scope sheet: entities, bank and card accounts, monthly transaction volume, software, payroll and sales-tax obligations, deliverables and deadlines. Attach the 40 questions and ask for written answers and the supporting documents within ten business days.
Have two people score the answers independently before comparing notes, because a persuasive cover letter moves a single scorer more than it should. Where a provider answers a question with an offer of a call, score it 1 at most until the document arrives.
Then call the references yourself, using the questions in item 35, and run a paid pilot month with the top scorer on one entity or one process before signing for the full scope. A pilot exposes onboarding quality, response times and the named accountant’s real availability in a way no written answer can.
Keep the scored checklist. Twelve months later it becomes your renewal review, and the gap between what was promised and what was delivered is the strongest position you can take into that conversation.
How do you score the answers?
| Section | Items | Weight | Maximum | Fail condition |
|---|---|---|---|---|
| Security and compliance | 1 to 8 | 2 | 32 | Any item scored 0 |
| People | 9 to 15 | 2 | 28 | No named accountant offered |
| Process | 16 to 23 | 1 | 16 | No written close checklist |
| Software and data | 24 to 28 | 1 | 10 | Data not returnable on exit |
| Pricing and contract | 29 to 34 | 1 | 12 | Scope not priced like for like |
| References and stability | 35 to 40 | 1 | 12 | Fewer than two references |
| Total | 40 items | 110 | Any fail condition |
A provider scoring under 80 with no fails is worth a second conversation. A provider scoring over 90 with a fail is not. Fails exist because a strong sales process can lift the total while a single missing control undoes everything else.
How do we answer this checklist ourselves?
We publish our controls on the security page and the country-by-country rules we work under on the compliance page, so items 1 to 8 can be scored from documents rather than a call. Our model is a named accountant plus backup plus team lead, working in your own software, on month-to-month terms, and the options are set out on the engagement models page. We have been owner-operated since 2020 with no venture funding, which answers item 37 directly.
Some items we will always answer with a document and some with a conversation. Pricing depends on volume and scope, so we send a custom quote within 1 business day. For item 40, ask us on the first call.
Sources
- FTC, Safeguards Rule: what your business needs to know: ftc.gov
- IRS, Publication 4557, Safeguarding taxpayer data: irs.gov
- AICPA Code of Professional Conduct: pub.aicpa.org
- ICO, International transfers: ico.org.uk
- Cornell LII, 26 CFR 301.7216-3: law.cornell.edu
- indinero, How much does outsourced bookkeeping cost in 2026?: indinero.com
- Grand View Research, Finance and accounting BPO market report: grandviewresearch.com
Frequently asked questions
What should an accounting outsourcing RFP include?
Six sections: security and compliance, the people who will do the work, the process and reporting cadence, software and data ownership, pricing and contract terms, and references and stability. Ask for evidence under each, such as a written information security plan, named staff profiles, a sample month-end pack and two client references in your industry. The 40 questions in this checklist cover all six and can be pasted into an RFP document as they stand.
How do I compare accounting outsourcing quotes fairly?
Normalize the scope first. List the accounts, transaction volume, entities, software and deliverables, and ask each provider to price exactly that. Then compare the monthly total including onboarding, catch-up, software and any per-transaction fees, and check what triggers a price change. US outsourced bookkeeping ranges from about $150 to $1,600 a month depending on service level (indinero, 2026), so a quote outside that band needs a reason. Our own pricing depends on volume and scope, so we send a custom quote within 1 business day.
What security questions should I ask an outsourced accountant?
Ask for the written information security plan, whether multi-factor authentication is enforced on every system, how access is granted and removed, whether staff are background-checked and under NDA, where data is stored and processed, and how an incident would be reported to you. In the US the FTC Safeguards Rule sets that standard for firms handling tax data (FTC, 2026). Ask to see the documents, not a summary of them.
Should I ask an outsourcing provider for certifications?
Ask which certifications and audits they hold and ask to see the report or certificate, not the logo. SOC 2 and ISO 27001 are the common ones for data handling, and HIPAA applies to healthcare data. A provider without a certification can still be safe if its written controls are strong and verifiable, and a provider with a logo on its website can still fail to enforce them. Weight the evidence, not the badge.
How many references should I check before choosing a provider?
Two is the minimum, and at least one should be in your industry and on your software. Ask each reference how long they have been a client, who their named accountant is and whether that person has changed, how the provider handled a mistake, and whether reports arrive on the agreed date. A provider that cannot produce two willing references after several years in business is telling you something.
Sources
- FTC, Safeguards Rule: what your business needs to know
- IRS, Publication 4557, Safeguarding taxpayer data
- AICPA Code of Professional Conduct, ET 1.150.040 (use of a third-party service provider)
- ICO, International transfers (UK GDPR guidance)
- Cornell LII, 26 CFR 301.7216-3, disclosure or use permitted only with the taxpayer's consent
- indinero, How much does outsourced bookkeeping cost in 2026?
- Grand View Research, Finance and accounting BPO market report 2026 to 2033
