How CPA firms vet an offshore bookkeeper: a data-security checklist

Short answer: demand an NDA before any file changes hands, read-only bank feeds (never credentials that move money), 2FA everywhere, no subcontractors, and deletion-on-offboarding in writing. If a bookkeeper hesitates on any of these, walk away.

You're handing someone your clients' financial data. "Trust me" isn't a control. Here's the checklist I'd want a CPA firm to run on me — ask these seven questions before the first login is shared.

1. Will you sign an NDA before receiving files?

This is table stakes. A signed NDA and a short engagement letter should come before any file, login, or screen share. If someone asks for "just a quick look at the books first," that's the interview ending early.

2. What does your access model look like?

The right answer: read-only bank and credit-card feeds inside your QuickBooks, with the minimum permissions needed for the work. Nobody doing reconciliations needs the ability to move money. Ask directly: "Do you ever hold credentials that can move funds?" The answer must be no.

3. Who holds the credentials?

Credentials should live in a password manager — never in spreadsheets, chat threads, or email. Ask which one. "A password manager" is a fine answer; a brand name you recognize is better. Either way, credentials you revoke on offboarding, not credentials they keep.

4. What are the device and network habits?

Modest, checkable things beat vague promises: two-factor authentication on every account, an encrypted laptop, no work over public Wi-Fi. Nobody needs to claim ISO 27001 — but everybody should be able to describe their actual setup in two sentences.

5. Who actually touches the books?

The #1 offshore complaint isn't quality — it's communication. Ask: "Is the person on this call the person doing the work?" If the answer involves a rotating team or unnamed "associates," your accountability just evaporated. One dedicated person, named, reachable.

6. What happens on offboarding?

Every engagement ends eventually. The right bookkeeper has an answer ready: access revoked, files deleted from their side, confirmation in writing. If this question gets a blank stare, the security posture was never real.

7. Can I reach you — really?

Unreachability kills more offshore relationships than errors do. "Can't do a video call," slow replies, hidden contact info — all red flags. Ask for a response SLA in writing. (Mine: within 4 business hours, with overlap hours for US mornings.)

Red flags that end the conversation

Misrepresented capability. The most common offshoring failure: a "senior" who'd only ever prepared, never reviewed. Ask what they won't do — an honest "I don't sign returns" beats a vague "full accounting services."
The spam-rate pitch. Spam-rate pricing signals spam-rate diligence. A senior offshore seat runs a flat monthly retainer — below a US hire, above the noise.
No video call. If they won't show their face before touching your clients' data, neither should you.

Quick answers

What does "read-only bank access" mean?

The bookkeeper can see transactions to reconcile them, but cannot initiate transfers, payments, or withdrawals. Reconciliation needs visibility, not authority.

Should we share our QuickBooks login?

No — create a dedicated user for the bookkeeper with the minimum permissions the work requires. You can revoke it in one click when the engagement ends.

What if a bookkeeper won't sign an NDA?

Move on. Willingness to sign before seeing anything is the cheapest trust signal in this business.