How to Choose a CAS Provider: Questions to Ask

Client accounting services (CAS) means handing your bookkeeping, monthly close, payroll coordination, and financial reporting to an outside team that also advises you, rather than just entering data. The stakes are concrete. In GAO analysis of IRS data, returns done by paid preparers carried an estimated 60% error rate, versus 50% for self-prepared returns, and undercover refund mistakes ranged from $52 too little to $3,718 too much.

For Denver and Colorado business owners weighing an outsourced accounting team, this guide lays out a plain checklist of what to ask, and which answers are non-negotiable under federal law. WhippleWood has served closely held businesses from Littleton since 1981, and the questions below are the ones we would want a buyer to ask us.

What Questions Should You Ask Before Outsourcing Your Accounting?

Ask nine things before you outsource: what is in scope, the technology stack, how pricing is structured, who is assigned to your account, how the team handles security and SOC 2, the communication cadence, industry fit, the onboarding plan, and the exit terms. Each one maps to a real risk. A gap in any of them is where an outsourced relationship tends to fail.

Two of these carry federal legal weight rather than preference. Data security is mandated by the FTC Safeguards Rule, and payroll-tax liability never leaves you. Treat those two as pass or fail. The rest are judgment calls, where a strong firm answers directly and a weak one deflects.

“Typically, these clients remain legally responsible for paying the taxes due, even if the employer sent funds to the payroll service provider for required deposits or payments.” — Internal Revenue Service, on outsourcing payroll

What Is the Difference Between CAS and Traditional Accounting?

Traditional accounting is compliance-first record-keeping and tax filing. CAS is ongoing outsourced accounting plus advice, meaning a monthly close, dashboards, and a person who interprets the numbers. The labor market shows the shift. The U.S. Bureau of Labor Statistics projects bookkeeping, accounting, and auditing clerks to decline 6% from 2024 to 2034, at a median wage of $49,210. Higher-skill accountants and auditors are projected to grow 5%, at a median of $81,680.

What this means for you: a CAS team should sell analysis and guidance, not data entry that software already automates. If a candidate describes only transaction processing, you are buying legacy bookkeeping under a new name.

In-House Bookkeeper vs. CAS Provider vs. DIY: Which Fits?

Your complexity, your risk tolerance, and who owns compliance when something breaks decide the right model. This table compares the three common paths on the dimensions that decide the outcome.

Outsourcing shifts work but not all liability. Even with a CAS or payroll firm, the IRS pursues the employer if deposits are missed, so the security and payroll questions below apply to every row except pure DIY.

How to Choose a CAS Provider: The Nine-Point Checklist

Work through nine questions in order, starting with the two federal pass-or-fail items, security and payroll liability, then the seven judgment calls. Ask each one out loud and expect a specific answer, not a brochure.

1. What Is Included in the Service Scope?

Ask for the scope in writing: which entities, which accounts, monthly close timing, payroll, sales-and-use tax, 1099s, and what counts as out of bounds. A defined scope is what a later dispute gets measured against. Vague scope is the most common source of surprise fees and finger-pointing.

2. How Secure Is the Firm, and Does It Hold SOC 2 or ISO 27001?

A legitimate CAS firm must meet the FTC Safeguards Rule, whose core requirements have been fully enforceable since June 9, 2023. The Rule names an “accountant or other tax preparation service” as a covered financial institution, one of 13 enumerated examples under 16 CFR 314.2. That means specific, checkable controls.

“Implement multi-factor authentication for any individual accessing any information system,” and “protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest.” — FTC Safeguards Rule, 16 CFR 314.4(c)

Ask the firm to produce a Written Information Security Plan (WISP), confirm it has a designated Qualified Individual overseeing security, and ask whether it holds an independent SOC 2 or ISO 27001 report. IRS Publication 4557 requires preparers of any size to create and enact a WISP, so “we’re too small” is not a valid answer. The fullest written-plan rules exempt only firms holding data on fewer than 5,000 consumers, and most real firms exceed that.

3. Will You Use EFTPS Under My EIN for Payroll Deposits?

This is the payroll pass-or-fail question. Even when you outsource payroll, you remain legally responsible for federal employment taxes, including income tax withheld plus both shares of Social Security and Medicare, per IRS guidance. If a third party defaults, the IRS assesses the penalties and interest against your account.

The IRS recommends employers enroll in the Electronic Federal Tax Payment System (EFTPS) and register for their own PIN, so they can independently confirm that deposits are actually being made under their EIN. Ask a candidate directly: will you deposit under my EIN through EFTPS, and can I see the payment history myself? A firm that resists that transparency is a risk.

If the arrangement uses a Form 8655 reporting agent, know the limit. A reporting agent “assumes no liability” for your employment-tax duties, and it must give you a written statement reminding you that you stay ultimately responsible.

4. How Is Pricing Structured, and What’s Included?

Ask for the pricing model, not just a number: fixed monthly fee versus hourly, what triggers a change, and exactly which services the base fee covers. Transparent firms tie price to a defined scope so you can compare like for like. The aim is no surprise line items, with pricing as defined as the scope in question 1.

5. Who Will Be Assigned to My Account, and How Is Continuity Handled?

Ask who does the daily work, who reviews it, and what happens when that person is out. A named lead plus a backup and a reviewing CPA means no single point of failure. If the answer is one unnamed offshore contractor, coverage and quality both depend on one desk, a fragile setup for your monthly close.

6. How Does Offshore Staffing Change the Data Question?

Offshore staffing is legal, but it adds a consent step. If your tax return information will go to a preparer located outside the United States, Treasury rules require your prior written consent under Section 7216 before any data leaves the country. Ask whether the firm uses offshore or subcontracted labor, and how it obtains that consent.

The penalties are real. A preparer who knowingly or recklessly discloses return information without authorization commits a misdemeanor, punishable by a fine of up to $1,000 and up to one year in prison. A separate civil penalty adds $250 per disclosure, capped at $10,000 per year. Confirm how the firm handles Section 7216 consent before you send a single file.

7. Does the Firm Contractually Bind Its Own Vendors?

When you outsource, your data may flow to the firm’s own subcontractors and software vendors. The Safeguards Rule requires each firm to select service providers capable of maintaining safeguards, to require those safeguards by contract, and then to reassess them on a schedule. Ask whether the firm binds its vendors to the same security standard in writing, and how often it reassesses them.

8. What Is the Communication Cadence and Industry Fit?

Ask for the reporting rhythm, meaning a monthly close by a set date, a standing review call, and clear response-time expectations. Then ask for proof the firm knows your industry. A team that already serves auto dealerships, construction, nonprofits, or professional services will spot issues a generalist misses. Cadence and industry fit decide whether a firm becomes a partner or a vendor you chase for answers.

9. What Are the Onboarding and Exit Terms?

Ask how the first 30 to 90 days run, who migrates your data, and how the relationship ends. Exit terms decide whether you can leave cleanly: who owns the files, how records are returned, and what notice each side must give. A firm confident in its work will put fair exit terms in writing without friction.

How Long Should the Provider Evaluation Process Take?

Provider evaluation should scale with risk, not run on a fixed clock. Federal guidance treats due diligence as proportionate to the criticality of the outsourced work, and completed before you contract. The interagency guidance issued June 6, 2023 makes this explicit for regulated financial activities: rigor rises with risk.

Evaluation is also not a one-time event. The Safeguards Rule requires ongoing reassessment, including vulnerability testing at least every six months and after material changes. Expect a real vetting to take weeks for a straightforward engagement, and longer where payroll, multiple entities, or offshore staffing are involved.

Can You Ask for Client References Before Signing?

Yes, ask for references, but understand that a CPA firm cannot casually confirm who its clients are. Because unauthorized disclosure of return information is a misdemeanor under Section 7216, a firm needs a client’s consent before naming them. A good firm handles this by offering references from clients who have agreed to speak, or anonymized case examples. Willingness to arrange a reference call is itself a signal, and stonewalling is one too.

What Contracts Should You Expect From an Outsourced Accounting Firm?

Expect a written engagement letter defining scope, fees, and responsibilities. Expect a data-security or confidentiality provision reflecting the Safeguards Rule, a Form 8655 authorization if a reporting agent will file payroll taxes, and clear onboarding and exit terms. IRS guidance ties provider oversight to documentation, so signed agreements with security terms, due-diligence records, and periodic review notes belong in the firm’s own WISP.

What this means for you: everything material should be in writing. Verify one baseline credential yourself. Anyone paid to prepare or substantially help prepare your federal returns must hold a valid PTIN, and only CPAs, enrolled agents, and attorneys have unlimited rights to represent you before the IRS in an audit or appeal.

Next Steps

Run every candidate through the nine questions, insist on written answers for scope, security, payroll, and exit, and confirm credentials before you share data. If your current firm is underperforming, with missed closes, no advice, or thin security answers, the same checklist tells you whether to fix the relationship or replace it.

WhippleWood offers a free CAS readiness check for Denver-area business owners: a short consultation that maps your current setup against these nine questions and shows where outsourcing would help. Contact us to schedule it, or read more in our WhippleWood insights.

Frequently Asked Questions

How do I choose a CAS (client accounting services) provider?

Choose a CAS provider by asking nine questions before signing: service scope, technology stack, pricing structure, who is assigned to your account, security and SOC 2, communication cadence, industry fit, onboarding, and exit terms. Treat data security and payroll-tax liability as federal pass-or-fail items, since both are governed by law rather than preference.

What is the difference between CAS and traditional accounting?

Traditional accounting is compliance-focused record-keeping and tax filing. CAS is ongoing outsourced accounting plus advisory, meaning a monthly close, reporting, payroll coordination, and someone who interprets the numbers. BLS data shows bookkeeping-clerk roles declining 6% through 2034 while higher-skill accountant roles grow 5%, reflecting the shift from data entry to guidance.

How do I know if an outsourced accounting provider is secure?

A compliant firm meets the FTC Safeguards Rule: it keeps a Written Information Security Plan, designates a Qualified Individual, and uses multi-factor authentication plus encryption of customer data in transit and at rest. Ask for its WISP and any independent SOC 2 or ISO 27001 report. IRS Publication 4557 requires a WISP regardless of firm size.

Who is legally responsible for payroll taxes if I outsource?

You are. The IRS holds the employer legally responsible for federal employment taxes even when a third party handles payroll, and pursues the employer if the provider defaults. Enroll in EFTPS under your own EIN so you can independently verify deposits, and confirm the provider will deposit under your EIN.

Can I ask for client references before signing?

Yes, but a CPA firm needs client consent before naming clients, because unauthorized disclosure of return information is a misdemeanor under Section 7216. Expect references from clients who have agreed to speak, or anonymized case examples, rather than an open client list.