24-Point Outsourcing Due Diligence Checklist

A. Professional Demarcation & Client Ownership (Checkpoints 1–6)

1. Absolute Prohibition on Direct Client Contact: Does the provider explicitly commit that they will never contact your end-clients via email, phone, or portal?

2. Clear Regulatory Boundaries: Does the contract confirm that the provider acts purely in a production capacity and is not a UK practice or statutory auditor?

3. Retention of Final Review & Statutory Sign-Off: Does your UK practice retain exclusive authority to review, approve, and submit filings to HMRC and Companies House?

4. 100% White-Label Formatting: Are deliverables formatted to your firm’s exact indexation and branding standards without third-party marks?

5. Single Consolidated Query Protocol: Does the provider batch queries into a single structured schedule with proposed treatments rather than piecemeal emails?

6. Non-Solicitation Covenants: Are strict, legally binding client and staff non-solicitation covenants embedded in the Master Services Agreement?

B. UK GDPR, Data Privacy & Information Security (Checkpoints 7–12)

7. Article 28 Data Processing Agreement (DPA): Is a bilateral UK GDPR Article 28 DPA executed defining processing instructions, subprocessor controls, and audit rights?

8. ICO-Approved UK IDTA / Addendum: Is the International Data Transfer Agreement (IDTA) in place to legally govern cross-border data access from India?

9. Remote Cloud Access Only (No Local DB Persistence): Does the team work directly inside your cloud software without downloading complete client databases onto local drives?

10. Hardware Lockdown & Disabled External Storage: Are USB mass-storage ports disabled on company laptops to prevent unauthorised local copying of accounting files?

11. Individual MFA & Password Governance: Are logins authenticated via named credentials with mandatory two-factor authentication, with zero pooled credentials?

12. Documented Rapid Deprovisioning SLA: Does the provider guarantee access revocation within 60 minutes of staff departure or project reassignment?

C. Internal Quality Assurance & Review Standards (Checkpoints 13–18)

13. Mandatory Second-Level Senior Technical Review: Does every file undergo documented line-by-line review by an experienced senior reviewer before delivery?

14. Balance Sheet Substantiation: Are lead schedules prepared and cross-referenced to primary documentary evidence for every balance sheet account?

15. Zero Unreconciled Suspense Balances: Does the provider guarantee that suspense accounts are cleared or specifically flagged on the query schedule?

16. UK VAT Technical Knowledge: Does the team demonstrate operational competence in Domestic Reverse Charge (CIS), Postponed VAT Accounting, and partial exemption?

17. UK Accounts Production Standard Formats: Are draft accounts prepared under FRS 102 Section 1A or FRS 105 directly inside TaxCalc or IRIS?

18. Net Capacity Audit: Does the provider measure success by UK reviewer time saved rather than simply hours clocked?

D. Commercial Agility & Pilot Protection (Checkpoints 19–24)

19. One-Client Pilot Availability: Can you test the service on a single file with zero obligation to commit additional clients?

20. Pre-Agreed Pilot Success Criteria: Are turnaround deadlines, error tolerance thresholds, and satisfaction ratings agreed before work begins?

21. Elastic Seasonal Scalability: Can you expand capacity for the 31 January busy season and reduce hours afterwards without penalty?

22. Transparent Pricing Without Hidden Extras: Is pricing based on fixed job quotes or predictable monthly capacity retainers rather than low teaser rates?

23. Subprocessor Transparency: Does the contract prohibit subcontracting your files to unvetted third parties without prior written consent?

24. Clean Break & Termination Terms: Can you terminate the arrangement smoothly with reasonable notice and immediate revocation of system access?

UK Accounting Practice Outsourcing Due Diligence Checklist

24-Point Practice Evaluation Guide

A. Professional Demarcation & Client Ownership (Checkpoints 1–6)

B. UK GDPR, Data Privacy & Information Security (Checkpoints 7–12)

C. Internal Quality Assurance & Review Standards (Checkpoints 13–18)

D. Commercial Agility & Pilot Protection (Checkpoints 19–24)

How Does Ferret BizServe Score?