blog.lemonagency.io

Category: Avior

  • What to Send Offshore, and What to Keep In-House

    What to Send Offshore, and What to Keep In-House

    Once a firm has decided to use an offshore team, a second question arrives immediately and usually gets far less thought than the first: which work actually goes?

    Most firms answer it by accident. They send whatever hurt most last month — the client whose records arrived in a shoebox, the fund that took three times as long as it should have, the pay run that went wrong twice. It feels like the obvious answer. It is almost exactly backwards.

    What follows is the test worth applying instead. It assumes the compliance groundwork is already done; the privacy and professional obligations that come with sending client information overseas are a separate question, covered in our guide to what Australian firms need to get right before sending client data offshore.

    Pain is the wrong sorting criterion

    The instinct to offshore the worst job in the office is understandable, and it is the single most common way a first engagement goes badly.

    The jobs that feel worst usually feel that way because they are full of decisions. A reconstruction job, a client who cannot find half their documents, a fund holding an asset nobody has dealt with before — the difficulty in each is judgement, and judgement is precisely what does not travel well across a distance, a time zone and a gap in documentation. Send your hardest file first and you will get back exactly what you feared: something that needed six questions asked and answered, where only two got asked.

    Meanwhile the work that is merely long — reconciliations, straightforward returns, routine pay runs — feels unremarkable because it is predictable. Predictable is the whole point. It is also, usually, where most of your team’s hours actually go.

    A more useful way to frame it: you are not looking for the work you most want to stop doing. You are looking for the work that can be done correctly by a capable person who cannot tap you on the shoulder at the moment they need to.

    Three questions that decide it

    For any job type you are considering, ask these in order:

    • Is it repeatable? Same kind of inputs, same steps, same shape of output, every time. Not identical — repeatable. A rental schedule is repeatable even though every property is different.
    • Is it documented? Could a competent person who has never met you follow it from what is actually written down, rather than from what everybody here just knows?
    • Is it reviewable? Can you tell from the finished output whether it is right, in less time than it would have taken you to do it yourself? If checking it properly means redoing it, nothing has been gained.

    Three yes answers and the job is a strong candidate. A single no is not a reason to keep that work in-house forever — it is a description of the project you need to do first.

    Most often the no is the second question. That is good news. Documentation is far cheaper to fix than judgement is to transfer, and writing the process down is worth doing whether or not anything ever leaves your office.

    Work that travels well

    In practice, the job types that clear all three questions for most Australian accounting firms are:

    • Bank, credit card and clearing account reconciliations, and the month-end close that sits on top of them
    • Pay runs where classifications, rates and entitlements have already been settled by you or your client
    • Individual returns where the source documents and the ATO pre-fill report are complete
    • SMSF annual compliance prepared against your own checklists in Class or BGL Simple Fund 360
    • BAS and IAS prepared from a reconciled ledger
    • Year-end workpapers and financial statements for companies, trusts and partnerships
    • Catch-up bookkeeping, data entry and system migrations where the records are complete

    The common thread is not that this work is easy. Some of it is demanding and all of it has to be accurate. The thread is that the right answer is determinable from the file. Everything needed to finish the job correctly is either in the records or in your checklist, and where it is not, the gap is obvious enough to be raised as a question rather than guessed at.

    Work that should stay with you

    Four categories are worth protecting deliberately, because the pressure to hand them over grows as the arrangement succeeds.

    The client relationship. Not just the meetings — the small judgement calls that come out of knowing a client’s history. Whether this year’s unusual transaction is a one-off or the start of something. Whether a client who always files late needs chasing in March or in April. None of that is in the file.

    Award interpretation. Deciding which award covers a role, and which classification level applies to it, is the employer’s call and carries the employer’s liability. The Fair Work Ombudsman is explicit that employers must correctly identify each employee’s classification in order to pay them correctly, and be clear about why they selected it — the detail is set out in its guidance on award classifications. An offshore team can apply classifications and rates accurately and consistently once they are settled. It should never be the thing settling them.

    Anything the client relies on as a tax agent service. The line here is not where people often assume it is. Preparing a return for your firm’s review is work done for you; the service the client relies on to meet their obligations under a taxation law — including lodgement — is a tax agent service, and providing one for a fee requires registration with the Tax Practitioners Board. The TPB sets out what counts in its overview of tax agent services. That part is your firm’s to provide, and it does not become otherwise because the preparation happened somewhere else.

    Work you would put your name to without reading twice. If a job is going out under your signature on the strength of your professional judgement rather than on the strength of a checklist, it belongs with the person whose judgement it is.

    The grey zone is usually a documentation problem

    Plenty of work sits awkwardly in the middle: repeatable and reviewable, but only one person in the office actually knows how it is done.

    That is worth naming honestly, because it is not really an offshoring question. A process that lives in one person’s head is a key-person risk you already have, and it is already costing you — in onboarding time, in holiday coverage, in what happens when that person leaves. The decision about offshoring did not create it; it just made it visible.

    There is a second reason to care. If you cannot write down how a job is done, you cannot review it properly either, because you are checking the result against a standard only you can see. Firms that work through this usually find the documentation improves their own internal review as much as it enables anything external.

    Start with volume, not with pain

    When you have a shortlist, pick the job type you do the most of rather than the one that annoys you the most. Four reasons:

    • The setup cost — writing the checklist, agreeing the file structure, the first few rounds of questions — is paid once and then spread across many jobs.
    • You get a real sample. Quality is a pattern, and you cannot see a pattern in one job.
    • Process gaps surface in the first week rather than the third month, while you still have attention on it.
    • The capacity you free up is large enough to notice, which matters when you are deciding whether to continue.

    A sensible first month

    One job type. Three to five jobs rather than one, so you are judging a pattern instead of an anecdote. Review at full strength for the whole batch — the point of the first month is to find out what the review has to catch, and you cannot learn that by reviewing lightly. Compare the output against what your own team would have produced, not against perfection, because your own files contain queries and small corrections too.

    Then widen by job type rather than by volume. Adding a second kind of work tests the process; adding more of the same work only tests capacity, and capacity is the easy part.

    Firms that work through it in this order tend to find the decision straightforward, because by the time they are choosing, they are choosing between things they can actually see. The ones that struggle are almost always the ones that started by sending the hardest file in the office and drew a conclusion from it.

    This article is general information about how Australian firms structure outsourced work, current as at October 2026, and is not legal, tax or compliance advice. Avior Offshore is not a registered tax agent or BAS agent and does not provide tax agent services, BAS services, financial advice or employment advice. Confirm your own obligations with your professional body or adviser, and check the Fair Work Ombudsman and TPB sources directly, as guidance is updated from time to time.

  • Sending Client Data Offshore: What Australian Accounting Firms Need To Get Right

    Sending Client Data Offshore: What Australian Accounting Firms Need To Get Right

    Most conversations about offshoring start with price and end with a question nobody in the room can answer with confidence: are we actually allowed to do this?

    The short answer is yes. Australian accounting firms have sent preparation work overseas for years, and both the Office of the Australian Information Commissioner (OAIC) and the Tax Practitioners Board (TPB) have published guidance on how to do it properly. Neither regulator prohibits it. What both do is make the firm responsible for it — and that responsibility does not travel offshore with the work.

    That distinction is the entire subject of this article. If you understand it before you send the first job, offshoring is an operational decision. If you discover it afterwards, it becomes a compliance problem with your name on it.

    Sending work offshore is a “disclosure”, and that word carries weight

    When personal information leaves Australia, Australian Privacy Principle 8 (APP 8) applies. Before disclosing personal information to an overseas recipient, an entity must take such steps as are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles in relation to that information.

    Firms frequently assume this does not apply to them, on the reasoning that the data never really leaves — the offshore team logs into the firm’s own Xero or Class file, so nothing has been handed over. It is an intuitive argument, and it does not hold.

    The OAIC does draw a line between using information and disclosing it. Where an entity keeps such a degree of control that it is merely handling the information within its own effective control, that is a use, and APP 8 is not engaged. Routing data in transit through an overseas server is the textbook example. But engaging a contractor located overseas to perform services on your behalf is treated differently: in most circumstances, providing personal information to that contractor is a disclosure, and APP 8 must be satisfied before it happens.

    The consequence is the part worth reading twice. Under section 16C of the Privacy Act 1988, a firm that discloses personal information to an overseas recipient is accountable for acts and practices of that recipient which would have breached the APPs. In practical terms, the firm wears the breach. A provider’s assurances are not a defence; the reasonable steps the firm took are.

    The OAIC sets out what those steps look like, and the emphasis falls on enforceable contractual arrangements — specifying the purposes for which the recipient and any subcontractors may use the information, and the minimum technical and organisational security measures that apply to it. The detail is worth reading in full in the OAIC’s APP 8 guidelines on cross-border disclosure.

    “We’re under the threshold” is a weaker position than it sounds

    The Privacy Act’s small business exemption covers most organisations with an annual turnover of $3 million or less, and a large number of Australian practices sit comfortably under that line. Many conclude the Act is simply not their problem.

    For an accounting firm, that conclusion is unsafe for a specific reason: tax file number recipients are covered regardless of turnover. The Privacy (Tax File Number) Rule 2015 regulates the handling of TFN information, and the Notifiable Data Breaches scheme applies to TFN recipients to the extent that TFN information is involved in a breach. A firm preparing individual returns handles TFNs by definition, which means the exemption does not clear the ground the way it first appears to.

    The exemption can also be lost on other grounds — a business that trades in personal information, or one related to a larger business, is brought back in. And even a firm genuinely outside the Act is still bound by professional confidentiality under APES 110, by the TPB’s Code of Professional Conduct, and quite possibly by confidentiality terms in its own client engagements. The Privacy Act is one source of obligation here, not the only one.

    What the Tax Practitioners Board expects

    The TPB has dealt with this directly. Its current guidance is TPB(GS) 31/2018, Outsourcing and offshoring of tax services — renamed from a Practice Note to a Guidance Statement in April 2026, so firms working from an older internal policy may be citing a document that has since been archived. Two Code items do most of the work.

    Code item 6 — confidentiality. A tax practitioner must not disclose information relating to a client’s affairs to a third party without the client’s permission or a legal duty to do so. Permission may be obtained through a signed letter of engagement, a signed consent, or other communication. The TPB’s recommendation is more specific than most engagement letters are: inform the client about the proposed disclosure, including to whom and where it will be made. The jurisdiction is part of the disclosure, not an operational detail to be kept in-house.

    Code item 7 — competent services. A tax agent service provided on your behalf must be provided competently, and this expressly extends to services provided by an unregistered external contractor, whether in Australia or abroad. Supervision does not thin out because the preparer is in another country. The review layer is yours, and so is the outcome.

    Read together, these put real pressure on the boilerplate clause. A line in your terms saying the firm “may engage third party service providers from time to time” is unlikely to amount to informed client permission for sending identified financial records to a named country.

    Settle these before the first job leaves your office

    None of this is difficult, but it is much easier to do before an engagement than to retrofit across a client base. A defensible arrangement generally has all of the following in place:

    • The jurisdiction named in your engagement terms, not merely the fact that offshoring occurs.
    • Client permission captured in writing, in a form you could produce on request, for each client whose information will be disclosed.
    • A written agreement with the provider covering purpose limits, whether subcontracting is permitted, minimum security measures, breach notification timeframes, and return or deletion of data when the engagement ends.
    • Access through your systems and your user accounts, with permissions you set, so that what offshore staff can reach is visible to you and revocable by you alone.
    • No local copies — no removable drives, no personal email, no printing, no downloads to local machines.
    • A named supervising practitioner responsible for review and sign-off on every job, recorded somewhere other than memory.
    • A breach escalation path measured in hours, with a named contact on both sides, tested at least once before you need it.
    • An offboarding step that actually happens on the day a staff member leaves, on either side of the arrangement.

    A provider who cannot answer these questions in writing is telling you something useful about how the rest of the engagement will go.

    Don’t build the arrangement on an exception

    APP 8 has exceptions, and two get reached for often. The first applies where the entity reasonably believes the overseas recipient is subject to a law or binding scheme substantially similar to the APPs, and there are mechanisms the individual can access to enforce that protection. The second is the individual’s informed consent to the disclosure.

    Both are narrower in practice than they look on paper:

    • The Philippines has had a Data Privacy Act since 2012 and a National Privacy Commission to administer it. Whether that satisfies both limbs of the first exception — particularly accessible enforcement by your individual client — is a legal judgement for your own advisers to form on your facts. It is not something a provider can settle for you, and any provider asserting it flatly is overreaching.
    • Consent must be genuinely informed and freely given. Consent bundled into terms that nobody reads invites precisely the argument you would least like to meet: that it was never informed at all.

    The more durable posture is to assume APP 8.1 applies, take the reasonable steps, and treat the exceptions as a backstop rather than the design.

    AML/CTF changed the picture in July 2026

    From 1 July 2026, AML/CTF obligations were extended to tranche 2 entities, including accountants providing certain designated services. Newly regulated businesses were required to enrol with AUSTRAC — generally within 28 days of first providing a designated service, which for most meant 29 July 2026. The core obligations include developing and maintaining an AML/CTF program that identifies and manages the business’s risks, appointing a compliance officer, training staff, and being ready to identify and report suspicious activity.

    This matters for offshoring because customer due diligence creates a new and unusually sensitive category of personal information: identity documents, source of funds and wealth, beneficial ownership details. If offshore staff touch client onboarding or document collection, that information now sits inside both your privacy obligations and your AML/CTF program — and the program has to describe how the arrangement is managed. A firm that mapped its offshore data flows for APP 8 a few years ago has a map that is now incomplete.

    What a defensible arrangement looks like day to day

    Everything above reduces to a fairly short operational picture. Offshore staff work inside the firm’s systems through the firm’s own user accounts, with permissions the firm controls and can withdraw in a minute. Nothing is stored locally, emailed personally or printed. Every person with access has signed a confidentiality agreement, and access is removed the day they leave. There is a written, rehearsed process for reporting a suspected breach that aligns with the Notifiable Data Breaches scheme. And every job carries a named reviewer at the firm, because supervision is the obligation that cannot be delegated offshore at all.

    This is the standard we hold ourselves to, and the detail of how we do it is set out on our data security and confidentiality page. A firm evaluating any provider — us included — should ask for it in writing and read it against the checklist above.

    A sensible place to start

    Three steps, in order. Map the data: list what categories of client information would actually leave Australia for the work you have in mind, including anything collected for customer due diligence. Paper the arrangement: update engagement terms to name the jurisdiction, capture permission properly, and get a provider agreement that covers purpose, security, subcontracting, breach notification and exit. Pilot one job type, with full review, before extending it across the practice.

    Firms that work through those three steps rarely find the compliance side difficult. The ones that run into trouble are almost always the ones that started with the second half of the conversation — capacity and cost — and left the first half until a client asked.

    This article is general information about the obligations that apply to Australian firms, current as at October 2026, and is not legal, tax or compliance advice. Avior Offshore is not a registered tax agent or BAS agent and does not provide tax agent services, BAS services or financial advice. Confirm your own obligations with your professional body or legal adviser, and check the OAIC, TPB and AUSTRAC sources directly, as guidance is updated from time to time.