What to Include in a Service Agreement with an Indian CA Firm

Why the Agreement Matters More Than the Vetting

Most US CPAs spend more time vetting an Indian CA firm — checking credentials, reviewing sample workpapers, asking for references — than they spend on the service agreement. This is the wrong priority. Vetting tells you what to expect when things go well. The agreement tells you what happens when they do not.

A well-drafted service agreement does three things: it defines what the Indian firm is responsible for, it protects your clients' data under US legal standards, and it gives you enforceable remedies if the relationship breaks down. Without it, you are relying on informal assurances that carry no legal weight.

This guide covers the ten clauses that belong in every outsourcing agreement between a US CPA firm and an Indian CA firm — what each clause does, what to watch out for, and why omitting it creates risk.

1. Scope of Work

Define exactly what the Indian firm will and will not do. "Bookkeeping services" is not a scope. A proper scope specifies: which clients are included, which accounting periods are covered, what deliverables are expected (reconciled books, workpapers, specific reports), what software the work will be done in, and what the Indian firm is explicitly not responsible for (filing, client communication, tax advice).

A vague scope creates disputes about whether something was included. A clear scope protects both parties — the Indian firm knows what to deliver, and the CPA firm knows what to expect.

2. Data Protection and Security Requirements

This is the most important clause in the agreement. It must specify:

• That all client data is confidential and cannot be used for any purpose other than the agreed work
• What security controls the Indian firm must maintain — at minimum, encrypted file transfer, access controls limited to staff working the engagement, and no storage on personal devices
• A prohibition on sharing client data with any third party, including subcontractors, without written consent
• A breach notification obligation — the Indian firm must notify the CPA within a defined period (typically 24–48 hours) if a data incident occurs
• The specific systems and file-sharing platforms approved for data transfer (for example, ShareFile or a shared Google Drive with two-factor authentication)

Under state data privacy laws — California's CCPA, for example, and similar statutes in other states — the CPA firm may be a "business" and the Indian firm a "service provider." Ensure the data protection clause is drafted consistently with the applicable state law requirements for your clients' home states.

3. Confidentiality and NDA

The data protection clause handles client data security. The confidentiality clause is broader — it covers proprietary information about your practice: client lists, fee structures, workflows, templates, and any non-public information about your business.

If you have not already signed a standalone NDA before sharing any files, include the full NDA terms in this clause. Many firms sign an NDA first and then incorporate it by reference in the main agreement. Either approach works — what matters is that the confidentiality obligation is in writing, signed, and predates any information sharing.

4. IRC 7216 Acknowledgment

IRC 7216 prohibits a tax return preparer from disclosing or using tax return information without the taxpayer's written consent. If the Indian firm qualifies as a "tax return preparer" under the statute — which it may, if it is involved in bookkeeping that flows directly into return preparation — the CPA must obtain written client consent before sharing that client's information with the Indian firm.

The service agreement should include an acknowledgment clause confirming that:

• The CPA has obtained and will maintain IRC 7216 consent from each client whose data is shared
• The Indian firm will not use client tax return information for any purpose beyond the agreed scope
• The Indian firm will maintain records adequate to demonstrate compliance with applicable confidentiality requirements

The client consent itself is a separate document that must be signed by the client — it cannot live in the service agreement. But the service agreement should acknowledge the consent obligation so both parties understand the framework.

5. Subcontractor Restrictions

Specify whether the Indian CA firm may subcontract work to other individuals or firms. If subcontracting is permitted, require written notice before any subcontracting occurs, require that the same data protection and confidentiality obligations apply to subcontractors, and require that the Indian firm remains fully liable for subcontractor performance.

If subcontracting is not permitted — which is the more protective approach — state that explicitly. The risk of silent subcontracting is that client data reaches individuals who never agreed to your confidentiality terms and whose conduct is outside your control.

6. Turnaround SLAs and Quality Standards

Define the expected turnaround time for standard deliverables — for example, reconciled books for a prior month within five business days of receiving source documents. For tax season, define peak-period SLAs separately: Indian CA firms routinely handle tax season volume, but the agreement should specify what "timely" means and what happens if deadlines are missed.

Quality standards should specify the acceptable error rate and what happens if workpapers require significant rework. A reasonable approach is to require the Indian firm to correct any errors at no additional charge, with a provision that repeated significant errors (more than once per quarter, for example) trigger a remediation process before becoming grounds for termination.

7. Liability Cap

The liability clause defines the Indian firm's maximum financial exposure for errors, omissions, or data breaches. Standard practice in professional services agreements is to cap liability at fees paid for the specific engagement that gave rise to the claim — or at six to twelve months of total fees, whichever is higher.

The agreement should also specify what types of damages are excluded. Indirect, consequential, and punitive damages are typically excluded — the Indian firm cannot be held liable for a client's lost business resulting from a filing error, for example, even if the error originated in their workpapers.

Ask the Indian firm to carry professional indemnity (errors and omissions) insurance and to provide proof of coverage. A reputable firm will have this. Include a clause requiring them to maintain coverage throughout the engagement and to notify you if the policy lapses.

8. Governing Law and Jurisdiction

The governing law clause specifies which country's and state's laws apply to the agreement. Always specify your home state in the United States — not Indian law. Disputes involving your clients' data and your professional liability are most practically resolved under the law you know and in the jurisdiction where you practice.

Require the Indian firm to consent to jurisdiction in your state. A reputable Indian CA firm that regularly works with US CPAs will agree to this without objection. Resistance to US governing law is a red flag.

9. Termination Rights

Define both parties' rights to terminate the agreement and the notice periods required. Include:

• Termination for convenience — either party may terminate with 30 days' written notice, without cause
• Termination for cause — immediate termination if the Indian firm breaches the confidentiality clause, misuses client data, or commits material errors that are not corrected within a defined cure period
• Survival of key obligations — the confidentiality and data protection obligations survive termination and remain in effect indefinitely

10. Data Return and Deletion on Exit

When the engagement ends — whether by choice or for cause — specify what happens to client data held by the Indian firm. The agreement should require:

• Return of all client data to the CPA within 30 days in a specified format
• Permanent deletion of all copies retained by the Indian firm, including backups
• A written certificate of deletion provided to the CPA on request

Do not rely on the Indian firm's informal assurances that data has been deleted. A written certificate is a legal record that demonstrates you exercised due diligence — important if a data complaint arises later from a former client.

What a Reputable Indian CA Firm Should Provide Before Signing

A well-established Indian CA firm will typically provide the following before any files are shared:

• A signed NDA (their standard form, or yours)
• ICAI registration number and proof of current membership
• Professional indemnity insurance certificate
• A brief description of their data security setup — encrypted file sharing, access controls, staff confidentiality agreements
• A sample engagement letter or service agreement they have used with other US CPA firms

If a firm cannot provide these without extended negotiation, that is informative. The administrative overhead of a proper agreement is not high — firms that work regularly with US CPAs have dealt with it before.

Frequently Asked Questions