Outsourcing Audit Work to India: Rules CPA Firms Follow

Is outsourcing audit work to India allowed, and which rulebook actually applies? It is allowed. What catches partners out is that the governing rulebook is not the one their tax team already runs.

The consent paperwork a tax team runs is built for IRC section 7216, and it attaches to tax return information in the hands of a return preparer. An audit engagement does not produce return information, so reusing that process on an audit is documenting the wrong rule.

What governs instead is the AICPA Code on client disclosure and confidentiality, and on an issuer audit, PCAOB supervision standards.

Get four things right and an India audit team becomes an ordinary staffing decision: which procedures move, who reviews them, what the client is told, and what a seat costs.

What does outsourcing audit work to India actually mean?

Outsourcing audit work to India means a US firm has an offshore team perform preparation and testing procedures while the engagement partner keeps supervision, review and the signed opinion. The AICPA Code requires the firm to tell the client before confidential information is shared. IRC section 7216 does not apply to audit engagements.

That one sentence does a lot of work, so it is worth pulling apart. The offshore team is doing rule-bound execution: schedules, tie-outs, sample testing, documentation. The judgment calls, and the name at the bottom of the report, never leave your firm.

Think of it the way you already think about staffing a large engagement. You do not hand the opinion to the senior who built the lead schedule. Distance changes the logistics of supervision, not its location.

Audit support, internal audit and an Indian statutory audit are three different things

Three very different searches land on the same phrase, and two of them are not this. Here is the split:

• Audit support for a US firm: an offshore team performs preparation and testing procedures on your engagements, under your instructions, for your signature. This is the arrangement this page is about.
• Internal audit outsourcing or co-sourcing: a company's own internal audit function is performed or supplemented by an outside provider. Different buyer, different rules, covered further down.
• A statutory audit of an Indian entity: under the Companies Act this is a separate obligation performed by an auditor appointed in India, and it is not what a US firm is buying when it sends audit work offshore.

Once the three are apart, the useful question is which procedures can actually leave the engagement team.

Which audit procedures can move offshore, and which cannot?

The split is not by task difficulty, it is by whose judgment the task is. Preparation and testing performed under written instruction can sit offshore. Risk assessment, scoping, supervision, client communication and the opinion stay with the engagement partner, because AS 1201.04 keeps primary responsibility there whatever the staffing structure.

Partners tend to expect the line to fall at complexity, with the "easy" work going offshore. It does not. Substantive testing is not easy, and it travels well because it is rule-bound and reviewable.

Work that moves

The work that transfers cleanly shares one property: somebody can write down what done looks like before it starts.

• Workpaper preparation, schedules and audit documentation: performed under the engagement team's written instructions, reviewed onshore.
• Substantive testing of balances and transaction samples: the largest single block of hours on most engagements.
• Confirmations, tie-outs, recalculations and roll-forwards: rule-bound and remotely deliverable, with a clear evidence trail.
• Control evaluation and initial analytical review: reported as routine on UK engagements, and reviewed onshore in every case.

The retained floor

Then there is the floor, and it does not bend for staffing convenience.

If this shape looks familiar, it should. It is the same "what moves first, what never moves" question that governs what moves first in a record to report transition, and the answer comes out the same way: transactional execution travels, accountable judgment does not.

Knowing what can move is half of it. The other half is the paperwork that has to exist before it does.

Which professional rules apply when audit work is performed offshore?

Two rulebooks, and on an issuer audit, three. The AICPA Code governs every engagement: ET 1.700.040 on confidentiality and ET 1.150.040 on use of a third-party service provider. On an issuer audit, PCAOB AS 1201 and the amended other-auditor standards apply. SQMS No. 1 sits at the firm level. IRC section 7216 governs outsourced tax preparation.

Most of the confusion here is not about the content of any single rule. It is about which one is even in play, which sits alongside the broader legal considerations for India outsourcing a firm works through once.

That bottom row is where most firms already have a process, because it is the one they built for outsourcing tax preparation to India. It is also the row that causes the trouble.

Why the tax outsourcing rulebook does not govern an audit

IRC section 7216 is a criminal provision aimed at anyone in the business of preparing, or providing services in connection with the preparation of, income tax returns, and what it protects is information furnished for or in connection with preparing a return.

The Treasury regulation defines tax return information the same way, as information furnished for, or in connection with, the preparation of a tax return, plus anything the preparer derives from it, as of September 2026.

An audit engagement produces no return and generates none of that information. So running a section 7216 consent on an audit documents a rule that was never in play.

The reverse reading is just as wrong, and more expensive. Section 7216 not applying does not leave you with no disclosure duty, because on an audit the duty comes from the AICPA Code instead. One rule steps out, another steps in.

One nuance keeps this honest. A firm that also prepares the same client's return still has section 7216 duties. Those duties run with the tax work, not with the audit.

If your tax practice is the reason the section 7216 process exists in the first place, it is worth knowing exactly how the written-consent rules work on outsourced tax returns before you assume the audit side inherits them.

Private-company audits and issuer audits are not the same paperwork

The AICPA duties apply to both. The PCAOB layer applies only on an issuer audit, and it is not a formality.

The amended other-auditor standards took effect for audits of fiscal years ending on or after December 15, 2024. They raise what the lead auditor has to do when somebody else performs part of the work.

At the firm level, SQMS No. 1 introduced new requirements for networks and service providers, and firms' systems of quality management were required to be designed and implemented by December 15, 2025.

One of those rules is the one partners ask about most, because it involves picking up the phone.

Do you have to tell an audit client that work is being done in India?

Yes, and it costs one sentence. The AICPA Code requires the firm to inform the client, preferably in writing, that a third party may be used, before confidential information is provided. Before disclosing, the firm either contracts for confidentiality with adequate procedures, or obtains specific client consent.

Notice the sequencing. The telling happens before the data moves, not in a footnote after the fact. That is the part firms get wrong far more often than the wording.

What goes in the engagement letter

Three things belong in the file, and none of them is hard to produce.

• The disclosure sentence: a plain statement that the firm may use a third party in performing the engagement, in the engagement letter, so the timing is provable.
• The confidentiality contract: an agreement with the provider to maintain confidentiality, with reasonable assurance that it has appropriate procedures to prevent unauthorized release. The alternative route is specific client consent.
• Sample language: the AICPA's Professional Ethics Executive Committee publishes sample client disclosure language for the third-party service provider interpretation, so nobody has to draft this from a blank page.

Data handling sits alongside the disclosure rather than replacing it. If client records are going to be processed by people in India, it is worth understanding India's data protection act before the first file moves.

The same goes for who those people are. Background checks in India are a routine pre-employment step, and an audit client's records are exactly the situation they exist for.

In the UK the expectation is more explicit. The FRC has been running heightened monitoring of overseas service delivery centres and expects engagement letters to name offshore processing hubs.

As Accountancy Age renders the regulator's position: you can outsource the work, but you cannot outsource accountability.

What clients actually say when you tell them

This is the part partners dread and it is almost always an anticlimax. Practitioners discussing the disclosure report that once the arrangement is explained, clients rarely object, and several treat telling the client as an obligation rather than a choice.

Read that as practitioner experience, not as survey data. There is no study behind it, and we would rather label the provenance than dress it up as a statistic.

Telling the client is one sentence. Standing behind the work is the part that takes structure.

Who supervises the offshore team, and who signs the audit opinion?

The engagement partner, on both counts. AS 1201.03 makes the partner responsible for supervising engagement team members including those outside the partner's own firm. AS 1201.04 provides that a partner who seeks assistance nevertheless retains primary responsibility for the engagement and its performance. The signature never moves offshore.

Read those two paragraphs together and a convenient argument dies quickly. Nothing in AS 1201 turns on whose payroll the person is on. The duty follows the engagement, not the employment contract.

What the review documentation has to show

Supervision that exists only in the partner's head is not supervision the file can demonstrate.

Under the amended standards, the lead auditor reviews whether the other auditor followed the lead auditor's instructions, including use of applicable PCAOB standards, and whether additional audit evidence should be obtained (AS 1201 paragraph .13).

In practice that means a few concrete artifacts:

• Written instructions issued before the work starts: scope, sample sizes, the standards to be applied, and what constitutes completion.
• Documented review notes on offshore workpapers: cleared with a response, not silently closed.
• Tracked error rates and review turnaround: so the quality conversation is evidence-based rather than anecdotal.
• A record of what further evidence was sought: and why, where the review raised a question.

None of that is easy to do well at distance, and critics have said so for well over a decade. Douglas Carmichael, the PCAOB's former chief auditor, put it to Reuters plainly: "it is tough to supervise on a remote basis."

The honest answer is not a reassurance, it is a file. Remote supervision is harder to perform casually and easier to evidence, which is why firms that do it well end up with better documentation than they had before.

Getting the operating rhythm right is most of the battle, and there is a practical playbook for managing an offshore team in India that covers the review cadence in detail.

Supervision handles this year's engagement. The objection that stops partners signing is about the year after next.

Will offshoring audit work stop your own staff from learning?

It can, and the profession has said so out loud. Interview respondents told the PCAOB that the push toward shared service centers is removing foundational skills and experiences from firm personnel. Whether that happens to your firm depends on how the offshore team is structured, not on where it sits.

The PCAOB's December 2024 Spotlight rests on more than 150 interviews with partners at the largest US audit firms, which makes it the most direct evidence available on what practitioners actually think.

The verbatim finding is blunter than any summary of it. Respondents said the push for the use of shared service centers is "removing foundational skills and experiences from firm personnel."

One put it concretely: "Our staff now will never see cash testing, as it is done offshore. We are going to see the impact of that when they are managers."

That is not a talking point you can wave away. It is a real second-order cost, and it lands three or four years after the decision that caused it.

The same respondents named the pressure behind it: pressures to "get the [profit] margins right" which include specific metrics to send work overseas. That is the trade being made, stated plainly by the people making it.

Why a team that stays answers this and a rotating bench does not

Here is where the structure of the offshore arrangement stops being an administrative detail.

If the same named associates and seniors work your files this busy season, next busy season, and the one after, procedure-level experience accumulates inside a relationship.

Your reviewers learn who is strong on inventory and who is strong on revenue. The team learns your client's ledger.

If the work goes to a pool that re-allocates between engagements, none of that compounds. You get capacity, and you pay for the ramp-up again every year.

Continuity is therefore a quality argument before it is a cost argument. It is also the point at which Indian employment mechanics stop being HR trivia.

India attrition rates determine whether a team is still intact in January, and what notice periods India actually enforces determines how much warning you get when somebody leaves.

One neighboring topic is worth separating out before the numbers, because the rules there are genuinely different.

How is internal audit outsourcing different from audit support?

Internal audit outsourcing is a different arrangement with a different constraint. The company's own internal audit function is being performed or supplemented by an outside provider, and independence runs the other way: your external auditor cannot also be your internal auditor. The buyer is usually the audit committee, not an engagement partner.

Co-sourcing is the common middle version, where an in-house internal audit lead keeps the plan and the reporting line to the audit committee while a provider supplies specialist or surge capacity for specific reviews.

The practical difference for a reader of this page is simple. If you are a CPA firm buying capacity for your own engagements, you are in audit support.

If you are a company deciding who performs your internal audit plan, you are in audit outsourcing, and the independence question you have to answer is about your external auditor, not about India.

Different rules, different buyer, different page. Which brings us to the question every partner asks in the first ten minutes.

What does outsourcing audit work to India cost, and how do you staff it?

US accountants and auditors earned a median annual wage of $83,680 in May 2025. India-side, published Wisemonk rates for specialized accounting work run $15 to $25 an hour, and total cost of employment lands at 110% to 125% of gross. No reliable audit-specific Indian salary band is published, so the accounting rates are the closest anchor.

We would rather give you two honest anchors than one invented band. Here is what sits behind each.

What the US side costs, and why the pipeline story changed

The Bureau of Labor Statistics puts the median annual wage for accountants and auditors at $83,680 as of May 2025, which works out to $40.23 an hour. The lowest 10 percent earned less than $56,020 and the highest 10 percent earned more than $144,090.

On volume, BLS projects about 115,300 openings for accountants and auditors each year, on average, over the decade, with employment growing 5 percent from 2025 to 2035.

Now the part that has quietly gone out of date. The story everyone repeats is a one-way collapse in the accounting pipeline, and the AICPA's own 2025 Trends Report no longer supports it.

US schools awarded 55,152 accounting bachelor's and master's degrees in 2023-24, down 6.6 percent year over year. That is a decline, but it is a shallower one than the 9.6 percent drop the year before.

The CPA exam pipeline tells a similar mixed story: 28,082 new candidates entered in 2024 against 42,626 in 2023, with 16,448 in the first six months of 2025. Meanwhile spring 2025 accounting enrollment rose 12.4 percent to 266,506, the highest since 2020.

The practical read for a partner is this. Do not build a five-year offshore strategy on the assumption that domestic hiring is permanently finished, and do not build a busy-season plan on the assumption that next year's graduating class will rescue it either.

What an India seat costs

Wisemonk publishes India accounting outsourcing rates by work type:

• Bookkeeping: $8 to $12 an hour.
• Specialized accounting work: $15 to $25 an hour. Audit support sits closest to this band.
• Financial reporting and controller-level work: $20 to $40 an hour.

Those are our published India accounting rates, and they carry 40 to 60 percent total savings against US cost.

For an employed team rather than an hourly engagement, the useful published anchor is our finance-seat data. Be precise about what it covers: those bands are FP&A roles, not audit roles.

• FP&A analyst, 2 to 4 years: $9,600 to $18,000 base.
• Senior analyst: $18,000 to $30,000.
• Manager: $30,000 to $48,000. Bands current as of July 2026.

What travels across from that data regardless of role is the loading. Statutory employer contributions run 15 to 22 percent, and fully loaded total cost of employment lands at 110 to 125 percent of gross. That multiplier is the number to model with.

If you want the full build of that stack rather than the summary, the breakdown of what an India finance seat costs per FTE walks through every statutory component.

You can run your own numbers in the employee cost calculator before committing to a headcount, and the India payroll and statutory layer is where those contributions actually get filed.

Employment routes for an India audit team

Three routes, and the choice is mostly about how permanent you expect this to be.

• Your own Indian entity: full control and the lowest per-head cost at scale, at the price of incorporation, registrations and a local HR and compliance function. Most firms reach this only after the team is proven. It is the crossover point covered in weighing an EOR against an India entity.
• An Employer of Record: a third party becomes the legal employer while you direct the work day to day. If the model is new to you, what an Employer of Record is covers the mechanics, and hiring in India without a local entity covers what it takes to start.
• A vendor's bench: fastest to capacity and the weakest on continuity, because the people are allocated to you rather than hired for you.

Whichever route you take, the disclosure duty and the supervision duty are unchanged. That is worth saying twice, because the employment structure is exactly where firms hope to find an exemption and there is not one.

For the wider comparison, choosing an employment model in India lays the three side by side, and hiring through an EOR covers the process end to end.

US companies hiring in India covers the cross-border specifics a US firm runs into first. If you are planning against a busy-season date, the India hiring timeline is the calendar to work backward from.

How can Wisemonk help you build an audit support team in India?

Wisemonk is an India-native Employer of Record (EOR) that helps global companies hire, pay, and manage talent in India without setting up a local entity.

For an audit support pod, that means named associates and seniors working your preparation and testing schedules within weeks, on compliant Indian employment contracts, without registering a company in India first.

One thing worth being precise about: we do not perform audit work and we do not sign any part of your opinion. We employ and support the India team that does the work under your supervision.

We support 300+ global clients and more than 2,000 employees across India, process $20M+ in annual payroll, and hold a 4.8/5 rating on G2. Pricing starts from $99 per employee per month as of September 2026.

Here is how we help:

• India Employer of Record: we become the legal employer of your India audit team, so you can supervise and review the work without holding an Indian entity. Laptops and equipment are handled as part of the same setup. See our EOR service.
• India PEO: if you already hold an Indian entity, our PEO service runs payroll, statutory filings, benefits and onboarding under your own registrations.
• Background verification providers in India: identity, employment, education and court-record screening before anyone touches an audit client file.
• Mira AI: post the role, and every applicant is scored against a scorecard you wrote, with the reasoning shown. Finance and Accounting is one of its ten role categories.
• Setting up a GCC in India: for a firm building an owned delivery centre rather than a pod, scoped and priced on a custom quote.

From our experience helping firms build finance and accounting teams in India, the pods that hold up across a second busy season are the ones staffed with the same named people who worked the file the first time, not a bench that re-allocates in between.