The control objection
How to outsource bookkeeping without losing financial control.
Control is not proximity to the work. It is three specific things: what you can see without asking, what cannot happen without your approval, and what you can take back on any given day. Where all three hold, outsourcing usually increases control, because a written record replaces one person’s memory.
None of the three rest on trust. Each is a mechanism you can specify before signing and test inside the first month.
Sight, consent, recovery. Everything else is preference.
Owners rarely lose control of outsourced finance dramatically. It goes quietly. Six months in, the provider is the only party who knows where anything is, what a particular balance represents, or why last quarter looks the way it does. Nothing was stolen and nothing was hidden. The knowledge simply moved, and no mechanism was built to move it back.
Three mechanisms prevent that, and they are worth naming separately because providers tend to be strong on one and vague about the other two.
- Sight. The current position is visible to you on demand, without a request and a wait.
- Consent. Nothing consequential leaves the business or changes what you owe without your explicit approval of that exact action.
- Recovery. The records, the evidence and the system access are yours, and you could take the work back or move it elsewhere without a negotiation.
What you should be able to see — without asking for it.
Visibility is the cheapest of the three controls and the one most often traded away, usually by accident: the reporting is good, so nobody notices that everything else requires an email.
- The cash position — the balance and what is already committed against it, not just the bank figure.
- What is outstanding — who owes you, since when, what was promised, and what promise was broken.
- What is waiting on you — a live list of items held pending your approval or your answer, so nothing stalls silently in a queue you cannot see.
- What is unresolved — every exception the provider is holding, with a plain-language reason, a named owner and a date. This list is the single most informative thing a provider can show you.
- The evidence behind a figure — the invoice, bill or statement that supports an entry, retrievable without asking someone to go and find it.
- The state of the period — whether a month is recorded, reconciled or formally closed, and as at what date.
- The correction history — what was changed, when and why. Records that can be quietly amended are not records.
A working rule: if seeing something requires an email and a wait, that is not visibility. It is a request queue with a friendly tone.
What must never happen without you.
Consent is the control that matters on the worst day. It should attach to the specific action, not to a general engagement — approval of a payment run in March is not approval of a payment in April.
- Money leaving the business. A provider can assemble a payment run, check it against bills and evidence, and present it. The release is yours. This separation costs nothing and removes an entire class of risk.
- Concessions. Discounts, credit notes, write-offs and goodwill adjustments each reduce what you are owed. They are commercial decisions with a profit consequence, and they belong to the business.
- Changed payment terms for a customer or a supplier, including informal extensions granted in the course of a follow-up conversation.
- Anything sent in your name. Statements, reminders, letters and messages to customers, suppliers or authorities carry your reputation. Preparation can be delegated; the authority to send should never be assumed.
- Changes to supplier bank details. Treat every one as suspect until verified by a call to a number you already held. This is the most common way small businesses lose money to fraud, and outsourcing adds a step where the check can be skipped by whoever is being polite.
- Any treatment that materially moves the reported position. A reclassification that changes profit, a large accrual, a judgement call on revenue timing — raised with you, not resolved quietly.
The difference between reading and doing.
Access is where consent is either enforced or quietly undone. An approval policy means very little if the person preparing the payment run also holds the credentials to release it.
- Named individuals, never a shared login. If two people use one account, nothing that happens in it can be attributed to either.
- Read access to banking, not transaction rights. Reconciliation needs statements and transaction data. It does not need the ability to move funds.
- Role-limited access in the accounting system. Ask which level each person on the provider’s team holds, and whether it can be narrowed without breaking the work.
- You hold the administrator rights. Whoever can add and remove users controls the system, whatever the contract says.
- Offboarding is a defined step. When someone leaves either side, their access ends within days — and someone can show you that it did.
- Approval trails that survive. Who approved what, and when, recorded somewhere neither party can quietly edit.
How a provider handles credentials, evidence and retention is a fair question to ask early rather than after signing. At Par sets out its own arrangements in security and data protection.
Ownership of the record, and a clean exit.
The final control is the one nobody wants to discuss during a good month, which is exactly why it should be settled before the engagement starts. Recovery is what makes the other two controls credible: a provider you can leave is a provider you can hold to a standard.
- The accounting file and its subscription sit in your company’s name, billed to you, with the provider added as a user. A file that lives inside a provider’s account is a file you negotiate for.
- Supporting evidence is stored where you can retrieve it — not solely in the provider’s internal system, and not only in an inbox belonging to someone who may leave.
- Corrections are recorded rather than overwritten. A history that can be silently rewritten cannot be handed over, because the next party has no way to know what changed.
- A written handover set. Books to a stated date, reconciliations, the open exception list, evidence, payroll records, and the working notes that explain anything unusual.
- A notice period that is symmetric, and a stated timeframe for handover. A provider comfortable with a clean exit has usually thought carefully about everything preceding it.
- Nothing essential held hostage by a tool the provider owns and you cannot access after the engagement ends.
Have the exit conversation while it is theoretical and nobody is annoyed. The answers are far more informative then.
Where At Par fits — and the limits.
At Par is built to be outsourced without handing over control. The recurring work moves — bookkeeping and month-end close, receivables follow-up, payroll, management reporting — while the position, the open items and the decisions waiting on you stay visible, with a qualified accountant (ACCA) accountable for the work.
If you already run QuickBooks or Xero, the file stays yours and stays in your name. The controls above are not unique to At Par, and they should not be — they are the standard worth demanding of anyone, including us. A related question, if the books are behind rather than merely outsourced: catch-up work comes first.
Asked by owners who do not want to hand over the keys.
How do I keep control if I outsource my bookkeeping? +
By specifying three things before signing. Sight: the cash position, outstanding invoices, unresolved items and anything waiting on approval are visible on demand rather than on request. Consent: money leaving, concessions, changed payment terms and anything sent in the company name require explicit approval of that specific action. Recovery: the accounting file, the subscription and the supporting evidence sit in the company name, with a defined handover if the engagement ends. Trust is not a control; those three are.
Is outsourcing bookkeeping risky for a small business? +
The risks are concrete and mostly preventable: payment authority granted alongside record-keeping access, shared logins that make actions unattributable, records held inside a provider’s own systems, and knowledge concentrating in one person who could leave. Each has a standard fix — read-only banking access, named individual logins, the file in the company’s name, and an exception list the owner reviews. Handled that way, outsourcing usually reduces risk compared with an owner doing the work at midnight.
Should a bookkeeping provider use my login, or their own? +
Their own, always, as named individual users added to accounts the business owns. Shared credentials destroy attribution: when two people use one login, no action can be traced to a person, approval trails become meaningless, and offboarding is impossible to verify. Individual access also makes narrowing permissions possible — read access to banking, restricted rights in the accounting system — which is the mechanism that keeps preparation and execution separate.
Who should own the accounting software subscription? +
The business, in the business’s own name, billed to the business, with the provider added as a user and the owner holding administrator rights. This single arrangement resolves most exit disputes before they start: the records, the history and the access remain with the company regardless of what happens to the relationship. Where a provider insists on holding the subscription, ask specifically what happens to the file, the attachments and the user access on the day the engagement ends.
How should a supplier bank-account change be verified when finance is outsourced? +
By a call to a phone number already held for that supplier — never a number supplied in the message requesting the change, and never by replying to the email. The verification should be recorded, and the change should require approval from someone other than whoever received the request. Outsourcing adds a handoff where a polite person may skip the check, so the step belongs in the process explicitly rather than in someone’s judgement.
What happens to my records if I change bookkeeping providers? +
That depends entirely on how the arrangement was set up, which is why it should be settled at the start. Where the accounting file is in the company’s name and evidence is stored somewhere the company can reach, the handover is administrative. Where the file, the attachments and the working papers live inside a provider’s systems, the exit becomes a negotiation at the worst possible moment. Ask for a written handover set: books to a stated date, reconciliations, open items, evidence and payroll records.
Can an outsourced provider make payments on my behalf? +
A provider can prepare a payment run — matched to bills, checked against evidence and presented for approval — without ever being able to release funds. That separation is the right default for owner-led businesses, and it costs nothing to implement. Granting payment authority is a distinct decision that should never follow automatically from granting bookkeeping access. At Par prepares payments and does not move client money; the client executes.
What should an outsourcing agreement include to protect financial control? +
Name the deliverables and the dates. Then name the controls: what the client can see and how; which actions require client approval before they happen; who holds which system access and how it is removed; where records and evidence are stored and in whose name; how corrections are recorded; the notice period; and exactly what is handed over on exit, in what format and how quickly. An agreement that lists services but not controls has described the good months only.
Does outsourcing bookkeeping mean losing visibility of cash? +
It should mean the opposite. An owner doing their own books usually holds the cash position in their head, which fails the moment they are busy. A properly run arrangement produces a stated position — the balance, what is already committed against it, and what is expected — available without asking anyone. Loss of visibility is a sign the arrangement was specified as a task list rather than as an outcome with a reporting cadence attached.
Ask us the awkward control questions. Before you ask anyone else.
Access, approvals, evidence, records ownership, exit. Bring the list above and put it to us first — the answers are the fastest way to judge any provider, including this one.
Prefer to reach us directly? Tell us a little and we'll come back with a time.
Ask about controlsWe use your details only to prepare for and hold this call. No spam, ever.
Reviewed by an ACCA on the At Par team · Last updated 29 July 2026 · The controls described here are a general standard, not an At Par feature list. See what we actually do.