Your Firm Has an AI Policy.
But What About Your Outsourcing Provider?

The outsourcing model is changing

The traditional economics of offshore outsourcing have been relatively straightforward. Accounting firms can access skilled professionals in countries such as India and the Philippines at a lower cost than employing equivalent resources in the UK.

AI is beginning to change that equation.

Tasks that previously required several hours of manual processing can increasingly be supported by AI. Document extraction, transaction categorisation, reconciliations, accounts preparation and elements of tax computation are all areas where AI-assisted workflows can deliver significant efficiencies.

For outsourcing providers, the commercial incentive is obvious. AI can help them process more work, reduce turnaround times and improve margins.

And there's no reason to assume offshore providers will be slower to adopt AI than UK practices. In fact, given the competitive nature of the outsourcing market, some may be moving considerably faster.

That isn't necessarily a problem. Responsible AI adoption could make outsourcing services more efficient, accurate and affordable.

The problem arises when AI is introduced into the delivery process without the knowledge or oversight of the accounting firm responsible for the client relationship.

The AI you don't know about

Consider a fairly ordinary scenario.

A UK accounting practice outsources the preparation of personal tax returns to an established offshore provider. The relationship has been in place for several years, the quality of work is good, and the firm is comfortable with the provider's processes.

The practice has also recently introduced its own AI policy. Employees have been trained on the risks of AI, particularly around client confidentiality and data protection. They understand that client information must not be entered into unapproved AI applications.

But what happens when the same client information reaches the outsourcing provider?

Perhaps the provider has introduced an AI-powered document processing system to extract information from tax records. Perhaps its employees are using a generative AI assistant to help interpret transactions or draft computations.

Or perhaps an individual employee, looking to complete a difficult task more quickly, has started using a publicly available AI tool without formal approval.

The UK practice may have no visibility of any of this.

It may not know which AI applications are being used, whether those applications have been assessed for security and confidentiality, where the information is being processed, or whether AI-generated outputs are being independently checked.

The completed tax return arrives back at the practice, apparently no different from the work it has received for years.

The firm has introduced controls to prevent its own employees from exposing client information to unapproved AI systems, while potentially allowing exactly the same thing to happen elsewhere in its supply chain.

This is the hidden AI governance gap.

It's also an extension of a problem already emerging within accounting practices themselves: shadow AI, where tools are introduced without formal approval or oversight.

The difference is that when AI is being used by an external provider, the firm may have even less visibility over what's happening.

Your AI policy shouldn't stop at your front door

Most discussions about responsible AI adoption in accountancy focus on what happens within the practice.

Which tools are employees allowed to use? What information can be entered into them? Who checks AI-generated work? How are staff trained?

These are all important questions.

But if a significant proportion of a practice's work is being completed by an external provider, the governance arrangements need to consider that relationship too.

The issue isn't specific to India, the Philippines or any other outsourcing destination. A UK-based outsourcing provider could present exactly the same risks.

Nor should we assume that offshore providers have inadequate controls. Many have invested heavily in information security, quality management and operational processes.

The question is whether those arrangements adequately address AI.

An outsourcing provider might hold ISO 27001 certification, for example, demonstrating that it has an independently assessed information security management system within the stated scope. That's valuable assurance.

But ISO 27001 certification does not, by itself, demonstrate that the provider has appropriately governed every AI system it uses, assessed the reliability of AI-generated accounting outputs or established suitable human oversight.

AI introduces additional considerations that firms need to understand.

This is one reason why the AIGAS AI Governance Framework addresses more than information security alone. It considers areas such as AI risk, data protection, accountability, operational controls and human oversight.

As AI becomes more deeply embedded in everyday accounting processes, these considerations become increasingly important, whether the work is carried out internally or externally.

Outsourcing the work doesn't outsource the responsibility

When an accounting practice engages an offshore provider, it doesn't simply hand over all responsibility for the work being performed.

The practice retains professional obligations to its clients, including confidentiality, competence and appropriate oversight of the services it delivers.

There are also data protection considerations.

Under UK GDPR, firms need to understand the roles and responsibilities of organisations processing personal data on their behalf, including relevant requirements around sub-processors, contractual safeguards and international transfers.

If an outsourcing provider introduces an external AI service that processes client personal data, that may create additional obligations depending on the circumstances.

An existing outsourcing agreement may cover confidentiality, data security and data processing, but does it explicitly address the use of AI?

Does the provider have to disclose the AI systems it uses? Can it introduce new AI applications without notifying the practice? Are there restrictions on entering client information into external tools? What assurance exists around the accuracy of AI-generated work?

These are questions worth asking before a problem occurs.

There is also a broader operational risk.

Traditional accounting errors are often isolated to individual transactions, calculations or members of staff.

AI can introduce a different type of risk. If an AI-enabled process consistently applies an incorrect tax treatment or misinterprets a particular category of expense, the same error could potentially be repeated across hundreds of client files.

Human review remains important, but simply stating that work has been reviewed is not necessarily sufficient. The review needs to be meaningful, with people who understand the work and are capable of identifying errors.

AI can make mistakes at scale, just as it can deliver efficiencies at scale.

Trust is important. Evidence is better.

None of this means accounting firms should stop outsourcing.

Quite the opposite.

AI has the potential to make outsourcing more effective, and providers that adopt it responsibly could deliver significant benefits to UK practices and their clients.

But as the technology becomes more widely used, firms will need greater confidence in how their outsourcing partners are managing it.

And that confidence needs to be based on more than a contractual statement that the provider takes data security seriously.

Accounting practices should be able to establish whether their outsourcing providers have appropriate AI governance arrangements in place.

That means understanding which AI systems are used, what information they process, how risks are assessed, what safeguards exist, and how human oversight is maintained.

It also means knowing what happens when something goes wrong.

If an AI system produces an incorrect output, how is that identified? If client information is exposed to an unauthorised service, how is the incident managed and reported? If the provider introduces a new AI application, how does the UK practice become aware of it?

These shouldn't be unreasonable questions for an accounting firm to ask of an organisation handling its clients' information.

But there is a practical challenge.

Most accounting practices aren't equipped to conduct detailed AI governance assessments of every outsourcing provider they engage.

Nor should they necessarily have to.

This is where independent assurance and certification could play an increasingly important role.

Is it time for AI governance certification of outsourcing providers?

We already recognise the value of independent assurance in areas such as information security and quality management.

As AI becomes embedded in outsourced accounting services, there is a strong argument for extending that principle to AI governance.

Outsourcing providers should be able to demonstrate that their AI systems are identified, appropriately assessed, subject to suitable controls and supported by meaningful human oversight.

Independent certification against a recognised AI governance standard could provide accounting firms with a more consistent way of evaluating those arrangements.

It would also create an opportunity for responsible outsourcing providers to differentiate themselves.

Rather than simply telling prospective clients that they use AI to improve efficiency, they could demonstrate that they use it within an independently assessed governance framework.

That is a much stronger proposition.

At AIGAS, we believe responsible AI adoption needs to extend beyond the systems a business operates directly. Organisations should also consider how AI is used by third parties processing information or delivering services on their behalf.

The AI Governance Assurance Standard (AIGAS) has been developed to help accounting firms establish practical, proportionate and demonstrable AI governance arrangements.

Through its Bronze and Silver assurance pathways, firms can move from establishing fundamental controls to providing stronger evidence that governance is operating effectively.

The same principles of visibility, accountability, risk management and independent assurance are highly relevant to the outsourcing sector.

Independent assurance cannot guarantee that an AI system will never make a mistake or that a security incident will never occur. But it can provide evidence that an organisation has established appropriate governance arrangements to identify, manage and monitor those risks.

For the outsourcing industry, that could become an increasingly important mark of trust.

And for UK accounting practices, it could provide a clearer basis for deciding which providers they are comfortable entrusting with their clients' work.

The next question every practice should be asking

AI is going to change the economics of outsourced accounting.

Some providers will use it to improve productivity and reduce costs. Others will develop entirely new AI-enabled services. And some UK practices may find that work previously sent overseas can be completed more efficiently using AI within their own businesses.

The outsourcing market will evolve.

But regardless of how the commercial model changes, the need for accountability will remain.

If your practice uses offshore services, it may be worth starting with a straightforward conversation with your provider.

Ask whether AI is being used in the delivery of your work. Ask which systems are involved, what client information they process and what controls are in place.

You may find that your provider has excellent arrangements and can demonstrate them.

Or you may discover that AI is being used in ways you hadn't previously considered.

Either way, it's a conversation worth having.

And if you're unsure how well your own practice is managing AI risks, the free AIGAS AI Governance Self-Assessment provides a practical starting point for identifying strengths and potential gaps.

Because the next time you review your firm's AI policy, there's one question you should be able to answer:

Does it cover only the people and systems working inside your practice, or does it also address the people and systems processing your clients' information on your behalf?

Your clients won't distinguish between an error made in your office and one made thousands of miles away.

And neither should your approach to AI governance.