Engagement Termination & Data Return Checklist

Why it matters

What goes wrong at engagement end

Offshore accounting engagement termination is the point where compliance most often breaks down. The work is ending, attention is shifting to the replacement vendor or in-house transition, and nobody wants to be the person extending the relationship to handle administrative close-out. The result: offshore staff keep access to systems for months after the engagement ended, client data sits on offshore workstations with no confirmed destruction, and the provider never formally confirms return or destruction.

None of this is catastrophic day-to-day. But under a regulatory inquiry, peer review, or client data breach later, the inability to confirm engagement termination was handled cleanly is a real problem – especially for CPA firms that attested to the end client that third-party providers would be bound by confidentiality obligations. The checklist below prevents the most common errors.

Timing: start working through this checklist 30 days before planned termination. Most items require 1–2 weeks of lead time to execute properly. Termination-day-only handoffs almost always leave items incomplete.

The checklist

Engagement termination checklist (30 days pre-termination through 90 days post)

30 days before termination

[ ] Written termination notice sent to the offshore provider per contract terms. Confirm receipt.
[ ] Termination date agreed and documented. Last day of production work, last day of access.
[ ] Data return expectations set in writing: format (native file formats vs PDF exports), timeline (typical: 10 business days after last production day), destruction vs retention decisions for any data the provider legally must retain.
[ ] Replacement plan identified: in-house staff, new vendor, or temporary gap with scope reduction. Share context with offshore provider so they can support smooth handoff where needed.
[ ] Knowledge transfer schedule set. Who from offshore staff will document what processes, by when, to whom.

2 weeks before termination

[ ] Access inventory compiled. List every system (QBO, Xero, Bill.com, bank portals, tax software, email forwarding, client portals, shared drives, password managers) where offshore staff have access.
[ ] Process documentation from offshore staff delivered to you. Chart of accounts explanations, close procedures, recurring journal entries, login inventories, anything an incoming replacement would need.
[ ] Final work product transfer begun. Workpapers, models, process docs delivered in native format.
[ ] Outstanding items list reconciled. Everything in-flight at termination clearly assigned to offshore or you.

Termination day (day 0)

[ ] All offshore staff access revoked within 4 business hours of last production completion. Verify in each system.
[ ] Password changes executed on any shared logins offshore staff used.
[ ] Email forwarding disabled and mailboxes closed (if offshore staff had @yourfirm.com addresses).
[ ] Client portal access for offshore staff users removed.
[ ] Bank and payment system access revoked (where offshore staff had any – view-only or otherwise).
[ ] VPN access revoked.
[ ] Remote desktop / hosted QBDT named user accounts terminated.

10 business days after termination

[ ] Data return confirmation received from offshore provider. Written certification of return or destruction.
[ ] Any retained data (legally required retention by the provider) documented: what data, why retained, duration, access controls.
[ ] Confirm deletion of any client data from offshore workstations, email accounts, and cloud storage accessible to departed staff.
[ ] Final invoice received and reconciled. Written confirmation of no further charges pending.
[ ] Outstanding items list updated. Any items completed post-termination clearly marked.

30 days post-termination

[ ] Access audit: log into each system and verify no departed offshore users still have access.
[ ] Vendor security team notified of engagement closure (if your org has one).
[ ] Client notification (if applicable): for CPA firms with client-level §1.150.040 disclosure, update clients on the change in third-party provider.

90 days post-termination

[ ] Retention requirements checked. If contract required provider to retain specific data for ongoing periods, verify retention is being maintained per contract.
[ ] Engagement file closure: all termination documentation (notices, data return certifications, access revocation audit, final invoice) filed with engagement records per your firm's document retention policy.

Common failure points

Where the checklist most often breaks down

Access revocation gets done on some systems but not others. The 3–5 obvious systems (QBO, email) get handled; lower-visibility systems (specific lender portals, tax document portals, legacy CRMs) get missed. The access inventory step is designed to prevent this.
Data return confirmation never gets received. Provider says data is destroyed; no written certification comes. Later, you can't prove to a regulator that destruction happened. Always get written certification.
Shared passwords never get changed. If offshore staff used shared bank logins, vendor portals, or password manager entries, those passwords should be rotated on termination. Often forgotten.
Knowledge transfer doesn't happen. Replacement vendor starts from zero because departing offshore staff's process documentation was never extracted. This costs 4–8 weeks of productivity on the replacement.
Email forwarding stays active for months. If offshore staff had @yourfirm.com addresses with forwarding, those forwards can still route sensitive emails externally even after the engagement ends. Disable same day as termination.

Disclaimer: Not legal advice. Termination requirements depend on engagement contract terms, applicable law, and client-level obligations. Consult qualified counsel for specific situations.

Engagement termination & data return checklist.

What goes wrong at engagement end

Engagement termination checklist (30 days pre-termination through 90 days post)

30 days before termination

2 weeks before termination

Termination day (day 0)

10 business days after termination

30 days post-termination

90 days post-termination

Where the checklist most often breaks down

Related compliance resources

Compliance layer sorted – ready to scope the engagement.

Engagement termination & data return checklist.

What goes wrong at engagement end

Engagement termination checklist (30 days pre-termination through 90 days post)

30 days before termination

2 weeks before termination

Termination day (day 0)

10 business days after termination

30 days post-termination

90 days post-termination

Where the checklist most often breaks down

Related compliance resources

All Compliance Forms

Security & Infrastructure

For CPA Firms

Compliance layer sorted – ready to scope the engagement.