# Outsourced business services

> What distributors commonly outsource, from accounting and payroll to IT, hosting, collections and staffing, and what must stay in house for each service.

Source: https://docs.lumina-erp.com/first-and-third-parties/outsourced-business-services/

**In short.** You can outsource the work of a function but not your accountability for it. The IRS still holds you responsible for payroll taxes a provider fails to deposit, and security rules still hold you responsible for data a provider mishandles. For each service, keep decisions, approvals and knowledge in house, separate duties so no provider controls a transaction end to end, grant only the access needed and plan the exit before you start.

Most distributors outsource some back-office work: bookkeeping, payroll, IT support, hosting, collections, sometimes customer service or warehouse staffing. That is usually sensible, because a specialist can do routine work better and cheaper than a small in-house team. What you cannot outsource is accountability. The provider does the work, but the decisions, the approvals, the knowledge of how your business runs and the legal responsibility mostly stay with you.

## Keep in house or outsource, by function

The table shows, for each function, the work distributors commonly hand over and the part to keep.

| Function | Commonly outsourced | Keep in house |
|---|---|---|
| Accounting and bookkeeping | Transaction entry, reconciliations, month-end journal preparation, tax filings | Approving payments and journals, owning the chart of accounts, reviewing the close, pricing and margin decisions |
| Payroll | Calculating pay, tax deposits, filings, year-end forms | Approving hours and pay changes, adding and removing employees, checking deposits were made |
| HR through a PEO | Benefits, payroll, compliance administration | Hiring, firing, managing people, workplace safety on your site |
| Managed IT (MSP) | Help desk, device management, patching, backups, network | Owning admin accounts, deciding who gets access, approving changes to the ERP |
| Security (MSSP) | Monitoring, alert triage, vulnerability scanning | Deciding response to incidents, accepting risks, owning the security program |
| Cloud hosting | Servers, storage, database platform, uptime | Owning your data, backups you can restore, access decisions |
| Collections | Chasing seriously overdue accounts | Credit decisions, disputes, customer relationships you want to keep |
| Credit insurance and factoring | Insuring or funding receivables | Credit policy, customer selection, dispute resolution |
| Customer service (BPO) | Order status, tracking, routine questions, overflow calls | Pricing exceptions, technical product support, key accounts |
| Staffing | Warehouse and seasonal labor, temporary clerical help | Supervision, training on your processes, safety |

## Accounting and bookkeeping

An outsourced bookkeeper or accounting firm can run most of the transaction work, and for a small distributor it is often better than one overloaded in-house clerk.

| Keep first party | Why |
|---|---|
| Payment approval and bank signatory rights | A provider that can both enter and pay a bill has no check on it |
| Review of the monthly close and key reconciliations | You catch errors that affect pricing, rebates and inventory value |
| Knowledge of how costs, rebates and freight flow through your ERP | That knowledge is how you run the business, and it walks out with the provider |

Separate the duties. The provider enters and you approve. The provider reconciles the bank and someone else has signing authority. In the ERP, give the provider roles that cannot both create a vendor and pay it. [ERP security roles and access reviews](/erp-projects/security-roles-and-access-reviews/) covers how to set that up.

To keep the exit open, keep the books in your ERP and your accounting system under your own license, not the provider's.

## Payroll and professional employer organizations

A payroll service calculates pay, files returns and deposits taxes for you. A professional employer organization (PEO) goes further and acts as a co-employer, handling payroll, benefits and HR administration.

The IRS states that an employer that outsources payroll remains ultimately responsible for depositing and paying federal employment taxes. If the provider fails to pay, the IRS may assess penalties and interest against the employer (IRS, Outsourcing Payroll Duties, retrieved 2026-09-28). The IRS suggests enrolling in its electronic payment system to see your own deposits.

The exception is a certified PEO. Congress had the IRS create a voluntary certification program for PEOs in 2014. For work site employees, a certified PEO is generally solely liable for the employment taxes on wages it pays (IRS CPEO pages, retrieved 2026-09-28). An uncertified PEO does not carry that status, so your exposure depends on the contract and the tax rules. The IRS publishes a list of certified PEOs.

Whoever runs payroll, keep these in house.

| Keep first party | Why |
|---|---|
| Approving hours, rates and pay changes | Payroll fraud usually starts with a changed rate or a ghost employee |
| Checking that tax deposits were made | You are liable if they were not, unless the certified PEO rules apply |
| Adding and removing employees | Access and pay should end on the last day |

## Managed IT and managed security

A managed service provider (MSP) runs day-to-day IT: help desk, devices, patching, backups. A managed security service provider (MSSP) watches for attacks and triages alerts. Both usually hold powerful remote access to every system you have, which makes them an attractive target.

CISA guidance for MSP customers (2021, retrieved 2026-09-28) recommends that customers keep direct access to the logs and security data for systems the MSP manages. It also recommends requiring records of who accessed what and when, and managing the relationship as a shared risk.

| Keep first party | Why |
|---|---|
| Ownership of admin accounts, domains, licenses and cloud tenants | If the MSP relationship ends badly, you need the keys |
| Decisions on who gets access and to what | The MSP carries out access changes, and you approve them |
| Incident decisions | Whether to shut systems down, notify customers or pay anyone is a business decision |
| ERP change approval | The MSP patches servers, but your ERP owner approves ERP updates |
| Copies of backups you can restore, and a tested restore | A backup only the MSP can restore is a dependency, not a backup |

If you handle customer financial information and fall under the FTC Safeguards Rule, the rule has you keep responsibility for compliance when a service provider does the work. It also has you oversee your service providers (16 CFR 314.4, retrieved 2026-09-28). See [security and data sharing with vendors](/first-and-third-parties/security-and-data-sharing-with-vendors/).

## Cloud hosting

Hosting your ERP with a cloud provider or the publisher moves servers and uptime off your plate. It does not move data ownership. Keep a contract right to a full export of your data in a usable format, and your own copy of backups on a schedule you choose. Keep admin access to the application too, even if the provider manages the infrastructure.

## Collections

A collection agency chases seriously overdue accounts, usually for a percentage of what it collects. For B2B distributors, the relevant law is narrower than many assume. The federal Fair Debt Collection Practices Act defines debt as consumer obligations for personal, family or household purposes (FTC, FDCPA text, retrieved 2026-09-28). It generally does not cover collecting from business customers. State laws and the agency contract still apply, and a heavy-handed agency still damages a customer relationship you may want back.

| Keep first party | Why |
|---|---|
| The decision to send an account to collections | It usually ends the relationship |
| Dispute resolution | Many overdue invoices are really pricing, shipping or return disputes |
| Customer communication for accounts you want to keep | An agency speaks for your brand |

## Credit insurance and factoring

Trade credit insurance pays a share of an insured receivable if a customer fails to pay. Factoring sells receivables to a factor for cash now, at a discount. With recourse factoring, you still bear the loss if the customer does not pay. Both change who carries credit risk, but both also impose rules: approved limits per customer, reporting deadlines and in factoring, sometimes notice to your customers to pay the factor.

With invented numbers, suppose a distributor factors a $100,000 batch of invoices with an advance rate of 85% and a fee of 2% per 30 days. It receives $85,000 now. If customers pay in 45 days, the fee is about 3%, or $3,000, and the distributor receives the remaining $12,000 when the invoices are paid.

Keep credit policy and customer selection first party. A credit insurer's limit is useful information to weigh alongside your own judgment on a customer you know.

## Customer service and BPO

A business process outsourcer (BPO) can handle order status calls, overflow and after-hours service. It works best for routine, scripted questions. Keep technical product questions, pricing exceptions and key accounts in house, because that is where distributors earn loyalty. Give the BPO read-only ERP access to order status where possible, rather than rights to change orders.

## Staffing

Temporary and seasonal staff from an agency fill warehouse and clerical gaps. The agency usually handles payroll and employment administration, but site safety, training and supervision remain your responsibility. Give each temporary worker a named ERP and scanner login, and end it on the last day.

:::caution[Not legal advice]
Payroll tax liability, co-employment, debt collection law, factoring agreements and data protection duties vary by state and contract. Involve counsel and your accountant before you sign an outsourcing agreement for any of these.
:::

## Checks that apply to every outsourced service

- [ ] **Decisions and approvals stay with a named person on your side.** The provider recommends and executes.
- [ ] **No provider controls a transaction end to end.** Split creating, approving and paying.
- [ ] **Least-privilege access with named accounts.** Reviewed quarterly and removed on exit.
- [ ] **Your data stays in systems you own or can export from.** You have tested the export yourself.
- [ ] **Documentation of how the work is done, in your hands.** A new provider or employee can pick it up.
- [ ] **Performance measured from your own data.** Days to close, deposit confirmations, ticket times, collection rates.
- [ ] **Security evidence.** A SOC report or completed questionnaire, insurance certificates, incident notice terms.
- [ ] **An exit plan.** Notice period, data return format, transition help and its cost.

## Questions to ask a service provider

1. What will you do, and what will you expect us to approve?
2. What access do you need in our ERP, bank and other systems, and why?
3. How will we know the work was done correctly, from our own records?
4. Who else works on our account, including your subcontractors and offshore teams?
5. What happens to our data and documents when we leave, and how fast?
6. What insurance do you carry, and what is your liability cap?

## Red flags

Each of these means accountability has moved to the provider.

- The provider asks for admin or banking rights "to make things easier".
- You cannot see your own tax deposits, backups or logs.
- Only the provider knows how a process works.
- Accounts, domains or licenses are registered in the provider's name.
- You cannot tie the provider's reports back to your ERP.
- There are no written exit terms.

## Name an owner for each service

List every outsourced service you use today. For each, write the name of the person on your side who approves its work and could explain it to an auditor. Any line without a name is a service nobody on your side answers for.

## Sources

- [Outsourcing payroll duties (IRS)](https://www.irs.gov/businesses/small-businesses-self-employed/outsourcing-payroll-duties)
- [CPEO customers: what you need to know (IRS)](https://www.irs.gov/tax-professionals/cpeo-customers-what-you-need-to-know)
- [Certified professional employer organization (IRS)](https://www.irs.gov/tax-professionals/certified-professional-employer-organization)
- [Fair Debt Collection Practices Act text (FTC)](https://www.ftc.gov/legal-library/browse/rules/fair-debt-collection-practices-act-text)
- [CISA Insights: Risk Considerations for Managed Service Provider Customers (CISA, 2021)](https://www.cisa.gov/news-events/alerts/2021/09/03/cisa-insights-risk-considerations-managed-service-provider-customers)
- [16 CFR 314.4, Standards for Safeguarding Customer Information, elements (eCFR)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4)

---

Epicor, Prophet 21, P21 and DynaChange are trademarks or registered trademarks of Epicor Software Corporation registered in the United States and other countries. Kinetic is a trademark of Epicor Software Corporation. Lumina ERP is an independent consultancy and is not affiliated with, sponsored by or endorsed by Epicor.