Outsourced business services

Most distributors outsource some back-office work: bookkeeping, payroll, IT support, hosting, collections, sometimes customer service or warehouse staffing. That is usually sensible, because a specialist can do routine work better and cheaper than a small in-house team. What you cannot outsource is accountability. The provider does the work, but the decisions, the approvals, the knowledge of how your business runs and the legal responsibility mostly stay with you.

Keep in house or outsource, by function

The table shows, for each function, the work distributors commonly hand over and the part to keep.

Function	Commonly outsourced	Keep in house
Accounting and bookkeeping	Transaction entry, reconciliations, month-end journal preparation, tax filings	Approving payments and journals, owning the chart of accounts, reviewing the close, pricing and margin decisions
Payroll	Calculating pay, tax deposits, filings, year-end forms	Approving hours and pay changes, adding and removing employees, checking deposits were made
HR through a PEO	Benefits, payroll, compliance administration	Hiring, firing, managing people, workplace safety on your site
Managed IT (MSP)	Help desk, device management, patching, backups, network	Owning admin accounts, deciding who gets access, approving changes to the ERP
Security (MSSP)	Monitoring, alert triage, vulnerability scanning	Deciding response to incidents, accepting risks, owning the security program
Cloud hosting	Servers, storage, database platform, uptime	Owning your data, backups you can restore, access decisions
Collections	Chasing seriously overdue accounts	Credit decisions, disputes, customer relationships you want to keep
Credit insurance and factoring	Insuring or funding receivables	Credit policy, customer selection, dispute resolution
Customer service (BPO)	Order status, tracking, routine questions, overflow calls	Pricing exceptions, technical product support, key accounts
Staffing	Warehouse and seasonal labor, temporary clerical help	Supervision, training on your processes, safety

Accounting and bookkeeping

An outsourced bookkeeper or accounting firm can run most of the transaction work, and for a small distributor it is often better than one overloaded in-house clerk.

Keep first party	Why
Payment approval and bank signatory rights	A provider that can both enter and pay a bill has no check on it
Review of the monthly close and key reconciliations	You catch errors that affect pricing, rebates and inventory value
Knowledge of how costs, rebates and freight flow through your ERP	That knowledge is how you run the business, and it walks out with the provider

Separate the duties. The provider enters and you approve. The provider reconciles the bank and someone else has signing authority. In the ERP, give the provider roles that cannot both create a vendor and pay it. ERP security roles and access reviews covers how to set that up.

To keep the exit open, keep the books in your ERP and your accounting system under your own license, not the provider's.

Payroll and professional employer organizations

A payroll service calculates pay, files returns and deposits taxes for you. A professional employer organization (PEO) goes further and acts as a co-employer, handling payroll, benefits and HR administration.

The IRS states that an employer that outsources payroll remains ultimately responsible for depositing and paying federal employment taxes. If the provider fails to pay, the IRS may assess penalties and interest against the employer (IRS, Outsourcing Payroll Duties, retrieved 2026-09-28). The IRS suggests enrolling in its electronic payment system to see your own deposits.

The exception is a certified PEO. Congress had the IRS create a voluntary certification program for PEOs in 2014. For work site employees, a certified PEO is generally solely liable for the employment taxes on wages it pays (IRS CPEO pages, retrieved 2026-09-28). An uncertified PEO does not carry that status, so your exposure depends on the contract and the tax rules. The IRS publishes a list of certified PEOs.

Whoever runs payroll, keep these in house.

Keep first party	Why
Approving hours, rates and pay changes	Payroll fraud usually starts with a changed rate or a ghost employee
Checking that tax deposits were made	You are liable if they were not, unless the certified PEO rules apply
Adding and removing employees	Access and pay should end on the last day

Managed IT and managed security

A managed service provider (MSP) runs day-to-day IT: help desk, devices, patching, backups. A managed security service provider (MSSP) watches for attacks and triages alerts. Both usually hold powerful remote access to every system you have, which makes them an attractive target.

CISA guidance for MSP customers (2021, retrieved 2026-09-28) recommends that customers keep direct access to the logs and security data for systems the MSP manages. It also recommends requiring records of who accessed what and when, and managing the relationship as a shared risk.

Keep first party	Why
Ownership of admin accounts, domains, licenses and cloud tenants	If the MSP relationship ends badly, you need the keys
Decisions on who gets access and to what	The MSP carries out access changes, and you approve them
Incident decisions	Whether to shut systems down, notify customers or pay anyone is a business decision
ERP change approval	The MSP patches servers, but your ERP owner approves ERP updates
Copies of backups you can restore, and a tested restore	A backup only the MSP can restore is a dependency, not a backup

If you handle customer financial information and fall under the FTC Safeguards Rule, the rule has you keep responsibility for compliance when a service provider does the work. It also has you oversee your service providers (16 CFR 314.4, retrieved 2026-09-28). See security and data sharing with vendors.

Cloud hosting

Hosting your ERP with a cloud provider or the publisher moves servers and uptime off your plate. It does not move data ownership. Keep a contract right to a full export of your data in a usable format, and your own copy of backups on a schedule you choose. Keep admin access to the application too, even if the provider manages the infrastructure.

Collections

A collection agency chases seriously overdue accounts, usually for a percentage of what it collects. For B2B distributors, the relevant law is narrower than many assume. The federal Fair Debt Collection Practices Act defines debt as consumer obligations for personal, family or household purposes (FTC, FDCPA text, retrieved 2026-09-28). It generally does not cover collecting from business customers. State laws and the agency contract still apply, and a heavy-handed agency still damages a customer relationship you may want back.

Keep first party	Why
The decision to send an account to collections	It usually ends the relationship
Dispute resolution	Many overdue invoices are really pricing, shipping or return disputes
Customer communication for accounts you want to keep	An agency speaks for your brand

Credit insurance and factoring

Trade credit insurance pays a share of an insured receivable if a customer fails to pay. Factoring sells receivables to a factor for cash now, at a discount. With recourse factoring, you still bear the loss if the customer does not pay. Both change who carries credit risk, but both also impose rules: approved limits per customer, reporting deadlines and in factoring, sometimes notice to your customers to pay the factor.

With invented numbers, suppose a distributor factors a $100,000 batch of invoices with an advance rate of 85% and a fee of 2% per 30 days. It receives $85,000 now. If customers pay in 45 days, the fee is about 3%, or $3,000, and the distributor receives the remaining $12,000 when the invoices are paid.

Keep credit policy and customer selection first party. A credit insurer's limit is useful information to weigh alongside your own judgment on a customer you know.

Customer service and BPO

A business process outsourcer (BPO) can handle order status calls, overflow and after-hours service. It works best for routine, scripted questions. Keep technical product questions, pricing exceptions and key accounts in house, because that is where distributors earn loyalty. Give the BPO read-only ERP access to order status where possible, rather than rights to change orders.

Staffing

Temporary and seasonal staff from an agency fill warehouse and clerical gaps. The agency usually handles payroll and employment administration, but site safety, training and supervision remain your responsibility. Give each temporary worker a named ERP and scanner login, and end it on the last day.

Not legal advice

Payroll tax liability, co-employment, debt collection law, factoring agreements and data protection duties vary by state and contract. Involve counsel and your accountant before you sign an outsourcing agreement for any of these.

Checks that apply to every outsourced service

• Decisions and approvals stay with a named person on your side. The provider recommends and executes.
• No provider controls a transaction end to end. Split creating, approving and paying.
• Least-privilege access with named accounts. Reviewed quarterly and removed on exit.
• Your data stays in systems you own or can export from. You have tested the export yourself.
• Documentation of how the work is done, in your hands. A new provider or employee can pick it up.
• Performance measured from your own data. Days to close, deposit confirmations, ticket times, collection rates.
• Security evidence. A SOC report or completed questionnaire, insurance certificates, incident notice terms.
• An exit plan. Notice period, data return format, transition help and its cost.

Questions to ask a service provider

1. What will you do, and what will you expect us to approve?
2. What access do you need in our ERP, bank and other systems, and why?
3. How will we know the work was done correctly, from our own records?
4. Who else works on our account, including your subcontractors and offshore teams?
5. What happens to our data and documents when we leave, and how fast?
6. What insurance do you carry, and what is your liability cap?

Red flags

Each of these means accountability has moved to the provider.

• The provider asks for admin or banking rights "to make things easier".
• You cannot see your own tax deposits, backups or logs.
• Only the provider knows how a process works.
• Accounts, domains or licenses are registered in the provider's name.
• You cannot tie the provider's reports back to your ERP.
• There are no written exit terms.

Name an owner for each service

List every outsourced service you use today. For each, write the name of the person on your side who approves its work and could explain it to an auditor. Any line without a name is a service nobody on your side answers for.