Accounts Payable Outsourcing Providers: 10 Questions to Ask Before Signing a Contract
Before signing with an accounts payable outsourcing provider, get clear written answers to ten questions: what's in scope and how changes are priced, when prices can rise, which service levels apply and what happens when they're missed, who does the work, where your data goes, what assurance you'll receive, how incidents are reported, who bears liability for losses, what you get at exit, and how renewal and termination work.
Key takeaways
- Sales proposals describe intentions; the contract decides what you can actually enforce. Settle the details before signing, not after go-live.
- The most common post-signing disputes involve scope changes, price increases, and missed service levels without any remedy.
- Data location, staff changes, subcontracting, and incident notification should all be written into the contract.
- Make sure you can leave: a reasonable notice period, no surprise auto-renewal, and transition assistance with your documentation handed back.
- Have an attorney review the final agreement; this guide covers commercial questions, not legal advice.
Why the contract stage matters
By the time you reach a contract, you've usually picked a provider, seen a demo, and heard a confident sales pitch. It's tempting to sign the standard agreement and get started. But AP outsourcing puts a third party in the middle of your vendor payments, so the details matter: what happens when invoice volume doubles, when a key team member leaves, when a payment goes wrong, or when you want to switch providers in two years.
Most AP outsourcing agreements come in three parts: a master services agreement (MSA) with the legal terms, a statement of work (SOW) describing the services, and a service-level schedule. The ten questions below map to those documents. Once the contract is signed, the CFO's guide to transitioning to an outsourced AP model covers what comes next, from onboarding to go-live.
The 10 questions to ask before signing
1. What exactly is in scope, and how are changes handled?
Why it matters: A vague scope is the most common source of disputes. If the SOW says "accounts payable processing," you and the provider may have very different ideas about whether vendor onboarding, statement reconciliation, month-end accruals, or 1099 preparation are included.
What good looks like: A SOW that lists each activity, the systems and entities covered, the invoice channels, and what's excluded, plus a written change-control process that says how new work is requested, priced, and approved.
Red flag: Scope described in one or two broad sentences, or no change-control process at all.
2. How is pricing calculated, and when can it go up?
Why it matters: The starting price is only part of the cost. Annual price escalators, volume bands, minimum fees, and add-on charges can change what you actually pay over a multi-year term.
What good looks like: A clear pricing model (per invoice, per dedicated FTE, monthly tier, or hourly), a full schedule of add-on fees, a defined cap on annual increases, and an explanation of what happens if volume rises or falls outside your band.
Red flag: Uncapped annual increases, minimum monthly fees that don't match your volume, or "other fees as applicable" language with no schedule.
3. What service levels are you committing to, and what happens if you miss them?
Why it matters: Service levels without remedies are just aspirations. You need to know how performance is measured and what you get if it falls short.
What good looks like: Specific, measurable service levels, such as invoice entry within a set number of business days, exceptions flagged within a set time, payment runs prepared by an agreed cut-off, and month-end deliverables by a fixed workday. The contract should also say how performance is reported monthly and what remedies apply, such as service credits, a corrective action plan, and the right to terminate after repeated failures.
Red flag: Service levels stated as "best efforts," measured only by the provider, or with no consequences attached.
4. Who will do the work, and can they change without notice?
Why it matters: Much of the value in AP outsourcing comes from a team that knows your vendors, approvers, and coding rules. Frequent rotation or quietly handing your work to a subcontractor erodes that.
What good looks like: Named primary and backup staff, a commitment to notify you of changes to key personnel, documented handovers when someone leaves, and a requirement for your written consent before any part of the work is subcontracted or moved to a different delivery location.
Red flag: "Resources will be allocated as needed," or a contract silent on subcontracting.
5. Where will our data be processed and stored, and who can access it?
Why it matters: Your AP data includes vendor bank details, tax IDs, and payment history. You need to know which countries it's accessed from, whether it ever leaves your systems, and how access is controlled.
What good looks like: Contract language specifying delivery locations, a commitment that work happens inside your systems or a secure virtual desktop, restrictions on downloading or storing data locally, named logins with multi-factor authentication, and prompt removal of access when staff leave. Our 25-point offshore accounting security checklist lists the specific controls to ask about.
Red flag: No mention of data location, shared logins, or a provider that asks for your bank portal credentials.
6. What independent assurance will you provide, and how often?
Why it matters: Your auditors may need evidence that the provider's controls work, and you need it too. A SOC 1 report, which the AICPA describes as an examination of a service organization's controls relevant to its clients' internal control over financial reporting, is the standard evidence for AP. A SOC 2 report covers security and data handling.
What good looks like: A contractual commitment to share current SOC reports annually, a bridge letter covering any gap between the report period and today, the right to send a security questionnaire each year, and prompt notice if a report includes exceptions. Also ask which controls the report expects you to run on your side, so you can make sure you do.
Red flag: No independent report and no willingness to commit to providing one, or a contract that limits your ability to ask security questions.
7. How fast will you tell us about a security incident or error?
Why it matters: If a provider's systems are compromised, a staff member's account is misused, or a payment file contains errors, every hour counts. Delayed notice can turn a fixable problem into a loss.
What good looks like: A defined notification window for security incidents and material errors, a named contact on each side, cooperation obligations during investigation, and a commitment to share root-cause findings. With Nacha's fraud-monitoring rules now requiring all non-consumer ACH originators to have risk-based processes for spotting fraudulent payments, quick notice from your provider also supports your own compliance.
Red flag: "Commercially reasonable" notice with no timeframe, or no incident clause at all.
8. Who is liable if an error or fraud causes a loss?
Why it matters: Most provider contracts cap liability, often at a multiple of fees paid over a recent period. That cap may be far smaller than a single misdirected payment. You need to understand where the risk sits.
What good looks like: A liability cap you've consciously accepted, with any carve-outs for data breaches, confidentiality violations, or gross negligence clearly stated; insurance the provider carries, such as professional liability and cyber coverage, with evidence on request; and a process for correcting errors at the provider's cost. Just as important is control design: if your team releases every payment and approves every bank change, fewer losses can arise from the provider's side in the first place.
Red flag: A very low cap with no carve-outs, no insurance, or language that excludes liability for errors altogether. This is the question where an attorney's review matters most.
9. Who owns the documentation, and what do we get when we leave?
Why it matters: During onboarding, the provider documents your coding rules, approval matrix, vendor procedures, and workflows. That knowledge is valuable, and you want to keep it if you switch providers or bring AP back in-house.
What good looks like: Clear language that your data and the documentation of your processes belong to you, a defined transition-assistance period at agreed rates, return or certified destruction of your data at exit, and removal of all provider access on the last day.
Red flag: Process documentation described as the provider's proprietary methodology, or fees to return your files.
10. What are the term, renewal, and termination terms?
Why it matters: A long initial term with automatic renewal and a narrow cancellation window can lock you in long after the relationship stops working.
What good looks like: An initial term that matches your risk appetite, ideally after a short paid pilot; renewal that requires notice or confirmation; termination for cause with a cure period; and, where you can get it, termination for convenience with reasonable notice. Starting with a pilot is the simplest way to avoid signing a long contract with the wrong provider; here's how a 40-hour pilot works.
Red flag: Multi-year lock-in with automatic renewal and a short cancellation window, or early termination fees equal to the remaining contract value.
Quick-reference table: questions, clauses, and red flags
| # | Question | Where it lives in the contract | Red flag |
|---|---|---|---|
| 1 | What's in scope and how are changes handled? | SOW and change-control clause | One-line scope, no change process |
| 2 | How is pricing calculated and when can it rise? | Fee schedule | Uncapped increases, undefined add-ons |
| 3 | What service levels apply, with what remedies? | Service-level schedule | "Best efforts," no remedies |
| 4 | Who does the work, and can it change? | Personnel and subcontracting clauses | No notice of changes, silent on subcontracting |
| 5 | Where is data processed and who can access it? | Data protection and security clauses | No data location, shared logins |
| 6 | What independent assurance will you provide? | Audit and assurance clause | No SOC report commitment |
| 7 | How fast will you report incidents? | Incident notification clause | No defined timeframe |
| 8 | Who is liable for losses? | Limitation of liability, insurance, indemnity | Very low cap, no carve-outs |
| 9 | What do we get when we leave? | Ownership, exit, and transition clauses | Documentation held as provider property |
| 10 | What are the term and termination terms? | Term and termination clauses | Long lock-in, auto-renewal |
A pre-signing checklist
Before you sign, confirm that you have:
- Completed a paid pilot or parallel run on real invoices
- Spoken to at least two reference clients of similar size and industry
- Reviewed the provider's latest SOC report, or documented why you're accepting the alternative assurance offered
- Agreed a written RACI showing that your team keeps invoice approval, vendor bank-change approval, and payment release
- Mapped the controls the provider expects you to run into your own control matrix
- Had an attorney review the MSA, especially liability, data protection, and termination terms
If every item is ticked, you're signing a contract you understand rather than one you'll be renegotiating in six months. For what a well-scoped engagement looks like in practice, see our outsourced accounts payable services.
Frequently asked questions
What should be included in an accounts payable outsourcing contract?
An AP outsourcing contract should include a detailed scope of work, a full fee schedule with caps on increases, measurable service levels with remedies, personnel and subcontracting terms, data location and security commitments, SOC report rights, incident notification timelines, liability and insurance terms, and exit and transition provisions.
What service levels should an AP outsourcing contract include?
Common service levels cover invoice entry turnaround, exception flagging time, payment run preparation deadlines, month-end deliverable dates, and vendor inquiry response times. Each should be measurable, reported monthly, and backed by a remedy if missed.
How long should an AP outsourcing contract be?
There's no standard length, but many businesses start with a short paid pilot, then sign an initial term with clear renewal and termination rights. Avoid long automatic renewals with narrow cancellation windows.
Should an AP outsourcing provider carry insurance?
Yes. Ask for evidence of professional liability and cyber insurance, and understand how the coverage relates to the contract's liability cap. An attorney or insurance advisor can help you judge whether the limits are adequate.
What happens to my data if I end an AP outsourcing contract?
A good contract requires the provider to return your data and process documentation, provide transition assistance for a defined period, remove all system access, and certify destruction of any copies it holds.
This article is general information, not legal advice. Contract terms, liability, and data-protection provisions should be reviewed by a qualified attorney before you sign.
Reviewing an AP outsourcing agreement? We're happy to walk you through how we handle each of these ten questions in our own engagements, in writing, before you commit. Talk to our team.