Accounting services operations: one catalogue, one deadline register, traceable work

An accounting service is operationally sound when a competent colleague can trace each piece of work from agreed scope and source records to review, client authority, submitted output and retained evidence. The same system must expose exceptions, survive an absence and provide a controlled route when software or a supplier fails.

This 2027 guide is based on official material checked on 5 September 2026. Requirements depend on the service, entity, tax, professional membership, customer and facts. Recheck deadlines and guidance at the point of work, and obtain qualified accounting, tax, legal, AML, data-protection and security input where the practice needs it.

What to take away

One service catalogue stops sales offering work the practice cannot deliver.
A single deadline register with edit history shows who did what and when.
Never close a deadline because a button was pressed; keep submitted version and acknowledgement.
Client acceptance and engagement acceptance are separate checks, repeated when facts change.
Review depth should match consequence, not follow a fixed rule for every entry.

Build one service catalogue

List every service the practice sells or delivers. Separate bookkeeping, payroll, accounts preparation, management reporting, tax compliance, tax advice, company filings, statutory audit, outsourced finance, software and referral activity. Similar names can hide different responsibilities.

For each service, create a record containing:

eligible customer and entity types;
included outputs and periods;
excluded and referred work;
applicable rules and professional standards;
required competence and review;
data and software dependencies;
client inputs and cut-off dates;
fee mechanism and change triggers;
complaint, incident and exit routes;
service owner and approval date.

Prevent the website and sales team from offering work that is absent from the catalogue. New activity should pass legal, regulatory, competence, capacity, insurance, technology and pricing review before a proposal goes out.

A catalogue can sit in a controlled spreadsheet or in practice-management software such as Xero Practice Manager, QuickBooks Online Accountant, Sage or IRIS, provided it is versioned and kept to limited access. Where the service is described on the practice's website or in a professional-body directory — the ICAEW, ACCA or AAT find-an-accountant registers, for example — the entry must match the catalogue rather than the sales conversation.

Accept a client and an assignment separately

A known client can still request unfamiliar or high-risk work. Run entity and engagement checks at the start, then reassess when ownership, activity, location, tax position, leadership or service changes.

Depending on the facts, acceptance may cover identity, beneficial ownership, AML risk, conflicts, independence, authority, sanctions, competence, capacity, professional clearance, information risk and ability to pay. State the evidence, reviewer, decision and next review date.

HMRC's guidance on money laundering supervision for accountancy service providers describes the breadth of services that can fall within its accountancy-service-provider definition and the relationship with professional-body supervision. Virtual or automated delivery does not remove the need to assess the position.

Do not treat supervision as a quality award, or assume that membership covers every legal entity. Record the supervisor for the relevant practice and activity. Escalate uncertain boundaries before accepting work.

The Money Laundering Regulations 2017 define the accountancy service provider and set the customer due diligence, ongoing monitoring and record-keeping duties, while the Proceeds of Crime Act 2002 governs reporting through a nominated officer and suspicious activity reports. Most practices in England are supervised for this by a professional body supervisor — ICAEW, ACCA, AAT or CIOT — or by HMRC as money laundering supervisor for accountancy service providers. Keep the supervisory registration, the nominated officer and the due diligence records in the same controlled register, and confirm which supervisor covers each legal entity.

The engagement should identify parties, service, period, client records, practice work, decisions, review, submission, timing, fee, data handling, communication, complaints and termination. Give changes a version and durable approval. Keep one master record for the legal entity, services, periods, deadlines and engagement version.

Maintain a defensible authority record

Distinguish contractual authority, HMRC client authorisation, tax-service enrolment, Companies House authentication and internal approval. One credential does not establish the rest. Map which legal entity and user account may perform each action.

HMRC's standard for agents states that agents must never ask clients for their personal HMRC online sign-in details. It expects use of authorised agent services within its scope. Design the workflow so staff do not need shared client credentials to meet a deadline.

Review authority after personnel or client-contact changes. Remove leavers, revise deputies and test emergency access. An access list should reveal the business reason for each privilege and who approved it.

Name the exact authorisation each service needs. Typical entries are form 64-8 for HMRC agent authorisation, HMRC agent credentials through Government Gateway, the SA100 self assessment return, the CT600 company tax return, the VAT return, and Companies House filings such as the AP01 on the appointment of a director. Each belongs to a different service and account, each can be withdrawn, and the register should show who holds it.

Operate a single deadline register

The deadline register should identify customer, entity, obligation, period, authoritative source, statutory date, client cut-off, preparer, reviewer, approver, submission route and status. Keep its edit history.

Work backwards from the external deadline. Provide space for queries, client decisions, correction and a rejected submission. Flag dependencies such as third-party valuations, payroll changes or confirmation from another adviser. Every change to the register needs a source, date, editor and notification to affected owners.

Standard UK dates belong in the register from the start, so the practice never relies on memory near a period end. Dates that apply to many owner-managed clients include:

self assessmentfiling and balancing payment by 31 January after the tax year, a second payment on account by 31 July and a tax year ending on 5 April;
PAYEreal time information submissions on or before each payday, with PAYE payable by the 22nd of the following month when paid electronically and the 19th by post;
VATreturn and payment normally one month and seven days after the end of the VAT period;
private company accountsCompanies House filing nine months after the accounting reference date;
corporation taxthe CT600 twelve months after the end of the accounting period, with the tax payable nine months and one day after it ends;
confirmation statementfiling within 14 days of the end of the review period.

Use reliable source alerts, but require a named person to assess each update. When an authority changes a date or route, record the source, affected population, workflow change and client communication.

Never close a deadline merely because a button was pressed. Preserve the exact submitted version, time, account, technical response and final acknowledgement. For company information, the current Companies House software-filing page notes that an acceptance response does not automatically mean a document met its deadline. Timing evidence therefore belongs beside acceptance evidence.

Keep future announcements correctly dated. The same page currently places compulsory commercial-software filing of annual accounts on 1 April 2028, not in 2027.

Control intake and completeness

Give customers a schedule of required records, acceptable channels, file naming, periods and cut-off dates. Explain consequences without making threats or guarantees. Provide an accessible alternative where needed.

On receipt, verify customer, entity, period, completeness, legibility and expected totals. Detect duplicates and altered versions. Record when and how evidence arrived. Move material from an unexpected channel into the approved system, then address the exposure. Log each incoming record for completeness, duplicates, legibility, entity and period, and quarantine items that arrive through an unapproved channel.

Use a query register rather than disconnected email threads. Each item needs source, question, owner, effect, requested evidence, response, conclusion and closure. Show which output or deadline is blocked.

Do not convert silence into agreement. An unresolved classification, estimate or missing invoice needs an explicit treatment supported by the appropriate framework and authority.

Make preparation reconstructable

Link ledger entries, adjustments and schedules to source evidence. For manual journals, record preparer, date, amount, accounts, rationale, support and approval. Restrict journals that bypass ordinary controls.

Use standard schedules for recurring work but require the preparer to address current facts. A copied prior-year answer can look complete while being wrong. Flag changes in activity, ownership, staff, finance, contracts and tax position.

Separate data processing from technical judgement. Define escalation triggers for novel transactions, conflicting evidence, uncertainty, suspected error, fraud indicators and work outside competence. The specialist receives a concise question with relevant facts and deadline, then returns a documented conclusion.

The HMRC agent standard expects covered agents to keep their tax knowledge current, work to prevent unsupported or speculative figures, keep contemporary advice records and address inaccuracies. Those expectations can be evidenced through source-linked working papers, technical review and correction controls.

Design review around consequence

Not every entry needs the same level of scrutiny. Set review depth according to materiality, complexity, judgement, customer vulnerability, fraud risk, tax impact, deadline and history. Define which outputs require an independent person or external specialist. Set out which tasks need a self-check, a second person or a specialist, and record the findings and closure.

A useful review considers:

whether the expected records are complete;
whether banks and control accounts reconcile;
unusual or significant movements;
estimates, judgements and technical positions;
consistency with source evidence and prior periods;
entity, tax, period and filing route;
presentation and information the client must understand;
unresolved queries and subsequent events;
version control and approval readiness.

The reviewer records findings with consequence and required action. The preparer responds with evidence. Closure comes from the appropriate reviewer, not automatically from a status change.

Small teams may not be able to separate every role. Document the conflict and use proportionate alternatives such as delayed review, external consultation, exception reporting or owner challenge. Do not hide a lack of separation behind job titles.

Professional-body requirements set the floor for review. Firms that carry out audit work must run a system of quality management under ISQM (UK) 1, and every firm must meet its body's quality review and professional indemnity insurance requirements. Those duties constrain acceptance, review depth and handover, so each catalogue entry should point to the obligation that applies.

Obtain client decisions cleanly

Send the client a stable, identifiable output and explain what it covers. Highlight material estimates, elections, uncertainty, missing evidence and actions. State the approval deadline and what happens if new facts arrive.

Record the approving person's authority. If an adjustment changes the output after approval, show the difference and obtain a renewed decision. A reply referring vaguely to "the accounts" may not identify the version being submitted.

Provide reasonable communication methods for people who need adjustments. The HMRC standard encourages agents to identify clients needing extra help and make services accessible. Operationalise this through recorded needs, agreed formats and a deputy who can provide them.

Submit, acknowledge and archive

Before transmission, run a release check for entity, period, service, credentials, client authority, reviewer sign-off, deadline and final hash or version identifier. Restrict the ability to substitute another file afterwards.

Store all response messages, including warnings and rejections. A rejection creates a new exception with owner and recovery time. Escalate threatened statutory deadlines promptly and tell the client what is known, unknown and required.

After acceptance, deliver the agreed copy and evidence to the customer securely. Close the task only when queries are resolved, records are indexed, next-period actions are created and retention is scheduled.

Protect personal and confidential information

Create an information map covering enquiry, acceptance, delivery, filing, billing, complaint and termination. Record people, data categories, purpose, source, recipients, system, location, retention and rights route.

The ICO's controller and processor guidance explains that the legal role follows who determines purposes and means. A practice may have different roles for different operations. Contracts should reflect the facts, not manufacture them.

Approve suppliers before client information reaches them. Review instructions, confidentiality, security, subprocessors, rights assistance, incidents, return, deletion and audit. Reassess optional artificial-intelligence functions whose activation changes information use.

Use individual accounts, strong authentication and least privilege. Restrict bulk downloads and privileged support access. Check permissions on joiner, mover and leaver events, then sample them independently.

Prepare for disruption and error

List critical services and maximum tolerable interruption in operational terms. Identify software, people, communications, records and external authorities needed to meet each deadline.

The NCSC's small organisations cyber security guide gives practical UK guidance covering accounts, devices, backups and incident preparation. Apply it to the practice's actual stack and risks.

Exercise scenarios such as:

the payroll operator is unexpectedly absent;
a cloud ledger is unavailable near a deadline;
a privileged account is compromised;
confidential records reach the wrong recipient;
an integration duplicates transactions;
a submission is rejected after client approval;
the office loses normal communications.

For each, test detection, containment, evidence preservation, impact assessment, notification, client communication, manual work, restoration and backlog. Keep essential contacts and procedures accessible outside the failed system.

Errors and near misses need a just culture with accountable correction. Record what happened, population, consequence, immediate action, root cause, owner and retest. A repeated workaround is a process change waiting to happen.

Define measurable service standards

Turn broad promises into definitions. Instead of "fast response", specify what starts the clock, what counts as acknowledgement, when an informed answer is due, which hours count and how waiting for client evidence is shown.

Use standards for intake, queries, preparation, review, approval, submission, correction, incident updates, complaints and handover. Distinguish contract commitments from internal targets.

Pair speed with quality measures. Track rework, unresolved exceptions, review findings and repeat queries. Examine ranges and serious outliers rather than publishing an average that conceals several harmful failures.

Claims made in advertising require matching evidence. CAP Code section 3 addresses substantiation, qualifications, comparisons and misleading omissions within its scope. A published percentage should state population, period, definition and exclusions.

Run a pre-launch review

Before a new service starts, freeze the exact candidate: entity, audience, scope, contract, fee, staff, systems, suppliers, pages and proposed date. Name an independent reviewer and disclose any conflict.

Inspect source evidence, then observe an end-to-end scenario. Include late information, a technical question, reviewer correction, new client approval and failed submission. Test a staff absence, supplier outage, access removal and backup restoration.

Define hard holds in advance. Launch should stop for missing authority, unresolved supervisory status, inadequate competence, failed reconciliation, absent data terms, unsafe access, unsupported advertising or no credible deadline contingency.

Report each finding with evidence, consequence, immediate control, owner and due date. Do not dilute one serious blocker into a high average score. Retest the fix before release and schedule a review after the first complete live cycle.

Manage capacity with forward evidence

Translate the deadline register into hours and competence by week. Include review, client queries, corrections and support, not only preparation. Flag concentration around payroll, VAT, accounts and tax dates.

Measure work in progress, ageing, overdue client inputs, reviewer queues and unresolved high-risk items. A utilisation percentage alone can encourage the team to start work without finishing it.

Set thresholds for pausing new acceptance, moving work, obtaining external help or renegotiating scope. Confirm confidentiality, competence, data and review controls before outsourcing. Emergency resourcing still needs approved access and supervision.

Use actual completion and correction data to adjust future capacity. If a service repeatedly exceeds planned effort, find whether the cause is customer selection, record quality, training, technology, pricing or workflow.

Monitor quality through samples and signals

Quality assurance should examine a risk-based sample of completed and live files. Include new customers, difficult work, new staff, changed systems, complaints and prior findings.

Test the file against its engagement, authoritative deadline, source records, review requirement, client approval, transmitted version and retention. Interview the people doing the work to uncover unofficial shortcuts.

Combine file results with complaints, corrected submissions, late work, access exceptions, incidents, supplier failures and customer misunderstanding. Trends guide system fixes, while an isolated serious event may require immediate action.

Keep the reviewer independent enough to challenge delivery owners. Management can accept a defined residual risk within authority, but it should not rewrite evidence to make a result green.

Control termination and handover

When a client or provider leaves, identify unfinished work, known errors, future obligations, disputed items, payments, authorities, records, software access and retention. Tell the appropriate parties who is responsible after the cut-off.

Provide information to a successor where the client is entitled and no lawful reason prevents it. The HMRC agent standard includes expectations about making relevant documents available to a former client's new adviser within its scope.

Use a handover index, secure transmission and receipt. Revoke authority and system access at the correct time, preserving legally and professionally required records. Confirm deletion where appropriate without erasing evidence that must be retained.

Review the final invoice and complaint route. Do not let a fee disagreement obscure a statutory deadline or create uncontrolled withholding; obtain legal and professional advice for the actual circumstances.

Use a 2027 operating review cycle

Daily control handles failed integrations, urgent queries, access alerts and threatened deadlines. Weekly review covers work in progress, client inputs, reviewer capacity and incidents. Monthly review samples files, permissions, supplier issues, complaints and budget variance. Quarterly or service-cycle review examines trends, competence, client population, service standards and business continuity.

Trigger an immediate reassessment when law, HMRC or Companies House service, professional rules, ownership, staffing, software, supplier, data flow, insurance or advertised scope changes. Keep consultations and announced future requirements separate from rules already in force.

The operating test is simple to state and demanding to meet. For any output, the practice should be able to show why it acted, which evidence it used, who checked it, what the client approved, what was sent and how an exception would be recovered. That traceability is the foundation of reliable accounting services in 2027.

Before you act

List every service and its responsibilities in one catalogue.
Run entity and engagement checks before accepting any work.
Record authority for each action and review after staff changes.
Keep a deadline register with source, owner and status.
Link working papers to source evidence and approval.
Set review depth by materiality, complexity and risk.

Common questions

What should a service catalogue record for each service?

Record eligible customer and entity types, included outputs and periods, excluded and referred work, applicable rules and standards, required competence and review, data and software dependencies, client inputs and cut-off dates, fee mechanism, complaint and exit routes, and service owner.

How should a practice handle client authority and HMRC access?

Distinguish contractual authority, HMRC client authorisation, tax-service enrolment, Companies House authentication and internal approval. HMRC's standard for agents states agents must never ask clients for their personal HMRC online sign-in details. Map which legal entity and user account may perform each action, and review authority after personnel or client-contact changes.

What evidence should be kept when a deadline is met?

Keep the exact submitted version, its time, the account used, the technical response and the final acknowledgement. Acceptance alone does not prove the document met its deadline, so timing evidence sits alongside it.