The reply took six days and did not answer the question. You had asked whether the amended return from March actually went in. What came back explained how to run a report in the portal. The person who used to know your EIN without looking it up now has an auto-reply pointing at a shared queue. Every few months a payroll forum fills with this complaint, and the thread goes straight to where the support staff sit.

That is the wrong variable. The IRS is unambiguous: “The employer is ultimately responsible for the deposit and payment of federal tax liabilities,” and where a third party fails to do it, “the employer is liable for all taxes, penalties and interest due.” Payroll provider liability, in the sense of a vendor absorbing your tax exposure, mostly does not exist. You bought processing. You did not sell the obligation.

So the useful questions are narrower than “has support got worse.” Which legal arrangement do I have, are the deposits genuinely landing, and how long would it take me to find out one had not? Answer those and the support desk’s location becomes an operational preference rather than a risk you carry blind.

Payroll provider liability depends on which of four arrangements you signed

Most buyers cannot name theirs. The IRS recognises four third party payer arrangements, and they sit in genuinely different places on liability.

Arrangement	IRS form	Who is liable for the tax
Payroll service provider (PSP)	None required	“A PSP assumes no liability for their employer/clients’ employment tax withholding, reporting, payment, and/or filing duties.”
Reporting agent	Form 8655	“A reporting agent assumes no liability for their employer/clients’ employment tax withholding, reporting, payment, and/or filing duties.”
Section 3504 agent	Form 2678	The agent “agrees to assume liability along with the employer” for FICA and income tax withholding.
Certified PEO (CPEO)	Form 8973	“Generally, the CPEO is solely liable” for taxes on remuneration it pays to work site employees.

Read the first two rows twice. That is where the overwhelming majority of payroll relationships sit, and in both the provider’s liability for the tax is nil. A reporting agent signs and files certain returns, makes deposits and payments, and receives duplicate copies of your notices. A transfer of keystrokes, not of liability.

The CPEO row has a trap in it. A CPEO is solely liable for wages it pays to work site employees. For covered employees who are not, Treasury regulation 31.3511-1 provides that “a person other than the CPEO is also treated as an employer of the employee” where that person would be an employer anyway, and requires the CPEO to notify the customer it may also be liable. Remote and field staff can fall outside the shelter you thought you bought. Ask in writing which of your people the CPEO treats as work site employees, check the legal name and EIN on the Form 8973 against your contract, and verify certification against the list the IRS publishes. Groups do not always contract through the certified entity.

Worker classification never moves at all. The IRS weighs behavioural control, financial control and type of relationship, and says there is “no ‘magic’ or set number of factors.” The Department of Labor is blunter: “Employers are responsible for determining whether a worker is an employee under the FLSA.” If your provider’s onboarding screen lets a manager tick “contractor” and move on, that is your liability being created inside someone else’s software.

Verify the deposits yourself, not from a report

Everything else here is secondary. A provider screen saying a deposit was made is a screen the provider generated. It is not evidence from the IRS.

The IRS says what to do. Employers should “register on the EFTPS system to get their own PIN and use this PIN to periodically verify payments.” Your enrolment, your credentials, independent of the provider’s access. You then see payment history going back over a year; the IRS states 15 months on its EFTPS page and 16 on its outsourcing guidance, so treat it as roughly five quarters. New enrolments can take up to five business days, so it is not a same-afternoon check the first time.

• Open a Business Tax Account. It shows total amount owed by year, payment history, tax transcripts and tax compliance reports. One gap: not yet available for LLCs filing as sole proprietors on Schedule C or F.
• Keep the address of record as yours. The IRS “strongly suggests that the employer does not change their address of record to that of the payroll service provider as it may significantly limit the employer’s ability to be informed of tax matters.” If the provider’s address went on the file at implementation, the first notice about a missed deposit goes to them, and you can be three quarters into a problem with a clean inbox.
• Check the states separately. Federal deposits landing tells you nothing about state withholding or unemployment. Get your own login for every state you file in.
• Tie deposits to your register. Take one quarter, total the federal deposits in EFTPS, compare to the tax lines on your own payroll registers. It is the highest-value hour in this entire exercise.

Quarterly for the reconciliation, monthly for a glance at confirmations. Annual is too slow: a semi-weekly depositor stacks up a lot of wrong before it surfaces.

Asking about the support model without making it about geography

Time zone overlap is a fair operational question. Which city your payroll analyst sits in is not the variable that decides whether your Form 941 is correct. Authority, escalation and contractual commitment are.

• Who has authority to correct a filing, by role? Not who can raise a ticket. Who can cause an amended return to be prepared and submitted. If that sits two levels above anyone you can reach, your correction timeline is their backlog.
• What is the escalation path, with a trigger and a clock? “Tier 1, tier 2, tier 3” is not a path. At what point does an unresolved tax issue reach someone with filing authority, and within how many business hours?
• What response commitment is in the signed contract? The marketing page and the master services agreement are different documents. Do the service levels cover tax and compliance queries or only general support, and is there any remedy beyond a service credit?
• Does my named contact exist contractually? Many agreements promise a dedicated representative without naming one or committing to continuity. Ask who inherits your file when they leave, and whether anyone tells you.
• Who signs, and where do my notices go? If a reporting agent signs under Form 8655, keep a copy of the authorisation and know how to revoke it. The agent receives duplicate copies of notices. Duplicate should mean duplicate; confirm you are still on the original.

A provider answering all five crisply is fine wherever its people sit. One that cannot say who may amend a return has told you something worth acting on.

Who can see your payroll records, and what the attestations cover

Payroll data is unusually rich: legal names, addresses, SSNs, bank routing and account numbers, wage histories, garnishment orders. Four questions, in writing. Which roles can view full records, and can any see unmasked SSNs and bank details? Which subcontractors and affiliates touch processing or support, and what are your notification rights when that list changes? Where is data stored, where processed, and where accessed from, frequently three different answers? What is the offboarding SLA for a departing agent’s access, and what triggers it?

Then ask for the right attestation. Buyers reflexively ask for SOC 2, which examines controls against trust services criteria including security, availability, processing integrity, confidentiality and privacy. For a payroll processor, the report speaking to whether transactions are processed correctly is generally a SOC 1, covering controls relevant to user entities’ internal control over financial reporting. The AICPA describes SOC as “a suite of service offerings CPAs may provide in connection with system-level controls of a service organization”: different reports for different questions. Read four things:

• Type 1 or Type 2. Type 1 addresses control design at a point in time. Type 2 covers operating effectiveness across a stated period. Only the second tells you the controls actually ran.
• The period covered. A report ending fourteen months ago says nothing about the service you receive now, which matters most if the operating model changed since.
• Scope and subservice organisations. Are subservice providers carved out or included? Carved out means those controls were not examined.
• Complementary user entity controls. Almost nobody reads this section and for payroll it is the most useful page in the report. It lists the controls the provider assumes you operate for its own controls to work. Read it as a to-do list, because that is what it is.

Degrading support is a leading indicator, not just an irritation

Support quality and filing accuracy draw on the same well: knowledge of your account, staffing depth, time available per case. When that well runs low the visible symptom is slow tickets. The invisible one is a quarter filed against stale setup data.

• Resolution times lengthening while first-response times stay fast. Someone is hitting a metric that is not the one that matters.
• Replies that answer a different question, or quote the help centre back at you.
• Your account contact changing more than twice a year with no handover.
• Being asked for information the provider already holds: setup data, prior filings, your deposit schedule.
• Tax notices reaching you late, or from the provider rather than from the IRS.
• Small recurring errors fixed individually and never root-caused. A wrong jurisdiction on one employee, a deduction that resets, a wage base that did not roll over.
• A tax question that is “with the filings team” with no name and no date.

Three or more at once is the point to run the verification above and to price a switch, whether or not you use it.

When something is filed wrong

The routes are specific. Form 941 is corrected with Form 941-X, Form 944 with 944-X, Form 943 with 943-X, Form 945 with 945-X, CT-1 with CT-1X. Form 940 has no X form: an amended 940 is the original with the amended box checked.

Two timing rules decide a lot. An underpayment can qualify for interest-free adjustment treatment where you pay it by the time the adjusted return is filed, and the IRS frames the window as running to the due date of the return for the period in which you discovered the error. There are no interest-free adjustments for underpaid FUTA. For federal income tax withholding, corrections are generally only permitted where the error was discovered in the same calendar year the wages were paid, which makes a January discovery a materially different problem from a November one.

For penalties, go to the source rather than to any article, this one included. The IRS Failure to Deposit Penalty page sets out how the charge is calculated by days late, and states both that “we charge interest on penalties” and that the IRS “may be able to remove or reduce some penalties if you acted in good faith and can show reasonable cause.” Rates change; read the page for your year.

Which is why the paper trail has to be built as events happen rather than reconstructed afterwards. Reasonable cause is an evidence question. Contemporaneously means the date you asked, what you asked, what the provider said, the ticket number, the portal screenshot showing the deposit as made, and the date you found out it was not. Email a short summary after any phone call on a tax issue. Nine months later, “we relied on the provider” is an assertion. A dated thread showing you asked twice and were told it was handled is a record. Form 8655 lists, among a reporting agent’s authorisations, providing the IRS with information to aid in penalty relief determinations, which only helps if the provider’s account exists in writing.

Keep the recovery separate from the compliance fix. Correcting the return and paying the tax is between you and the IRS, and it does not wait. Recovering the penalty from the provider is a contract matter, governed by the limitation of liability you signed.

Switching is the leverage you actually hold

Timing. Move at a quarter boundary at minimum, so one entity files one complete Form 941 and responsibility is unambiguous. A 1 January move is better: year-to-date wages, taxable wage bases and W-2 responsibility all start clean. Worst is mid-quarter; second worst is the week before a deadline. Budget eight to twelve weeks rather than rushing a boundary you will miss.

Historical data, extracted before you give notice. Access narrows the moment a termination letter lands. Pull, machine-readable where you can: payroll registers for every period across your retention obligation; filed copies of every federal and state return, W-2, W-3 and 1099; deposit confirmations per jurisdiction; year-to-date wage and tax detail by employee including taxable wage bases; employee master data with current W-4 records, direct deposit details and hire dates; accrual balances with their rules; deduction and benefit setup, garnishment orders and wage assignments; your jurisdiction and account number list with deposit frequencies; and the general ledger mapping. Get a written data return and deletion commitment with a timeline.

A parallel run. Process one or two full cycles in both systems and reconcile gross, each tax, each deduction and net at the employee level, not just in total. Employee level is where you find the one person whose local jurisdiction did not carry across. The outgoing provider files only for periods it processed, the new one starts at the boundary, and nobody assumes. Then confirm the first deposit under the new provider landed, in EFTPS, yourself.

The four in-house controls that make any provider replaceable

• Reconcile the payroll register to the bank every cycle. Gross to net to the actual debit, including the tax impound if your provider takes one. Compare headcount and gross to the prior period, and ask about any variance you cannot explain in one sentence.
• File deposit confirmations monthly, verify against EFTPS quarterly. The confirmation is the claim. EFTPS is the check.
• Keep your own filing calendar. Built from IRS employment tax due dates and each state agency’s schedule, in your system, with your deposit schedule for the year on it. When the provider’s reminder stops arriving, yours still does.
• Name one internally accountable person. One individual owns payroll compliance, with authority to hold a run and escalate. “The provider handles it” is not an owner, and neither is a job title nobody currently holds.

Write them down. An initialled quarter-page checklist beats a control living in someone’s memory, and it doubles as the documentation behind any reasonable cause argument you may need.

That list also answers the question this usually ends at, whether to bring payroll in-house. Rarely, and not for this reason. Processing it yourself does not reduce the liability, because the liability was always yours. It moves execution risk from a provider whose depth you cannot see to a person whose depth you can. For most employers under a few hundred staff the better trade is a competent provider, those four controls, and a named owner who understands the filings well enough to argue about them.

This article is general information, not tax, legal or accounting advice. Deposit schedules, penalty rates, correction windows and classification tests change and turn on your specific facts. Use the IRS pages linked below and a licensed professional for your own situation.

If that control list produced an uncomfortable “we do none of those,” the gap is capacity rather than knowledge, and it is exactly the gap AB7 Solutions fills. We place trained remote payroll and finance professionals into this work: quarterly EFTPS and transcript verification against your own registers, deposit confirmation filing, an independent multi-jurisdiction deadline calendar, and the employee-level reconciliation on a parallel run if you decide to move. Our automation practice builds the plumbing so the checks do not depend on anyone remembering, connecting payroll, banking and accounting systems so a register-to-bank variance surfaces the same week instead of at year end. And because payroll records are the most sensitive dataset most companies hold, our cybersecurity practice will review the provider access model and read the SOC reports with you, including the complementary user entity controls section that lists work the provider already assumes you do. One commitment: if verification shows your provider is filing correctly and all you need is one named internal owner and a checklist, we will tell you that instead of selling you a service. To walk through your filing footprint and where the verification gap sits, call +1 321 341 7733, email ab@ab7solutions.com or director@ab7solutions.com, or visit www.ab7solutions.com.

Sources: IRS, Outsourcing payroll duties, Third party arrangements, CPEO customers: what you need to know, About Form 8655, Reporting Agent Authorization, Correcting employment taxes, Failure to Deposit Penalty, EFTPS, Business Tax Account, Employment tax due dates, Independent contractor (self-employed) or employee?; eCFR, 26 CFR 31.3511-1; US Department of Labor, Misclassification of employees as independent contractors; AICPA & CIMA, System and Organization Controls (SOC) suite of services.