HR outsourcing companies guide: models, costs, RFP

When HR work starts crowding out growth, outsourcing can reduce risk, control costs, and speed up results. Human resources outsourcing companies provide HR managed services ranging from payroll outsourcing and benefits administration to recruiting, compliance, and global hiring. This guide demystifies the models (HRO/ASO/PEO/EOR), shows how pricing really works, and gives you a practical RFP and implementation playbook.

You’ll get vendor-neutral clarity on co-employment, compliance responsibilities, HRIS integrations, and SLAs—plus a 90-day rollout plan you can adapt. By the end, you’ll be able to shortlist with confidence and compare total cost of ownership against in-house HR.

Overview

This guide is for executive and HR leaders at 25–500 employee companies who need to lower admin load and risk without stalling hiring or benefits. We cover the major outsourcing models, the services you can offload, transparent cost frameworks, and a step-by-step RFP process.

HR outsourcing is the delegation of specific HR functions to a third party under a service agreement or co-employment model. The decision matters because delegated payroll, benefits and leave work is not the same as transferred legal responsibility; check the contract and applicable law. Integration depth and change management drive time-to-value as much as headline price.

Types of human resources outsourcing companies (HRO, ASO, PEO, EOR)

Choosing the right model comes down to who employs whom, who files and remits payroll taxes, and who carries compliance risk. At a glance: HRO and ASO are service agreements where you remain the employer; PEO adds co-employment for U.S. workers; EOR becomes the legal employer (especially useful outside your home country).

As compliance context, FMLA employer coverage and employee eligibility use different tests: the 50-employees-within-75-miles rule concerns employee eligibility, not general employer coverage. Public agencies and public or private local schools do not need to meet the employer-size test. COBRA generally uses a prior-year 20-employee test for group health plans. See the Compliance section for counting details. For industry context on PEOs, see NAPEO.

HRO (Human Resources Outsourcing): A la carte HR BPO for tasks like payroll, benefits administration, recruiting, or compliance support. You remain the employer; verify delegated tasks and retained legal duties under the contract and applicable law.
ASO (Administrative Services Only): Similar to HRO but often bundles HR administration under your tax IDs. There is no co-employment. The ASO may file and remit on your behalf under the contract; ordinary delegation does not remove your federal-tax responsibility.
PEO (Professional Employer Organization): Co-employment model where the PEO shares certain employer responsibilities (e.g., payroll tax remittance) and may offer access to large-group benefits. You manage day-to-day people leadership.
EOR (Employer of Record): The provider becomes the legal employer for designated workers (commonly in foreign countries). It handles contracts, payroll, taxes, and statutory benefits; you direct work.

In all models, you still manage culture, performance standards, and business outcomes. Many providers also offer HRIS platforms and HR managed services to centralize time, HR, and payroll. Your integration needs should influence model choice as much as risk transfer.

Sources: U.S. DOL FMLA (https://www.dol.gov/agencies/whd/fmla), U.S. DOL COBRA (https://www.dol.gov/general/topic/health-plans/cobra), NAPEO overview (https://www.napeo.org/)

How co-employment works in a PEO—and when it benefits SMBs

In a PEO, you and the provider both employ the worker for different purposes. You direct work and compensation decisions; payroll, policy and benefit duties are allocated under the client service agreement (CSA) and applicable law.

This structure can reduce administration, but verify the allocated duties and compare actual benefit quotes; co-employment alone does not establish lower premiums or remove your responsibilities.

For example, a 75-employee, multi-state company might consider a PEO to coordinate 10 state tax accounts and EPLI/Workers’ Comp administration. Confirm the provider’s scope and compare medical premiums, plan choices and standardized policies before deciding whether the tradeoffs work for your team.

For broader industry data on PEO outcomes and definitions, see NAPEO (https://www.napeo.org/).

What services can you outsource?

You can outsource discrete HR outsourcing services or full-scope HR managed services across the employee lifecycle. The right mix depends on your internal strengths, compliance profile, and growth goals.

Payroll processing and tax filing
Benefits administration outsourcing (eligibility, enrollments, carrier interfaces)
Recruiting and talent acquisition, background checks, and onboarding
Time and attendance, scheduling, and leave management (including FMLA tracking; note EEO‑1 reporting generally applies to private employers with 100+ employees; confirm applicability and the reporting year with EEOC)
Performance management, engagement surveys, learning management, and compliance training
HR analytics and reporting (headcount, turnover, DE&I metrics)
I‑9 and E‑Verify administration (see USCIS E‑Verify), plus audits
ACA and COBRA administration and reporting
Offboarding, unemployment claims, and employee relations support

As you map scope, separate strategic responsibilities you’ll keep (culture, leadership, compensation philosophy) from transactional processes that scale better with a provider’s systems and controls.

Sources: EEOC EEO‑1 (https://www.eeoc.gov/employers/eeo-1-data-collection), USCIS E‑Verify (https://www.uscis.gov/e-verify)

Costs and pricing models (PEPM vs % of payroll) with scenario math

Request quotes showing per employee per month (PEPM), a percentage of defined gross payroll, or another stated fee basis. For HRO/ASO/PEO/EOR, identify what the service fee covers and separate employer taxes, benefit premiums, statutory costs and any service margin or other pass-throughs.

Your actual rate flexes with headcount, multi-state complexity, benefits administration, and support tiers.

Ask each provider for the rate, billable headcount or payroll base, minimum charges, included modules and support tier. For international workers, request country-specific employer taxes, statutory benefits and any currency or service charges separately from the administration fee.

Require apples-to-apples quotes with itemized inclusions and pass-throughs.

Key cost drivers to compare: headcount and seasonal variability; number of states/countries; benefits complexity (self-billed vs carrier-billed, COBRA/ACA); payroll frequency and off-cycles; integrations/API needs; support model (pooled vs dedicated); risk products (EPLI/Workers’ Comp).

Scenario math (hypothetical 50-employee example): assume $65,000 average annual salary, yielding $3,250,000 annual payroll or $270,833.33 monthly payroll.

Hypothetical monthly administration-fee comparison
Assumed proposal	Monthly calculation	Monthly fee
PEO at $95 PEPM	50 × $95	$4,750
PEO at 3.5% of payroll	$3,250,000 × 3.5% ÷ 12	$9,479.17
ASO/HRO at $45 PEPM	50 × $45	$2,250

These assumed fees are not verified vendor quotes or total costs. Duties and exclusions remain unknown; neither a model label nor a lower fee tells you who files or remits taxes.

Normalize quotes using the same period and headcount: list included duties and modules, identify who files/remits taxes, separate benefits premiums, broker commissions and statutory pass-throughs, and flag implementation/add-on fees (e.g., W‑2s, off-cycle payroll, COBRA events). Include the cost of retained internal work before drawing a total-cost conclusion.

Illustrative decision record — the assumed $45 PEPM ASO/HRO option

Named filing/remittance entity and supporting evidence: pending; request the exact legal entity, contractual duties and payment-verification method.
Included and excluded costs: $2,250 monthly assumed administration fee only. Modules, premiums, commissions, statutory costs and one-time/add-on fees remain unresolved; estimate retained internal work.
Acceptance tests: reconcile parallel payroll to the penny, verify tax account/payment evidence, and validate benefits eligibility and carrier connections before sign-off.
Unresolved question: does the scope cover required filings and remittances, and what work remains in-house?
Decision: pause selection; revise the comparison when evidence is complete, then select only after cost scope and acceptance tests are met.

To avoid surprises, request a rate card for change orders, clarify renewal caps, and model a +/‑ 20% headcount swing to see pricing sensitivity over 12–24 months.

Compliance, risk, and who is responsible under each model

In HRO/ASO, you remain the employer, but a provider may report and deposit employment taxes on your behalf. For ordinary outsourced payroll, IRS guidance says you remain responsible for federal-tax deposits and payment. Name the filing/remittance entity in the contract and verify payments through EFTPS. Allocate ACA/COBRA, wage-and-hour and leave tasks under applicable law and contract; the federal-tax rule is not a complete map of those duties.

In a PEO, the client service agreement (CSA) allocates responsibilities alongside applicable law; co-employment alone is not blanket tax or compliance immunity. You retain control over hiring, firing, compensation, scheduling, and safety practices.

A certified PEO (CPEO) has a specific federal-tax rule: generally it is solely liable for employment taxes on remuneration it pays to worksite employees as defined by law; it and the customer may both be liable for remuneration paid to non-worksite employees. The contract must name the exact CPEO legal entity and EIN. CPEO customers cannot view its federal deposits through EFTPS; agree on other verification evidence.

An EOR acts as legal employer for designated workers, with contract, payroll, tax and statutory-benefit services defined for the engagement. You direct day-to-day work. Before hiring, confirm country and role availability, contractual scope and retained client duties with qualified local advice; do not treat the model label as automatic compliance.

Regardless of model, you’ll still own culture, anti-harassment enforcement, and operational safety. Outsourcing doesn’t absolve you from maintaining a lawful, non-discriminatory workplace.

Use regulatory thresholds to frame scope. Under the general FMLA tests, private-sector employers engaged in commerce are covered with 50 or more employees each working day for at least 20 calendar weeks in the current or preceding year. Public agencies and public or private local schools do not need to meet that employer-size test. Employee eligibility generally requires a covered employer, 50 employees within 75 miles of the worksite, 12 months of employment (not necessarily consecutive) and 1,250 hours worked in the 12 months before leave begins. Verify applicable exceptions and state-law leave rights.

COBRA’s general threshold is at least 20 employees on more than half of typical business days in the previous calendar year. Count full-time and part-time employees; each part-time employee counts fractionally, using hours worked divided by the hours required for full-time status.

EEO‑1 reporting generally applies to private employers with 100+ employees; confirm applicability and the reporting year with EEOC. Confirm in contracts who monitors thresholds, updates policies, files reports, and responds to audits—and what indemnities and limits apply.

Sources: DOL FMLA (https://www.dol.gov/agencies/whd/fmla), DOL COBRA (https://www.dol.gov/general/topic/health-plans/cobra), EEOC EEO‑1 (https://www.eeoc.gov/employers/eeo-1-data-collection)

Security, SLAs, and data governance to ask about

Security assurances and service levels protect your workforce data and your operations. Require third-party validation, clear uptime commitments, and transparent incident handling before you sign.

Request a SOC 2 Type II assurance report; review covered systems, scope, selected criteria, reporting period and exceptions. Confirm which requested security, availability, confidentiality, processing integrity or privacy criteria it covers (AICPA SOC overview).
Data encryption in transit and at rest; key management practices and data segregation for multi-tenant systems
Access controls and identity: SSO/SAML, role-based access, MFA enforcement, and audit logs
Incident response: detection/response times, breach notification windows, root-cause analysis and corrective action plans
Uptime SLAs: negotiate a target (e.g., 99.9%+) and define the measurement period, exclusions and maintenance windows; require performance monitoring and defined RTO/RPO for backups
Data retention/deletion timelines, customer export rights, and portability at termination
Subprocessor/vendor risk management, penetration testing cadence, and vulnerability remediation SLAs
Support tiers and response times by priority; named CSM vs pooled queue; escalation paths and executive access
Audit rights and compliance reports (e.g., SOC 2, penetration test summaries). For benefits workflows, determine covered-entity, business-associate and PHI scope; obtain the required BAA before applicable PHI handling (HHS business-associate guidance).

Close gaps by aligning SLAs to payroll calendars and open enrollment peaks. Reference these commitments in your scorecard to compare providers on more than features.

Source: AICPA SOC 2 overview (https://www.aicpa.org/resources/article/what-is-soc-2)

Integrations: HRIS, payroll, and ATS ecosystems

Integrations determine how quickly your team adopts the platform and how trustworthy your reports are. Prioritize native connectors to your HRIS, payroll, ATS, time, and general ledger. Verify how data maps, syncs, and is validated end to end.

A fast demo can mask complexity. Ask to see field-level mappings for job, comp, location, and benefits data. Confirm whether changes flow one way or bi-directionally. Test how errors are surfaced.

Migrations succeed when providers offer templates, staging environments, and parallel runs to catch mismatches before go-live.

Integration mini-checklist: current native connectors; API coverage and rate limits; webhooks/events; field-level mapping for people, comp, and tax data; sync cadence and latency; error handling and retries; SSO/SCIM for user provisioning; GL export formats and dimensions.

Confirm ownership: who builds and maintains connectors, what the SLA is for break-fix, and how version upgrades are handled when your HR tech stack evolves.

How to shortlist providers and run an effective RFP

A disciplined RFP compresses the timeline and reduces risk by forcing apples-to-apples comparisons. Start with your scope and constraints, then drive to demos and references that validate execution, not just promises.

Define scope and success metrics with a baseline, metric definition and measurement window. Treat targets such as reducing payroll errors by 80% or cutting time-to-hire by 30% as illustrative choices to adapt, not promised results.
Document must-haves (multi-state payroll, COBRA, ACA, leave tracking), nice-to-haves, and excluded items.
Set data and security requirements: evaluate SOC 2 Type II report scope, criteria, period and exceptions; require SSO/MFA and RTO/RPO targets. Negotiate uptime (e.g., 99.9%+) with a defined measurement period and exclusions.
Map integrations (HRIS, payroll, ATS, time, GL) and required field coverage.
Issue the RFP with timelines and a pricing template (PEPM vs % payroll, implementation fees, change-order rates).
Build a scorecard with weighted criteria.
Run scenario-based demos (hire in two states; off-cycle payroll; ACA measurement).
Validate 2–3 references matching your size/industry.
Negotiate SLAs, data ownership/portability, and renewal caps.

Question bank to include: Who files/remits payroll taxes? What’s your average implementation timeline by headcount? How are COBRA and ACA handled—who is the responsible entity? Which APIs and native connectors are production-supported?

What is your support model and response times by severity? How do you handle security incidents and notify clients? What are typical add-on/hidden fees? Can you share case metrics (error rates, time-to-hire) for companies like ours?

Decision criteria that predict long-term fit

Selecting on features alone risks churn; choose a partner you can scale with. The best predictors of success blend compliance maturity, implementation discipline, and integration depth with a service model that meets your team where it is.

Compliance posture and indemnities aligned to your model (HRO/ASO/PEO/EOR)
Implementation track record and resources (project plan, parallel runs, data validation)
Integration fit (native connectors, API depth, GL export flexibility)
Support model (named CSM vs pooled; SLAs; payroll-calendar alignment)
Scalability (multi-state/country support, seasonal headcount swings)
Total cost of ownership (PEPM/percent pricing, benefits, add-ons, change orders)
Cultural alignment and change-management approach
Proof of outcomes (benchmarks on error rates, time-to-hire, benefits adoption)

Ask finalists to map these criteria explicitly to your 12–18 month roadmap. Strong providers will show how their model flexes as you grow.

Implementation timeline and change management

Most implementations succeed or struggle based on data quality and stakeholder bandwidth, not software alone. Use the illustrative 30/60/90-day plan below to align HR, finance, and IT on readiness milestones; adapt dates to scope and unresolved risks.

Days 0–30 (Discovery and data prep): assemble a cross-functional team, inventory current processes, and extract clean employee, comp, and tax data. Build the integration plan and GL mapping, stand up SSO, and schedule vendor-led training.

Risks here include incomplete historical tax data and unclear leave balances. Mitigate with a single source of truth and template-driven data validation.

Days 31–60 (Configuration and parallel): configure payroll, benefits, time, and security roles. Connect carriers and tax jurisdictions. Run at least one parallel payroll and reconcile variances to the penny.

Confirm ACA/COBRA settings, test onboarding and offboarding, and dry-run open enrollment workflows. Use parallel payroll, carrier connections and tax account confirmations as readiness evidence.

Days 61–90 (Go-live and stabilization): proceed only after resolving material payroll, tax and benefits defects and obtaining sign-off from responsible HR, finance and IT owners. Execute first live payroll with contingency for off-cycle corrections. Monitor support tickets and error trends. Finalize documentation and transition to your steady-state CSM.

A light change-management plan—FAQs, quick guides, and manager training—reduces noise.

Use cases by size, industry, and geography

Model fit changes with complexity. Map your scenario to the option that best balances risk transfer, speed, and integration control.

Startup (25–75 employees, 1–2 states): ASO/HRO for payroll + benefits admin; consider PEO if its CSA allocation of payroll duties and actual benefit quotes fit your priorities.
Mid-market (75–250, multi-state): consider PEO for coordinated administration and compliance support, checking CSA allocation and applicable law; HRO/ASO if you want tighter HRIS ownership and in-house compliance expertise.
Seasonal/variable workforces: HRO/ASO with flexible PEPM and time/attendance depth; or consider PEO for multi-state payroll support after checking CSA duties, applicable law and variable-headcount terms.
Healthcare and nonprofit sensitivities: providers with strong ACA/COBRA, leave tracking, and audit support. Evaluate SOC reports and data governance; determine HIPAA covered-entity, business-associate and PHI scope for the actual workflow, with a BAA where required. Do not assume industry or employment records alone establish PHI status.
Unionized or manufacturing: HRO/ASO or PEO with robust timekeeping, shift differentials, and CBA-aware payroll; confirm multi-jurisdiction overtime rules.
Early global expansion: consider an EOR for designated workers where you lack an entity. Verify country/role availability, provider terms and retained client duties. Evaluate a later entity or model change against local requirements and your needs rather than assuming a required transition.

As you scale, revisit model assumptions annually. A move from PEO to HRO/ASO is an option to evaluate as your HRIS, processes and broker relationships change; compare retained duties, transition costs and provider terms before deciding.

FAQs

What’s the difference between HRO, ASO, PEO, and EOR? HRO/ASO are service agreements where you remain the employer; PEO adds co-employment in the U.S.; EOR becomes the legal employer (often for international hiring).
How do providers price—PEPM or percent of payroll? Request the stated rate and billable headcount for PEPM, or the rate and defined payroll base for a percentage charge. Compare included services and separate taxes, benefits, statutory costs and add-ons before assessing either structure.
Who holds compliance liability for payroll taxes, ACA/COBRA, and FMLA? HRO/ASO: distinguish contracted filing/remittance work from your retained federal-tax responsibility. PEO: check CSA allocation and applicable law; the specific CPEO worksite-tax rule is not general PEO immunity. EOR: legal employer for designated workers, with client duties still to confirm. Name the filing/remittance entity, require verification evidence, and review each non-tax duty in the MSA under applicable law.
What SLAs and security assurance should we require? Evaluate SOC 2 Type II report systems, scope, selected criteria, period and exceptions—not a universal certification. Negotiate uptime (e.g., 99.9%+) with measurement period and exclusions, incident response, RTO/RPO and support times by severity.
How long does implementation take? Treat 6–12 weeks for SMBs as an illustrative planning range, alongside the adaptable 30/60/90-day phases. Timing depends on data quality, integrations and carrier connections; reconcile parallel payroll and resolve material payroll, tax and benefits defects before responsible human sign-off.
Which integrations matter most? HRIS, payroll, ATS, time, and GL; evaluate native connectors, API coverage, field mappings, sync cadence, and error handling.
When is EOR better than PEO? Consider an EOR for designated workers in a country where you lack an entity. Compare alternatives after confirming country/role availability, provider terms and retained client duties; the model alone does not establish local compliance or hiring speed.
What hidden fees should we watch for? Implementation, off-cycle payrolls, W‑2/1095 processing, COBRA events, extra tax accounts, integration build fees, and premium support.
How do we measure ROI? Track payroll error rate, time-to-hire, turnover, benefits adoption and cost trends, compliance findings, and HR ticket volume/time saved. Record released capacity separately from cash savings; saved hours reduce expenditure only if you can demonstrate an actual spending reduction, net of provider fees and retained internal costs.