Standards and certification

SOC 2 readiness for Canadian software and service companies

A SOC 2 readiness assessment checks your controls against the AICPA Trust Services Criteria before a CPA firm examines them, so the audit starts without surprises.² We help you choose the criteria and report type, close the gaps and organize the evidence. The SOC 2 report itself comes only from an independent CPA firm.¹

Ask us to call you back Book the free audit

The founder of a small software company, in his late fifties, standing at the window of a brick loft office with a mug of coffee, empty desks with closed laptops behind him — SOC 2 readiness is quiet work: controls set up, evidence kept, and nothing left for the auditor to find by surprise.

A person here calls you back the same business day, usually within an hour.

Written permission first
A report in plain words
Checked again after the fix

What a SOC 2 report is, and who issues it

A SOC 2 report is an independent CPA's report on the controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy, the five categories of the AICPA Trust Services Criteria.¹² Customers and business partners use it to judge the risks of handing a function or their data to you, which is why they often request it.¹

SOC stands for System and Organization Controls, a suite of services that CPAs provide under AICPA standards.³ The AICPA guide for SOC 2 examinations was updated as of 15 October 2022 to reflect SSAE No. 20 and No. 21, and it applies the 2017 Trust Services Criteria with revised points of focus from 2022, together with the 2018 description criteria for the system description.¹

In Canada, CPA Canada publishes a SOC 2 guide adapted from the AICPA version, revised in 2024. The engagement it describes is based on Canadian Standard on Assurance Engagements (CSAE) 3000, and it includes illustrative reports issued under Canadian and United States standards together.⁴ SOC 2 therefore results in a CPA's report with an opinion; the word certification, often used in searches, describes it loosely.

Who does what in a SOC 2 examination
Who	Role	Source
AICPA	Sets the Trust Services Criteria, the description criteria and the attestation standards for SOC 2	²¹
CPA Canada	Publishes a non-authoritative SOC 2 guide adapted to CSAE 3000	⁴
Independent CPA firm (service auditor)	Examines your system description and controls and issues the SOC 2 report	¹⁵
Your company (service organization)	Owns the controls, writes the system description and chooses the CPA firm	¹
itopsi (INNOVA CONSULT LTD.)	Readiness work before and during the examination; issues no report or opinion	²

SOC 2 compliance in Canada: voluntary, often requested by customers

SOC 2 compliance in Canada is driven by contracts: a customer, often a larger company or one based in the United States, asks for the report during procurement or renewal. CPABC notes that Canadian standards do not specifically include reports similar to SOC 2, and that an engagement under CSAE 3000 could accomplish the same.⁵

For a Canadian SaaS company this has a practical side. You can engage a Canadian CPA firm, a United States firm, or a firm that reports under both sets of standards, as the CPA Canada guide illustrates.⁴ The right choice depends on who will read the report, so ask your customer which report it expects before you sign with an auditor.

When people search for SOC 2 certification in Canada, what they need is this report and the work to earn a clean opinion. A SOC 2 report covers a defined system for a date or a period, and a later report is needed to show that the controls kept working.

Choosing the Trust Services Criteria and the system boundary

The scope of a SOC 2 examination is set by two choices: which of the five Trust Services categories the report covers, and which system it describes. The CPA Canada guide describes SOC 2 engagements on controls over one or more of these subjects, so the selection follows what your customers rely on you for.⁴

Security of your system.⁴
Availability of your system.⁴
Processing integrity of your system.⁴
Confidentiality of the information your system processes or keeps for customers.⁴
Privacy of the personal information you collect, use, retain, disclose and dispose of for customers.⁴

Drawing the system boundary

The system is the product or service your customers buy, with the platforms, people, processes and data behind it. We list what sits inside, which cloud providers and subservice organizations support it, and what stays outside, so the description and the controls match.

Type 1 or Type 2: which SOC 2 report to start with

A Type 1 report covers the fairness of management's description of the system and the suitability of the design of controls as of a specified date; a Type 2 report adds the operating effectiveness of those controls throughout a specified period.⁵ The CPA Canada guide explains the difference between the two types for SOC 2 engagements.⁴

A Type 1 report needs controls designed and in place on one date, while a Type 2 report needs them running across a whole period, so Type 2 takes longer to reach. If your customer asks for Type 2 directly, readiness work aims at the start of the period. Our article on SOC 2 Type 1 vs Type 2 walks through the choice for a small company.

The road to a SOC 2 report: five steps of readiness with us, then the CPA firm's Type 1 and Type 2 examinations.

What our SOC 2 readiness assessment covers

Our SOC 2 readiness assessment compares your current controls with the criteria you chose, closes the gaps with you and leaves an evidence trail a CPA firm can test. It starts with a 30-minute conversation and a scope letter that names the system, the dates and what we may touch.

Criteria, report type and scope

We help you decide on the categories, Type 1 or Type 2 and the system boundary, based on what your customer asked for and what you can support.

Gap assessment against the criteria

We review each criterion and record how a control meets it, partly meets it or is missing, ranked by effort and by the questions an auditor will ask.

Closing the gaps

We work on access reviews, multi-factor sign-in, logging, change management, backups, incident response and vendor oversight. Policies are written for your organization; see security policies and vendor risk.

Evidence and system description

We organize the evidence folder by criterion and draft the system description for management to complete and approve against the description criteria.

During the examination

We help you answer the CPA firm's requests and follow up on exceptions. A penetration test of your application, which some customers expect next to SOC 2, is arranged on request and scoped separately.

Choosing the CPA firm for the SOC 2 audit

The SOC 2 audit is performed by CPAs in public practice, and you choose and contract the firm yourself.¹ Ask about licensing and quality review: the AICPA has said it will act when auditors have not performed audits in accordance with professional standards, have not been enrolled in peer review, or are unlicensed.³ In British Columbia, CPABC states that practitioners issuing CSAE 3416 service organization reports must hold the audit category of public practice licensing.⁵

Readiness work and the examination stay separate. We prepare, the CPA firm tests and forms its opinion, and the result depends on how your controls operate. That separation is what gives the report its value to your customers.

What you have in hand before the examination

Before the examination you hold a readiness report and a set of documents that belong to your company, written plainly for leadership with a technical appendix for engineering.

A readiness report with gaps, priorities and owners
A work plan with dates up to the start of the examination
Policies and process descriptions in your company's name
An evidence folder organized by criterion
A draft system description for management's review

Why a contracted team: the risks of SOC 2 preparation done alone, with a chatbot or a freelancer

Founders preparing alone tend to buy a compliance tool, accept its default policies and discover during fieldwork that the documents describe controls nobody runs. Exceptions in a Type 2 report stay in the report your customer reads.

A chatbot can write an access policy in seconds, yet it cannot see who holds production access, whether logs are kept or how changes reach customers, which is exactly what the CPA firm tests. A freelancer may set up the tool and leave before the observation period ends, with no one to answer the auditor's follow-up questions.

A contracted team works under a written scope letter, keeps dated records of each fix, hands everything to you and stays reachable through the examination. INNOVA CONSULT LTD. carries commercial general liability insurance, and the price is fixed before work begins.

Five plain reasons to trust us with this

A registered Canadian company
INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.
In practice since 2013
The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.
We run servers of our own
Our own servers and more than 80 websites are checked for known vulnerabilities every day.
Insured
Commercial general liability insurance of CAD 1 million is in force.
Your scope, your report
A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

Step 1

We agree what to check

A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

Step 2

You sign the scope letter

It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

Step 3

We check, and write it down

One report in plain words for you, with the technical detail attached for whoever looks after your systems.

Step 4

We fix it

We make the repairs ourselves, or together with your current IT provider or web developer.

Step 5

We check again

A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

Ask for a quote →

A fixed quote once the scope is agreed
The price in writing before work starts
A second check after the fixes

Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

Ask on a call

Is SOC 2 mandatory in Canada?

SOC 2 is voluntary in Canada: it comes from customer contracts and procurement questionnaires. CPABC notes that Canadian standards do not specifically include SOC 2-type reports, while a CSAE 3000 engagement can accomplish the same. If a customer asks for SOC 2, confirm which report type and which criteria it expects, and whether a Canadian or United States report suits it.

How long does it take to get a SOC 2 report?

It depends on how many controls already exist, the report type and the CPA firm's schedule. A Type 1 report can follow once controls are designed and in place. A Type 2 report covers a period chosen with the CPA firm, and the report comes after that period ends and testing is complete. After our gap assessment, the readiness timeline goes into the scope letter.

How much does SOC 2 compliance cost?

Two costs add up: readiness work and the CPA firm's examination fee, which the firm quotes separately. Our part depends on the number of criteria in scope, the size of the system, how much documentation exists and whether we also fix technical gaps. After a 30-minute conversation you receive a scope letter with a fixed price, and work starts only when you sign.

Who performs the SOC 2 audit?

An independent CPA firm, acting as service auditor, examines your system description and controls and issues the SOC 2 report with its opinion. You choose and contract the firm. INNOVA CONSULT LTD. is a separate party: we prepare your company before the examination and help during it, and the opinion belongs to the CPA firm alone.

Should we start with Type 1 or Type 2?

Type 1 looks at the design of controls as of a single date and suits a first report when a customer needs something soon. Type 2 adds operating effectiveness over a period and is what many larger customers ask for in the end. We usually recommend asking your customer first; the answer often settles the order.

Is SOC 2 a certification?

SOC 2 is an attestation report by a CPA firm, often called a certification in everyday speech. The report describes your system, states the CPA firm's opinion and, for Type 2, lists the tests performed and their results. Customers read it under the terms the report sets, and a new report is issued for each new period.

SOC 2 or ISO 27001 first?

Follow what your customers ask for in writing. A SOC 2 report answers a request for a CPA attestation, while ISO/IEC 27001 answers a request for a certificate from an accredited certification body. Policies, risk assessment and access controls built for one carry over to the other. If both are requested, we plan the work so one set of evidence serves both.

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

Book the free audit instead

Same day callback
Written permission first
Fixed quote