SOC 2 auditor and consultant directory

The directory lists two different kinds of firm: CPA firms licensed to issue a SOC 2 report, and readiness consultants who get you ready for one. It is empty today, and this page says exactly what will fill it.

Last reviewed 2026-08-16Written by Jacob Masse, TrazTech Inc.

There are no firms in this directory yet. It launched empty and we are not going to pad it with scraped company records, because a directory whose entries nobody has checked is worse than no directory. This page explains what will be listed, how a firm gets in, and what the difference is between the two kinds of firm you are choosing between.

If you need quotes now rather than a list to read, the quote request form puts your scope in front of Canadian firms that do this work. If you want to understand what you are buying first, the guide to choosing a SOC 2 auditor covers independence, fees and the questions worth asking, and links to a page for each of twenty Canadian cities.

What this directory lists

Two categories, kept separate on purpose.

Audit firms. CPA firms that perform SOC 2 examinations and sign the opinion. In Canada that means a firm registered with a provincial CPA body and carrying the practice rights to perform assurance and attestation engagements. A listing here will record which provinces the firm is registered in, whether it performs Type 1 and Type 2 engagements, which Trust Services Criteria it covers, and whether it also audits ISO 27001 or other frameworks through an affiliated body.

Readiness consultants. Firms and independent practitioners who do the preparation work: gap assessment, policy writing, control design, remediation project management, evidence collection, and sitting beside you during fieldwork. They cannot audit you. A listing here will record what engagement models the firm offers, whether it works with a compliance platform, and what size of company it usually serves.

Listings will also carry the city or cities a firm actually serves. Most of this work is remote, so location matters less than people expect, but it still matters for on-site control testing and for firms that prefer clients in one time zone.

Auditor or consultant, and why you cannot use one firm for both

This is the distinction most companies get wrong on their first audit, and it is not a marketing nuance. The auditor has to be independent of the controls being audited. A firm that wrote your policies, designed your access review process and built your evidence collection cannot then issue an opinion on whether those controls work, because it would be auditing its own work.

Some large firms sell both through separate teams and claim a wall between them. Treat that claim carefully. It can be legitimate, and the professional standards allow certain non-attest services under conditions, but the safe answer for a small company is two firms. Buyers reading your report do not know your internal governance and a reviewer who spots the same firm on both sides will ask about it. The full cost picture for both is on the SOC 2 cost page, and SOC2Prep covers the readiness work itself if you plan to do it without a consultant.

What a listing will look like

The two rows below are examples, not real firms. The names are invented to show the format and the difference between the two listing states.

Nothing above is a firm. When real listings exist, this page will carry them in the same two states and the badge will mean what it says here.

How listings work

A basic listing is free. Firm name, category, the provinces and cities served, what the firm does, and a link. We do not charge to be in the directory and a firm's position in it is not for sale.

Claiming a listing means somebody at the firm confirms the detail is right and takes responsibility for keeping it current. An unclaimed listing is one we assembled from public information, and it carries the unclaimed badge so a reader knows the difference. Claiming is free and is done by writing to [email protected] from a company address.

Verified is a further step and it is the only badge that means we did work. For an audit firm, verification means we confirmed the firm is registered with a provincial CPA body and holds the practice rights for assurance engagements, and that a person at the firm confirmed what it audits. For a consultant, it means we confirmed the business is real, spoke to somebody, and checked the firm actually delivers the services claimed rather than reselling somebody else's. Verified is not a quality rating. It says the firm exists and is what it says it is. It does not say the firm is good, and no badge on this site is an endorsement.

Firms that respond to quote requests through this site are the ones most likely to appear first, because a firm that answers a real request has already told us what it does and who it serves.

How to choose between firms once there are firms to choose between

Shortlist three, not one and not eight. Give each the same scope in writing: headcount, the systems in scope, which Trust Services Criteria, whether you want Type 1 first, and the date the report has to exist by. Quotes that price different scopes cannot be compared, and most of the wild variation companies report comes from exactly that.

Ask an audit firm who signs the opinion and whether that partner has audited a company built like yours. Ask how many SOC 2 engagements the firm ran last year. Ask what renewal pricing looks like in year two and get it in writing before you sign year one, because renewals are where a cheap first-year quote gets recovered. Ask what happens if the auditor finds an exception during fieldwork and how that changes the timeline.

Ask a consultant what they will hand over at the end, whether the policies are templates or written against how you actually operate, and who does the evidence collection. A consultant who leaves you with a policy set nobody follows has made your audit harder, not easier. If the underlying problem is that nobody internally owns security, a fractional CISO is usually a better answer than a fixed-length readiness project.

Two things to walk away from: a firm that quotes a fixed price before asking what is in scope, and a firm that promises a clean opinion. Nobody can promise the outcome of an audit they have not performed, and a firm that does is either not doing the work or not planning to report what it finds.

Common questions