MHM Professional Corporation, SOC 2 audit
A licensed Canadian CPA firm that performs SOC attestations and is an SCC-accredited certification body for ISO standards, including the first Canadian accreditation for ISO/IEC 42001 AI governance audits.
MHM Professional Corporation also offers ISO 27001, ISO 42001 and compliance advisory. This page covers the SOC 2 audit side of what they do, because that is what GetSOC2 is about.
The listing
| Services | SOC 2 audit, ISO 27001, ISO 42001, Compliance advisory |
|---|---|
| Frameworks | SOC 2, ISO 27001, ISO 42001, PIPEDA |
| Based in | Calgary, Alberta |
| Website | mhmcpa.ca |
| Verified since | 2026-09-01 |
What to check before you hire them
This is general advice about the kind of work MHM Professional Corporation offers, not a judgement about the firm. Ask any firm the same questions and compare the answers.
- They sign the opinion
- This is a CPA firm, so it can issue the report rather than prepare you for it. Independence rules mean the firm that audits you cannot also have built your controls, so if you want help getting ready, that has to come from somewhere else. Ask which CPA body licenses the practice, whether it is enrolled in peer review, and who actually signs: a partner has to, and on some engagements you never meet them.
Working with a firm in Calgary, Alberta
Almost all of this work is done remotely, so treat location as a tie-breaker rather than a filter. Where it does matter: a firm in your own province knows the privacy statute you sit under without being briefed, timezone overlap decides how painful evidence chasing gets, and some buyers and public-sector procurement ask where data and staff are. If none of those apply to you, widen the search.
This listing is not written by the firm
It was compiled from public information, so treat it as a starting point rather than a statement from MHM Professional Corporation. This listing stays with the directory and is not handed over to the firm to write, because a listing a firm controls is advertising. If something here is factually wrong, MHM Professional Corporation or anyone else can write to [email protected] and we will check it and correct it.
Get a quote from MHM Professional Corporation
Tell us what you need and we will put it in front of MHM Professional Corporation and the other firms in the directory that match it. There is no charge to you.
Get a quoteBrowse the rest of the list
MHM Professional Corporation appears on these pages alongside comparable firms.
- Compliance advisory firms in Canada, 67 firms
- ISO 27001 firms in Canada, 37 firms
- ISO 42001 firms in Canada, 13 firms
- SOC 2 audit firms in Canada, 37 firms
Other firms doing this work
TrazTech Inc., Johanson Group LLP, 13 Security, 360 Advanced, 3Tenets Consulting, 7 River Systems
How do I know I can trust a firm like this?
Judge the website the way you would judge a report they wrote for you, because it is the only sample of their work you get for free. Four things to look for:
Past work, in specifics. Named clients, case studies, redacted sample reports, published research, CVEs, conference talks. A security or compliance firm that has done the work has something to show for it. A site that describes the service at length and never once shows the output of it is the single biggest red flag on this list.
An address in every country they claim. If a firm says it operates somewhere, it should show a street address there, and named people working from it. A country page with no address, no staff and no local clients is a marketing page, not an office, and the work will be delivered from wherever they actually are. That is fine if they say so, and a problem if they do not.
Writing that could only be about them. Generic copy that could have its name swapped for any competitor's, or the flat and tireless prose of an unedited language model, usually means nobody senior has looked at the page. Ask yourself whether any of it commits them to anything a client could hold them to.
People with names. Who leads the work, what they have done before, and are they findable outside the site. Testing and audit work is done by individuals, and a firm that will not name them is asking you to buy a logo.
None of these is proof on its own. Two or more together is a reason to ask direct questions before you sign anything, and to compare at least three firms. There is a longer version, with what to ask for in each case, on how to vet a firm.
Is this firm recommended by GetSOC2?
No. A listing is not a recommendation. MHM Professional Corporation carries a Verified listing, and nothing on this page is an endorsement of the firm or a statement that it is the right one for you. Compare at least three.
Does MHM Professional Corporation pay to appear here?
Not for this listing. Verified is normally the paid tier, and this firm was verified at no charge. Either way the badge does not buy a position within the tier, and it does not buy anything written about the firm on this page.
How do I get a quote from them?
Use the form linked above. It goes to the firms whose services match what you describe, which includes this one. You are never charged for a quote.