SOC 2 audit firms in Canada
Firms in the GetSOC2 directory that do SOC 2 audit work, ordered by tier and then alphabetically.
37 firms.
SOC 2 audit firms in Canada
Johanson Group LLP Verified
A licensed US CPA firm running SOC 1, SOC 2 and SOC 3 examinations and accredited as an ISO 27001 certification body, working mostly with early-stage technology companies.
MHM Professional Corporation Verified
A licensed Canadian CPA firm that performs SOC attestations and is an SCC-accredited certification body for ISO standards, including the first Canadian accreditation for ISO/IEC 42001 AI governance audits.
360 Advanced Unclaimed
A licensed Florida CPA firm (licence AD67897, PCAOB registered) that performs SOC 2 examinations and signs the attestation opinion, alongside ISO, HIPAA, PCI DSS, NIST and FedRAMP work.
A-LIGN Unclaimed
Certification body accredited by ANAB and UKAS to audit and issue ISO/IEC 27001 certificates, and also offering ISO/IEC 42001 certification.
AARC-360 Unclaimed
A PCAOB registered CPA firm with an AICPA peer review report that performs SOC 1, SOC 2 and SOC 3 examinations and signs the opinion.
Aprio Unclaimed
Aprio LLP is a licensed independent CPA firm providing attest services, and its team reports more than 10,000 SOC reports completed including SOC 2 Type II audits.
Assurance Dimensions Unclaimed
A licensed independent CPA firm that provides attest services and performs SOC 1 and SOC 2 audits as well as readiness work through its IT advisory group.
Auditwerx Unclaimed
Attest and audit services are provided by Auditwerx LLC and Carr Riggs & Ingram LLC as CPA firms, covering SOC 1, SOC 2 and SOC 3 examinations plus PCI DSS, HIPAA, HITRUST, NIST CSF, CMMC and ISO 27001.
Boulay Unclaimed
A CPA firm with 107 CPAs whose risk advisory group delivers SOC 1, SOC 2 and SOC 3 reporting along with ISO 27001 compliance and Microsoft SSPA attestations.
Cherry Bekaert Unclaimed
Cherry Bekaert LLP is a licensed independent CPA firm providing attest services, including SOC reporting engagements that it signs.
CLA (CliftonLarsonAllen) Unclaimed
A licensed CPA firm that performs SOC 1, SOC 2 and SOC 2+ examinations, including a readiness assessment before the examination.
ConstellationGRC Unclaimed
California CPA firm, ConstellationGRC CPA PC, licensed by the California Board of Accountancy, that performs SOC 2 examinations and signs the resulting report.
CyberCrest Compliance Unclaimed
Licensed CPA firm registered with the AICPA that issues SOC 2 attestation reports and also provides readiness work; states it serves clients in the US, Canada, Europe and APAC.
Doane Grant Thornton Unclaimed
Canadian accounting and business advisory LLP whose third party assurance practice issues SOC 1, SOC 2 and SOC 3 control reports, so the firm signs the attestation opinion rather than only preparing clients for the audit.
Doeren Mayhew Unclaimed
A licensed independent CPA firm that performs SOC 2 Type 1 and Type 2 examinations and signs the report opinion.
Eide Bailly Unclaimed
A licensed independent CPA firm providing attest services, including SOC 2 reports against the AICPA trust services criteria.
EY Canada Unclaimed
The technology risk assurance practice of EY Canada performs SOC 1, SOC 2 and SOC 3 engagements and issues the resulting attestation reports, so the firm signs the opinion rather than only preparing clients for the audit.
Fine Assurance Unclaimed
Fine CPA LLC, doing business as Fine Assurance, is a licensed Pennsylvania CPA firm that performs and signs SOC 2 Type 1, Type 2, SOC 2+ and SOC 3 reports.
GRF CPAs & Advisors Unclaimed
An independent public accounting firm that performs SOC 2 Type 1 and Type 2 audits and signs the report opinion.
IS Partners Unclaimed
Describes itself as a CPA firm specializing in IT compliance that performs SOC 1, SOC 2 and SOC 3 audits, with ISO 27001, ISO 42001, penetration testing and virtual CISO services. Now part of Axiom GRC.
Kaufman Rossin Unclaimed
A CPA and advisory firm that performs SOC 1, SOC 2 and SOC 3 examinations, including Type 1 and Type 2 testing, and signs the opinion.
KirkpatrickPrice Unclaimed
A licensed CPA firm that performs SOC 1 and SOC 2 audits and signs the opinion, and also delivers penetration testing plus ISO 27001, ISO 42001, HIPAA, PCI DSS and NIST assessments.
Lazarus Alliance Unclaimed
States it is a fully licensed CPA firm specializing in SOC 1 and SOC 2 audits, with licensed CPAs leading engagements, and also offers gap and readiness assessments and remediation support.
LBMC Unclaimed
A licensed CPA firm that performs SOC 1, SOC 2, SOC 3 and SOC for Cybersecurity examinations under SSAE 18 and signs the report opinion.
Linford & Company Unclaimed
A Certified Public Accounting firm founded in 2008 that issues SOC 1 and SOC 2 reports, and also performs ISO 27001, ISO 42001, HIPAA, PCI DSS, HITRUST, FedRAMP and penetration testing engagements.
McKonly & Asbury Unclaimed
A Pennsylvania certified public accounting firm with a dedicated SOC practice that performs SOC 2 audits and signs the opinion.
Render Compliance Unclaimed
Licensed CPA firm in Washington State that performs SOC 2 attestations and signs the report, and also runs gap assessments to determine readiness before fieldwork.
Richey May Unclaimed
A licensed independent CPA firm providing attest services, with a SOC audit team that performs SOC 1, SOC 2 and SOC 3 engagements.
Sage Audits Unclaimed
A Colorado licensed CPA firm (licence FRM.5000785) that performs SOC 2 examinations and signs the report opinion, working mainly with SaaS companies.
Schellman Unclaimed
Assessment firm combining penetration testing and red teaming with SOC 2 ISO 27001 and ISO 42001 audit and certification services.
Schneider Downs Unclaimed
A Top 60 independent CPA firm that performs SOC 2 Type 1 and Type 2 examinations and issues the opinion on the description, design and operating effectiveness of controls.
Sikich Unclaimed
Sikich CPA LLC is a licensed CPA firm providing audit and attest services, and the cybersecurity practice performs service provider reviews covering SOC 1, SOC 2 and SOC 3 plus PCI DSS, HIPAA and penetration testing.
Tanner LLC Unclaimed
A CPA and consulting firm whose IT assurance practice performs SOC 1 and SOC 2 examinations and signs the report opinion.
Throughline Unclaimed
A registered CPA firm and certification body that performs SOC 1 and SOC 2 audits and signs the report, and also covers ISO 27001 and ISO 42001.
Withum Unclaimed
WithumSmith+Brown PC performs SOC 2 Type I and Type II attestations with independent reporting by AICPA licensed CPAs, and also runs SOC 1, SOC for Cybersecurity and ISO 27001 consulting.
Wolf & Company PC Unclaimed
An accounting firm whose assurance practice issues SOC 1, SOC 2 and SOC 3 reports and agreed upon procedures, with work subject to AICPA peer review and the AICPA Enhanced Oversight Program for SOC reporting.
Zero Day CPA Unclaimed
A CPA-led audit practice that performs SOC 1, SOC 2 Type I and Type II and SOC 3 examinations and signs the report, and also offers penetration testing and HIPAA work.
Get quotes instead of browsing
Describe what you need once and it reaches the firms on this page that match it.
Get quotesOther ways to narrow the list
Same directory, cut a different way.
- AI security firms in Canada, 5 firms
- Cloud compliance firms in Canada, 10 firms
- Compliance advisory firms in Canada, 67 firms
- ISO 27001 firms in Canada, 37 firms
- ISO 42001 firms in Canada, 13 firms
- Penetration testing firms in Canada, 23 firms
- Canadian privacy firms in Canada, 4 firms
- Security questionnaires firms in Canada, 6 firms
- SOC 2 readiness firms in Canada, 51 firms
- Trust center firms in Canada, 6 firms
- vCISO firms in Canada, 18 firms
- SOC 2 firms in California, 4 firms
- SOC 2 firms in Colorado, 4 firms
- SOC 2 firms in Florida, 7 firms
- SOC 2 firms in Ontario, 11 firms
- SOC 2 firms in Pennsylvania, 4 firms
How do I know I can trust one of these firms?
Judge the website the way you would judge a report they wrote for you, because it is the only sample of their work you get free. Look for past work in specifics, an address in every country they claim, writing that could only be about them, and named people doing the work. None is proof alone; two together is a reason to ask direct questions. The four checks in full.
How were these firms chosen?
They were listed from public information or added by the firm itself. Being listed is not a recommendation, and GetSOC2 does not rank firms by quality. Verified listings sit above free ones and the order inside each band is fixed.
Does it cost anything to get quotes?
No. Buyers are never charged. Firms can pay for a Verified listing, and higher-intent enquiries are offered to free listings for a fee, which is how the site is funded.
How many firms should I approach?
Three is the number that makes a quote comparable. One quote tells you a price, and two tell you which is cheaper. Three tells you what the work actually costs and which firm understood your scope.