Packaging a SOC 2 readiness offer
Fixed fee wins the deal and loses the margin, unless the exclusions are written before the discovery call rather than after the first surprise.
Sell three things, not one: a fixed-fee assessment, a fixed-fee remediation and documentation engagement, and a monthly retainer through the observation window. In Canada in 2026 that is roughly $6,000 to $12,000 CAD for the assessment, $18,000 to $45,000 CAD for the build, and $2,500 to $6,000 CAD a month for the window. Selling one large number instead loses deals to sticker shock and hides the fact that most of your margin is in the third product.
$6k to $12k Gap assessment, fixed fee, CAD
$18k to $45k Readiness build, fixed fee, CAD
$2.5k to $6k Monthly through the window, CAD
What goes in each package?
| Deliverable | Assessment | Build | Retainer |
|---|---|---|---|
| Scope and system boundary decision | Recommended | Written and signed off | Maintained |
| Control gap analysis against the criteria | Yes, the whole product | Reused | Re-run annually |
| Dated remediation plan with owners | Yes | Driven to closure | Reviewed weekly |
| Policy set written to how they operate | No | Yes, 10 to 14 documents | Reviewed annually |
| System description narrative | Outline only | Yes, full draft | Updated for changes |
| Control implementation, hands on keyboard | No | Advisory, or priced separately | No |
| Evidence routine and folder structure | No | Yes | Operated with the client |
| Auditor selection support | No | Introductions | Request list management |
| Fieldwork support and auditor questions | No | No | Yes, the main value |
| Typical duration | 1 to 2 weeks | 8 to 16 weeks | 3 to 12 months |
| Fixed fee safe? | Assessment yes. Build yes with exclusions. Retainer only with a stated hours cap. | ||
The assessment is bought quickly by somebody who has not decided to trust you yet, so price it so that saying yes is not a procurement event. The build is where the work is. The retainer is where the margin is: by month three you are answering questions rather than producing documents, and it is the only one of the three that renews.
Where those engagements come from is a separate problem. Packaging only matters once a referrer can describe what you sell in one sentence.
How do you land on a number?
Estimate days, apply a rate, then sanity-check the total against what the audit costs. A readiness engagement that costs more than the audit itself is a hard sell in Canada whether or not the number is right. Buyers anchor on the audit fee because it is the number they were quoted first.
| Work | 10 to 25 staff | 25 to 75 staff | 75 to 200 staff |
|---|---|---|---|
| Scoping and system description | 2 to 3 days | 3 to 5 days | 5 to 8 days |
| Gap analysis | 3 to 4 days | 4 to 6 days | 6 to 10 days |
| Policy set | 4 to 6 days | 6 to 9 days | 9 to 14 days |
| Remediation guidance and follow-through | 5 to 8 days | 8 to 14 days | 14 to 25 days |
| Evidence routine setup | 2 to 3 days | 3 to 5 days | 5 to 8 days |
| Project management across the engagement | 3 to 4 days | 5 to 8 days | 8 to 14 days |
| Total | 19 to 28 days | 29 to 47 days | 47 to 79 days |
Canadian day rates for this work run $1,200 to $2,200 CAD for an independent practitioner and $1,800 to $3,000 CAD through a firm with a bench. Multiply and you will usually get a number above what the market pays. Narrow the scope, or accept a lower effective rate on the first few engagements. Do not solve it by estimating fewer days.
Deliver any of this under another firm's name and the rate arithmetic changes and the independence rules tighten. Subcontracting to CPA firms covers both.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
What has to be excluded in writing?
Every one of these has eaten a fixed fee. Name them in the statement of work as out of scope with a stated rate if the client wants them added.
- Implementing controls in their systems
- Advising that MFA must be enforced is readiness. Configuring their identity provider is engineering, and it is unbounded. Price it separately or refuse it.
- Additional trust services categories
- Quote the security criterion. Availability, confidentiality, processing integrity and privacy each add work, and privacy adds the most by a distance. If they add one in month two, it is a change order.
- A second framework
- ISO 27001, HIPAA or PCI arriving mid-engagement is a new engagement. The control overlap is real. The documentation overlap is not, and clients underestimate that.
- Remediation work performed by you
- Writing their incident response plan is in scope. Running their tabletop is arguably in scope. Rebuilding their offboarding process across four systems is not.
- Penetration testing
- Subcontract or refer it, and price it as a pass-through. Bundle it into a fixed fee and you carry the risk of a bad scope on somebody else's work.
- Anything after the report
- Year two is a renewal conversation, not an obligation. Say so, then have the conversation in month ten.
One exclusion that is worth abandoning
Many firms exclude auditor liaison from the build package and then answer the auditor's questions for free, because the client forwards the email. Include a capped number of hours, or price the retainer so the client has an obvious place to send it. Excluding it on paper and doing it anyway is the most common way readiness margin leaks.
Fixed fee or time and materials?
Fixed fee for the assessment and the build. The buyer is spending money to remove uncertainty and a variable quote reintroduces it. The exception: fixed fee is a bad idea when the client has more than two production environments, has never had a security owner, or is coming off a failed attempt with another consultant. Each of those roughly doubles the variance, and a fixed fee on doubled variance is a bet rather than a price.
For those, sell the assessment fixed and quote the build afterwards. The assessment is the discovery you would otherwise be doing for free during scoping, and it lets you price the second phase against something real.
What changes the price?
| Factor | Effect | Why |
|---|---|---|
| No single identity provider | Add 15 to 25 percent | Every system becomes a separate user list, review and offboarding step |
| Two or more clouds | Add 20 to 30 percent | Infrastructure evidence roughly doubles rather than growing a little |
| On-premises or colocation footprint | Add 10 to 20 percent | Physical access controls become a section that did not exist |
| Quebec personal information in scope | Add 5 to 15 percent | Law 25 documents have no SOC 2 equivalent and clients rarely have them |
| Health information held for a custodian | Add 10 to 20 percent | Provincial health privacy law adds agent obligations and a separate agreement review |
| A compliance platform already in place | Subtract 10 to 20 percent | Configuration evidence and policy scaffolding are partly done |
| Under 15 people, single cloud, one product | Subtract 20 to 30 percent | Genuinely less to look at, and the honest price should reflect it |
| Deadline inside 90 days | Add 20 percent or decline | Compressed work costs more to deliver and fails more often, and the failure is attributed to you |
The Quebec and health rows are where a Canadian practice can charge properly and a US-based competitor cannot quote at all. Both are covered from the buyer's side on SOC 2 and Law 25, which is worth sending to a prospect who does not know the obligation exists.
What should a SOC 2 gap assessment cost in Canada?
$6,000 to $12,000 CAD for a company of 10 to 75 people, delivered in one to two weeks. Below $6,000 the work is a questionnaire rather than an assessment, and above $12,000 you are competing with a full readiness engagement on price.
Should I publish my prices?
Publish a floor, not a rate card. "From $18,000 CAD" filters out the companies with a $5,000 budget before a discovery call, which is most of the benefit, without committing you to a number before you know how many clouds they run.
Do I need my own policy templates?
Yes, and they need to be yours rather than a downloaded American pack. The templates are not the product, the tailoring is, but starting from a set you wrote saves days per engagement and the Canadian obligations are already in them. The buyer-side view of why packs fail is on policy templates.
How do I price the observation window months?
A monthly retainer with a stated hours cap, priced so that a quiet month is profitable and a busy month is not painful. Between $2,500 and $6,000 CAD a month covers most Canadian engagements, and the cap is what stops the last month of fieldwork from consuming the whole margin.
List your firm
Buyers on this site are shortlisting readiness help. A claimed listing is free, and the Verified price is published before you fill anything in.
List your firm