SOC 2 readiness consultants in Calgary

What is different about preparing for a SOC 2 audit from Calgary: who is asking you for the report, which privacy statute sits underneath it, and what that does to your scope.

Last reviewed 2026-08-31Written by Jacob Masse, TrazTech Inc.

A consultant-led SOC 2 readiness program for a Calgary company runs roughly $20,000 to $60,000 CAD. An assessment and a gap list, with nobody running the program for you, runs $5,000 to $20,000 CAD. Alberta firms price inside that national range. Price is not what changes in Calgary. Scope is, because scope here is set by energy buyers, by industrial control systems contracts and by PIPA (Alberta), and the money follows scope.

Alberta's Personal Information Protection Act applies instead of PIPEDA, and it is the only Canadian private-sector privacy law that has required breach notification to the provincial commissioner since 2010. Calgary's energy sector also brings operational technology into scope more often than a pure software audit would.

What triggers a first SOC 2 in Calgary

Demand around Calgary comes from energy, industrial control systems, logistics, agricultural technology. The pattern across those sectors is worth naming: an Alberta company gets pushed into SOC 2 by a customer attaching a security schedule, not by a regulator enforcing PIPA (Alberta). That schedule usually says what it wants. Read it first. It tells you whether the energy buyer needs a Type 1 now or a Type 2 by a date, and whether industrial control systems expects any criterion beyond security, which decides half of a Calgary budget.

Sector shapes what an auditor looks at. energy buyers ask one short list repeatedly: who holds production access, how changes get approved, what happens to data when a Calgary contract ends, whether an independent penetration test exists. industrial control systems buyers add a questionnaire on top. logistics buyers arrive with neither and take whatever the PIPA (Alberta) policy set says. Building controls around those commitments is not gaming the audit. It is scoping around promises already made to Calgary customers in Alberta.

What moves with geography is the deadline. An energy buyer negotiating from Calgary usually hands over a renewal date to work back from. An logistics buyer usually does not. Get that date written down early, read the timeline, count backwards. The observation window is calendar time. No Alberta firm shortens it for a Calgary client at any price, whatever AB sales copy suggests.

PIPA (Alberta) and what it does to your scope

A company operating in Alberta answers to PIPA (Alberta) for private-sector personal information, and to HIA where health data is in play. SOC 2 replaces neither. It tests neither, since the security criterion asks about controls, not about Alberta statutory duties. They intersect anyway: breach notification under PIPA (Alberta), retention limits under HIA, and whatever a Calgary customer was promised, all landing inside one policy set.

The practical effect lands on scope. Where personal information subject to PIPA (Alberta) flows through a system, excluding that system from an Alberta audit is hard to do with a straight face, whatever the architecture diagram in Calgary says. Decide it deliberately while writing the system description, not when an auditor asks where Calgary customer records actually live. That single decision moves an AB quote more than any other.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

Hire in Calgary, hire remotely, or do it yourself

Readiness work is nearly all remote, so a Calgary address rarely decides anything. On-site time earns its cost twice in Alberta: when physical security controls are in scope because you run your own space or hardware, and when a team works better with somebody in the room for the scoping week. Otherwise judge a firm on whether it has taken an AB company like yours through this, and whether it treats PIPA (Alberta) properly rather than defaulting to American guidance written for neither Alberta nor Calgary.

In house suits a smaller Calgary team: one cloud, one product, no HIA exposure, somebody technical holding a few protected hours weekly. Work the checklist, which ticks and remembers where you got to. Score the six control areas on the readiness scorecard before committing an Alberta window date. Buy a readiness assessment near the end for an independent read, the cheapest insurance an AB company puts on a first audit. The national guide covers when hiring help is worth it and what to ask, and Alberta firms appear in the directory as they are checked.

Whoever prepares you cannot audit you. Independence rules keep the two engagements apart, so a Calgary company plans on two suppliers, two invoices, two sets of Alberta paperwork. Auditor selection is a separate decision, covered on GetSOC2 rather than here.

If HIA is in play

HIA sits outside SOC 2, and outside PIPA (Alberta) too. A Calgary company holding health records for a clinic, a hospital or an insurer usually inherits its duties through the custodian agreement rather than from HIA directly. Read that agreement in Alberta before writing a single policy: it commonly names retention periods, notification timing and audit rights stricter than the Trust Services Criteria ask for. Where energy or industrial control systems work touches patient records, add two to four weeks of Calgary scoping and expect the audited system to be larger than you first drew it in AB.

What to ask a firm quoting Alberta work

1. Give three candidates one written scope: headcount, systems in scope, criteria, the intended window, the date a report must exist by, and whether PIPA (Alberta) data sits inside it. Quotes priced on different scopes cannot be compared, which is most of the variation Calgary firms report in AB.
2. Ask which Alberta companies they have taken through this, and whether any were in energy or industrial control systems. Sector experience is worth more than a local address.
3. Ask how PIPA (Alberta) is handled in the policy set, by name, and how HIA is handled if health data moves through Alberta. A firm answering on American breach wording has told you which pack it ships.
4. Ask who collects evidence during the window. A firm that leaves when the window opens has left before the hard part.
5. Ask what you are handed at the end, and whether the policies are templates or written against how you actually operate in Calgary.

The rest of the country

Work the shortlist outward before you commit an afternoon to the wrong two firms. Practices that run readiness in Calgary take the same engagements in Edmonton, Vancouver and Regina, and a round of calls across those three usually turns up the second quote that makes the first one negotiable. Read those pages beside Calgary when buyers sit outside Alberta. The statute deciding an argument is usually the one on the buyer's side, not PIPA (Alberta) on yours, and industrial control systems contracts test that.

Common questions