SOC 2 readiness consultants in Edmonton

What is different about preparing for a SOC 2 audit from Edmonton: who is asking you for the report, which privacy statute sits underneath it, and what that does to your scope.

Last reviewed 2026-08-31Written by Jacob Masse, TrazTech Inc.

A consultant-led SOC 2 readiness program for an Edmonton company runs roughly $20,000 to $60,000 CAD. An assessment and a gap list, with nobody running the program for you, runs $5,000 to $20,000 CAD. Alberta firms price inside that national range. Price is not what changes in Edmonton. Scope is, because scope here is set by health technology buyers, by public sector contracts and by PIPA (Alberta), and the money follows scope.

Alberta's PIPA governs private-sector personal information, and health information is separately governed by the Health Information Act, which matters for any company touching custodian data in the province.

What triggers a first SOC 2 in Edmonton

Demand around Edmonton comes from health technology, public sector, artificial intelligence research, energy services. The pattern across those sectors is worth naming: an Alberta company gets pushed into SOC 2 by a customer attaching a security schedule, not by a regulator enforcing PIPA (Alberta). That schedule usually says what it wants. Read it first. It tells you whether the health technology buyer needs a Type 1 now or a Type 2 by a date, and whether public sector expects any criterion beyond security, which decides half of an Edmonton budget.

Sector shapes what an auditor looks at. health technology buyers ask one short list repeatedly: who holds production access, how changes get approved, what happens to data when an Edmonton contract ends, whether an independent penetration test exists. public sector buyers add a questionnaire on top. artificial intelligence research buyers arrive with neither and take whatever the PIPA (Alberta) policy set says. Building controls around those commitments is not gaming the audit. It is scoping around promises already made to Edmonton customers in Alberta.

What moves with geography is the deadline. An health technology buyer negotiating from Edmonton usually hands over a renewal date to work back from. An artificial intelligence research buyer usually does not. Get that date written down early, read the timeline, count backwards. The observation window is calendar time. No Alberta firm shortens it for an Edmonton client at any price, whatever AB sales copy suggests.

PIPA (Alberta) and what it does to your scope

A company operating in Alberta answers to PIPA (Alberta) for private-sector personal information, and to HIA where health data is in play. SOC 2 replaces neither. It tests neither, since the security criterion asks about controls, not about Alberta statutory duties. They intersect anyway: breach notification under PIPA (Alberta), retention limits under HIA, and whatever an Edmonton customer was promised, all landing inside one policy set.

The practical effect lands on scope. Where personal information subject to PIPA (Alberta) flows through a system, excluding that system from an Alberta audit is hard to do with a straight face, whatever the architecture diagram in Edmonton says. Decide it deliberately while writing the system description, not when an auditor asks where Edmonton customer records actually live. That single decision moves an AB quote more than any other.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

Hire in Edmonton, hire remotely, or do it yourself

Readiness work is nearly all remote, so an Edmonton address rarely decides anything. On-site time earns its cost twice in Alberta: when physical security controls are in scope because you run your own space or hardware, and when a team works better with somebody in the room for the scoping week. Otherwise judge a firm on whether it has taken an AB company like yours through this, and whether it treats PIPA (Alberta) properly rather than defaulting to American guidance written for neither Alberta nor Edmonton.

In house suits a smaller Edmonton team: one cloud, one product, no HIA exposure, somebody technical holding a few protected hours weekly. Work the checklist, which ticks and remembers where you got to. Score the six control areas on the readiness scorecard before committing an Alberta window date. Buy a readiness assessment near the end for an independent read, the cheapest insurance an AB company puts on a first audit. The national guide covers when hiring help is worth it and what to ask, and Alberta firms appear in the directory as they are checked.

Whoever prepares you cannot audit you. Independence rules keep the two engagements apart, so an Edmonton company plans on two suppliers, two invoices, two sets of Alberta paperwork. Auditor selection is a separate decision, covered on GetSOC2 rather than here.

If HIA is in play

HIA sits outside SOC 2, and outside PIPA (Alberta) too. An Edmonton company holding health records for a clinic, a hospital or an insurer usually inherits its duties through the custodian agreement rather than from HIA directly. Read that agreement in Alberta before writing a single policy: it commonly names retention periods, notification timing and audit rights stricter than the Trust Services Criteria ask for. Where health technology or public sector work touches patient records, add two to four weeks of Edmonton scoping and expect the audited system to be larger than you first drew it in AB.

What to ask a firm quoting Alberta work

1. Give three candidates one written scope: headcount, systems in scope, criteria, the intended window, the date a report must exist by, and whether PIPA (Alberta) data sits inside it. Quotes priced on different scopes cannot be compared, which is most of the variation Edmonton firms report in AB.
2. Ask which Alberta companies they have taken through this, and whether any were in health technology or public sector. Sector experience is worth more than a local address.
3. Ask how PIPA (Alberta) is handled in the policy set, by name, and how HIA is handled if health data moves through Alberta. A firm answering on American breach wording has told you which pack it ships.
4. Ask who collects evidence during the window. A firm that leaves when the window opens has left before the hard part.
5. Ask what you are handed at the end, and whether the policies are templates or written against how you actually operate in Edmonton.

The rest of the country

Work the shortlist outward before you commit an afternoon to the wrong two firms. Practices that run readiness in Edmonton take the same engagements in Calgary, Saskatoon and Vancouver, and a round of calls across those three usually turns up the second quote that makes the first one negotiable. Read those pages beside Edmonton when buyers sit outside Alberta. The statute deciding an argument is usually the one on the buyer's side, not PIPA (Alberta) on yours, and public sector contracts test that.

Common questions