Compliance work goes wrong in one of two directions: nothing gets done until an auditor books a date, or a consultant sells you a framework you did not need.

Working out what actually applies

PIPEDA applies to almost every Canadian business. SOC 2 and ISO 27001 are usually customer-driven. PHIPA applies if you hold Ontario health records, and cyber insurance now imposes controls of its own. We start by cutting the list to what you are genuinely bound by.

Evidence collected as you go

The expensive part of an audit is reconstructing twelve months of evidence in three weeks. Access reviews, patch records, training completion and incident logs are captured continuously, so the audit is a report rather than a project.

What auditors actually ask for

Policies that match what your systems really do, proof the controls ran, and a record of exceptions with who approved them. We prepare all three and sit with you through the questions.

Common questions

Can you certify us?

No, and be wary of anyone who says they can. Certification comes from an independent auditor. We prepare the evidence and the controls, then support you through their process.