Governance, Risk and Compliance in Canada
Trusted by
Which of these is costing you right now?
Four of the reasons Canadian mid-market teams call us. If one of these is yours, the page below says which piece of work fixes it.
A client made SOC 2 a condition of renewal
The deal isn't at risk, the renewal is, and the auditor's calendar is the binding constraint. Nobody starts SOC 2 with enough runway.
Three frameworks, three teams, and the same evidence twice
Your security lead answers the same control question for ISO, SOC 2 and a client questionnaire. That duplication is the entire argument for doing this once.
Nobody can say whether Quebec's law applies to you
Law 25 can reach a company with no Quebec office at all. Plenty of Ontario companies have never checked whether they're inside it.
Your biggest vendor got breached and you're guessing
You signed a contract with a security schedule and never exercised it. Now you need an answer for your own board by Friday.
Pick the piece you need, or the whole programme.
Every governance risk and compliance service in this practice, with what it covers and who's asking for it.
- Privacy Impact Assessment (PIA)Privacy impact assessment for Canadian institutions and their vendors, written to the rule that actually binds them.
- Third-Party Risk ManagementThird party risk management for Canadian organisations, covering the subcontractors and concentration OSFI B-10 asks about.
- Bill C-26 ReadinessBill C-26 became Bill C-8, now Canadian law, and designation starts a 90-day statutory clock.
- ISO 42001 AI Management SystemISO 42001 for Canadian organisations, from an AI system inventory to a certificate an accredited body signs.
- Quebec Law 25 ComplianceLaw 25 Quebec compliance for Canadian businesses, where retention rules, incident registers and portability requests actually work.
- CMMC ComplianceCMMC compliance for Canadian suppliers in the US defence chain, built on the controls that survived the suspension.
- NIST Cybersecurity FrameworkNIST Cybersecurity Framework for Canadian organisations, starting with the Function CSF 2.0 put at the centre.
- ISO 27001 Certification SupportISO 27001 certification support in Canada, from the first scope decision to the audit an accredited body runs.
- ISO 22301 Business ContinuityISO 22301 business continuity for Canadian organisations, built so the business impact analysis and the infrastructure agree.
- CPCSC Certification SupportCPCSC certification support for Canadian defence suppliers, from the Level 1 self-assessment through to ITSP.10.171 gap closure.
- SOC 2 Compliance ServicesSOC 2 compliance for Canadian companies, scoped down to what your customers actually asked for, then evidenced.
- PIPEDA CompliancePIPEDA compliance for Canadian organisations, built to still hold when Bill C-36 replaces the Act.
What governance risk and compliance actually covers.
Three groups, twelve frameworks, one evidence base. Most of the saving in governance risk and compliance comes from the last part rather than the first two.
Certification and attestation
The certificates and reports your buyers put in a contract. SOC 2, ISO 27001, ISO 42001 for AI, and the two defence supply chain programmes, CMMC and CPCSC. Pick the one your market asks for, because certifying against the wrong standard is a real and common expense.
Privacy and personal data
What you're already subject to, whether or not anybody has checked. PIPEDA federally, Quebec's Law 25 if you touch personal data of people there, and a privacy impact assessment before you launch anything new. This is the group companies discover late, usually because a customer asked.
Risk and resilience
Whether you'd survive it going wrong, and whether you could prove it. NIST CSF as the structure, ISO 22301 for continuity, third-party risk for vendors who can reach your data, and readiness for Canada's critical cyber systems law. Risk is the group boards ask about and nobody budgets for.
Does Governance, Risk and Compliance work the same way in every industry?
No. The Governance, Risk and Compliance work is the same craft in every sector, but the conditions around it are not. In financial services that means OSFI's technology and cyber risk rules; in government, Protected A, B and C data handling; and in defence and aerospace, controlled goods rules, CMMC and the flow-down from your prime. We keep the service and change the part that bends.
OSFI's technology and cyber risk rules set what an examiner will ask to see.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Protected A, B and C data handling decides where the work can run and who can touch it.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
Controlled goods rules, CMMC and the flow-down from your prime set what a supplier can do.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
Health information sits under provincial privacy law, and your IT provider is usually the custodian's agent.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
Solicitor-client privilege decides how a firm can handle its data.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
By the numbers
Years of experience
Enterprise deployments
Senior engineers
Support
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow a governance risk and compliance engagement runs.
Four stages. The first one usually shortens the list, which is not what people expect from a compliance quote.
Engagement phases
Phases 01 to 04
Find out what actually applies
We work out which of these you're legally subject to, which your buyers demand, and which somebody added because it sounded prudent. The third category is usually the biggest.
Build one evidence base
Controls get written once and mapped to every framework that needs them, so the same access review answers ISO, SOC 2 and the questionnaire. This is where the money is saved.
Close the gaps, in order of who's asking
The audit date and the client deadline set the sequence, not the framework's chapter order. A principal engineer does the technical work and stays reachable while it lands.
Keep it true after the certificate
Evidence that only exists at audit time is a problem you've deferred, not solved. We wire the collection into the running systems and hand you the calendar.
Where Canadian governance risk and compliance programmes break.
I run the governance risk and compliance practice, so I'll be direct about the two failures I see most, because neither is a framework problem and both are expensive to unwind.
Certifying against the wrong standard
A board decides the company should be certified, somebody picks the most famous standard, and eighteen months later you hold a certificate no customer has ever asked to see. It happens most often with ISO 27001, which is excellent and is not what a North American SaaS buyer requests. They want a SOC 2 report. The order is: ask your three largest prospects what they require, in writing, then certify. That call costs nothing and it's the single highest-return thing on this page.
Compliance that only exists on audit day
The second failure is quieter. A team passes an audit by assembling evidence in the six weeks before it, then goes back to normal, and the next audit costs the same six weeks again. Nothing was actually built. The fix is boring: pick the ten or twelve controls that carry most of the evidence, wire their collection into the systems that already run, and give each one an owner and a date. Certification then becomes a report you print rather than a project you fund.
What do you need from Governance, Risk and Compliance?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- Governance, Risk and Compliance
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584Governance risk and compliance in Canada, answered plainly.
The six questions we get asked before every engagement.
Regulated sectors, and where to read next
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- SectorFinancial Services and Fintech
- SectorHealthcare and Life Sciences
- SectorGovernment and Public Sector
- ServiceCybersecurity Services
- ServiceIT Audit and Assessment
- ServiceAI Consulting
Not sure where you stand? Take the free SOC 2 readiness assessment, ISO 27001 readiness assessment or PCI DSS readiness assessment
