Global Compliance Frameworks
All Audited under a single firm
CertPro conducts independent third-party audit and attestation engagements across leading compliance frameworks — including SOC 2, ISO 27001, HIPAA, GDPR, and ISO 42001. All engagements are performed and reported under a licensed CPA firm.
SOC 2 Type 1 & Type 2
SOC 2 Type 1 and Type 2 examination engagements conducted in accordance with AICPA AT-C Section 105 & AT-C Section 205 and the Trust Services Criteria (2017, updated). CertPro CPA LLC issues the attestation report as a licensed CPA firm. SOC 2 attestation reports are widely relied upon by enterprise procurement teams and board-level risk committees.
ISO 27001:2022
ISO 27001:2022 audits conducted in accordance with ISO/IEC 27001:2022 and ISO 19011 guidelines. CertPro performs the audit; certification is issued by an IAF-accredited certification body following successful completion of the audit process. Applicable to organizations across all sectors seeking internationally recognized ISMS certification.
ISO 42001:2023
ISO 42001:2023 assessment for AI Management Systems (AIMS), aligned with certification requirements. CertPro examines AI governance structures, risk controls, and accountability frameworks against the standard's requirements. Compliance certification is issued by an independent certification body following successful completion of the assessment process.
ISO 27701:2019
ISO 27701:2019 audit for Privacy Information Management Systems (PIMS), conducted as an extension to ISO 27001. CertPro audits PIMS conformity against ISO/IEC 27701:2019 requirements. The standard includes a mapping to GDPR and other data protection frameworks, supporting organizations in demonstrating privacy accountability.
ISO 27018:2019
ISO 27018:2019 audit for protection of Personally Identifiable Information (PII) in public cloud environments, conducted in accordance with ISO/IEC 27018:2019. Our assessment includes evaluation of documented controls and supporting evidence related to PII processing, data handling, transparency, and privacy safeguards.
HIPAA
HIPAA Security Rule assessment covering administrative, physical, and technical safeguards in accordance with the HIPAA Security Rule. CertPro assesses control design and conformity across business associates, with findings documented in a formal assessment report based on evidence gathered during the engagement.
GDPR
GDPR compliance assessment covering data protection policies, control design, and supporting evidence against applicable regulatory requirements. CertPro assesses organizational conformity with GDPR obligations for data processors, with findings documented in a formal assessment report based on evidence gathered during the engagement.
CCPA / CPRA
CCPA/CPRA assessment covering consumer rights management processes, data governance practices, and supporting evidence in accordance with applicable requirements. CertPro assesses organizational conformity with CCPA and CPRA obligations. Findings are presented in a structured assessment report with documented evidence supporting each conclusion.
PIPEDA
Assessment of privacy practices against PIPEDA requirements for commercial organizations in Canada. CertPro's PIPEDA compliance assessment includes evaluation of policies, consent mechanisms, accountability controls, and supporting documentation to report conformance.
Four Phases. Zero Shortcuts.
A clear structured audit process — scoped, documented, and executed in accordance with applicable attestation standards.
Kick-Off Meeting
Audit scope, applicable frameworks, system boundaries, personnel, departments, and processes are defined and agreed upon jointly. A single client point of contact is established. Engagement timeline and deliverables are confirmed before any evidence review begins.
Access to Evidence
Client grants access to the designated evidence repository. Control matrix, system description, or Statement of Applicability is reviewed against the applicable standard. An initial gap list is compiled from the evidence review findings.
Gap Clarification
Inquiries are carried out for additional evidence or clarification required per control area. Gaps are reviewed collaboratively via a scheduled video call. Any gaps that remain unresolved are formally documented and carried forward into the final report — categorized by severity and TSC mapping.
Reporting
Draft report is prepared as per AT-C Section 205 or applicable standard, incorporating all findings, tested controls, and auditor conclusions. An independent internal QC review is completed prior to issuance. Final attested reports and certificates are issued upon completion.
Compliance Questions, Answered
Specific answers to the questions clients ask before, during, and after an audit engagement — not generic compliance marketing copy.
Before engaging CertPro, your organization should have its controls designed, implemented, and — for a Type 2 engagement — operating for the full observation period. If your controls are not yet in place, we recommend engaging an independent readiness consultant or a GRC platform to prepare your environment prior to commencing the audit.
Once your controls are implemented and evidence is available, CertPro will conduct the engagement through defined phases of planning, testing, and reporting, in accordance with the applicable attestation standards.
Begin Your Compliance Audit with a
Licensed CPA Firm.
Schedule a 30-minute scoping call with a credentialed auditor. We will identify the right framework, discuss audit scope and outline a clear path based on your current state.