What Does a Compliance Program Actually Return?

A funded compliance program returns money in three places: enterprise deals that stop stalling in security review, breach losses you avoid or shrink, and audit-preparation labor you stop burning every cycle. For a typical 100 to 200 person B2B company, those three lines usually total somewhere between $150,000 and $400,000 a year against a program cost of $120,000 to $250,000. That math clears in most cases we model, but not all of them, and an honest business case shows both columns. Here is the arithmetic, line by line, with a model you can populate with your own numbers.

Key takeaways

• A funded compliance program returns money in three places: enterprise deals that stop stalling in security review, breach losses you avoid or shrink, and audit-preparation labor you stop burning every cycle.
• Lead with the revenue line, not the breach line. It is already in your CRM, and a board can pressure-test it live.
• Do expected-value math on the breach line with visible assumptions, and never let it carry the case. In most B2B companies the deals line is 70% or more of the modeled return.
• First-audit preparation runs 300 to 500 hours done by hand. Second-cycle prep typically drops to 100 to 150 hours once evidence collection is continuous.
• The model's most common output is neither "buy now" nor "don't buy". It is "start the clock two quarters before you think you need to."

Start with the revenue line, not the breach line

Most compliance business cases open with a scary breach statistic. Boards have seen that slide a hundred times, and they discount it accordingly, because the presenter can never say when the breach will happen or whether it will happen at all.

The revenue line is different. It is already showing up in your CRM. Deals that sat in "security review" for six weeks. A prospect who asked for a SOC 2 report you didn't have. A questionnaire with 340 questions that pulled your head of engineering off roadmap work for four days. Compliance vendors publish survey percentages for how often this costs companies deals; we are not quoting one, because the surveys we checked are marketing assets and the pages carrying the figures do not stay put.

You don't need a survey anyway. You need your own pipeline data, and that's what makes this line credible in front of a board.

Line one: deals you stop losing

Work it from your actual numbers. Suppose you closed $4M in new ARR last year and your sales team can point to $600,000 in qualified pipeline that died or slipped a quarter specifically because of security review friction: no audit report to hand over, slow questionnaire turnaround, a missing policy the buyer's procurement team required.

You will not recover all of that by getting compliant. Some of those deals were lost for other reasons too, and sales teams are generous when attributing losses to anything that isn't sales. Haircut it hard. If a SOC 2 Type II report and a maintained trust package recover even a third of that friction-attributed pipeline, that's $200,000 in ARR, recurring, not one-time. Even a quarter of it clears most program budgets on its own.

There's a second-order effect that's harder to quantify but real: sales cycle compression. When the security review step goes from "we'll get back to you" to "here's the report and the completed CAIQ, same day," deals that would have closed anyway close faster. We see this in most clients' second year: the compliance program stops being a gate and becomes a sales asset the AEs lead with.

For the model, book only the recovered-pipeline number. Leave cycle compression as upside commentary. Boards trust cases that visibly leave money off the table.

Line two: breach losses you avoid

This is the line everyone leads with, and it's actually the weakest line in the model. Use it, but use it honestly.

IBM's 2026 Cost of a Data Breach report puts the global average breach cost at $4.99M, and the US average at $11.5M. Those are real figures, but they're averages dominated by large enterprises with large record counts. If you're a 140-person company, presenting $11.5M as your exposure will get you laughed out of the room, and it should.

Do expected-value math instead, with visible assumptions:

• Start from a realistic worst case: for a company this size, a tenth of the US average, about $1.15M (forensics, notification, customer churn, legal, remediation).
• Put the annual probability of a material incident without a program at 6%. Expected annual loss: roughly $69,000.
• Credit the program with cutting that expected loss by a third, through faster detection, tested response, and fewer unpatched gaps. That's about $23,000 a year avoided.

Twenty-three thousand dollars. Small, defensible, and honest. If a board member wants to argue your probability or severity assumptions upward, let them; the case only gets stronger. But never let this line carry the case, because it can't survive scrutiny alone.

One older data point is worth a footnote in the deck: the Ponemon Institute's True Cost of Compliance research (originally 2011, updated 2017, so directional only at this point) found non-compliance cost organizations 2.71 times what compliance cost, $14.82M versus $5.47M on average. The absolute figures are stale. The ratio has held up in our client work: cleaning up after the fact, under regulator and customer pressure, always costs more than building the program deliberately.

Line three: audit labor you stop burning

First audits are expensive in a way that never hits a budget line, because the cost is paid in staff hours. Compliance platforms describe a first SOC 2 audit done by hand as taking hundreds of hours of manual work: writing policies, chasing screenshots, mapping controls, herding evidence out of a dozen SaaS admin consoles. None of them publishes a defensible band, so the 300 to 500 hours we plan against is our own figure, from what we see when clients arrive mid-slog, not a survey result.

At a loaded cost of $100 an hour for the engineering and ops time that ends up owning the work, 400 hours is $40,000 in labor for one audit cycle. And here's the part that compounds: without a program, you pay most of it again next year, because evidence collected ad hoc doesn't persist. Screenshots go stale. The person who knew where everything lived left in March.

A managed program attacks this two ways. Continuous evidence collection means audit prep becomes review rather than archaeology; second-cycle prep typically drops to 100 to 150 hours. And evidence consolidation across frameworks means a control tested once satisfies SOC 2, ISO 27001, and HIPAA simultaneously instead of being documented three times. If you're headed toward multiple frameworks (most companies selling into healthcare or enterprise eventually are), the consolidation saving alone can exceed the entire first-framework saving. This is the core economic argument for compliance as a service: the marginal cost of framework number two should be a fraction of framework number one.

Book $25,000 to $35,000 a year on this line for a single framework, more if you're multi-framework.

What the program actually costs

Now the other column. As of August 2026, for a 100 to 200 person company pursuing SOC 2 with continuous compliance, annual costs typically look like this:

• Audit fees: the CPA firm's examination fee, which varies more than any other line here. We do not perform audits, so we publish no market-wide number for it. What we do publish is narrower and labelled as such: the auditor selection guide states what boutique and regional CPA firms have quoted in engagements we supported, and the consultant question states what we see in the contracts we review. Treat either as a planning band rather than a price. The published spread and what actually drives it are in the SOC 2 cost breakdown
• Compliance automation platform: $10,000 to $30,000 a year
• Penetration testing: the SOC 2-scoped test, $10,000 to $18,000 a year in the engagements we scope, required in practice by most enterprise buyers even where the framework doesn't mandate it; the penetration testing cost breakdown carries the published spreads by engagement type
• Security leadership: a fractional vCISO engagement scoped to the hours you actually need, which lands well below the fixed cost of a full-time hire most companies this size can't keep busy. The vCISO guide works that comparison through and carries the compensation figures
• Internal time: a program liaison's hours, priced at your own loaded cost; the Budget Planner sizes that line against your headcount

The all-in total depends on which of those lines you actually carry and at what tier, so model it against your own scope with our Budget Planner rather than adopting someone else's average; year two runs lower because readiness work doesn't repeat. If a vendor quotes you dramatically less than a scoped estimate for the whole stack, something on the list is missing, usually the pen test or the human judgment.

The worked model

Put both columns together for a hypothetical 140-person SaaS company selling into mid-market and enterprise:

Costs, year one:

Every line there is a model assumption, not a quote; swap in your own numbers.

Returns, year one:

Net: positive $73,000, with the recurring picture better than that because pipeline recovery repeats and year-two costs drop while consolidation savings grow. That's the whole case. No slogan required; the arithmetic either clears for your company or it doesn't.

To populate it yourself, you need five numbers: friction-attributed pipeline losses from your CRM (interrogate sales honestly), a realistic incident cost for your size and data types, your annual incident probability estimate, your loaded hourly cost, and quotes for the cost column. Everything else is multiplication. If you'd like a second set of eyes on the assumptions, that's exactly the kind of pre-engagement conversation we'd rather have than a signed contract with bad math under it.

When the math says don't buy

Sometimes it doesn't clear, and you should be able to see that in the same model.

If you have no enterprise or regulated-industry pipeline, line one collapses, and line one carries the case. A 15-person startup selling to SMBs who never send questionnaires should not buy a full compliance program; a few foundational controls, a lightweight security policy, and a plan to revisit when the first enterprise logo shows up in pipeline is the right spend. Similarly, if you hold no sensitive data and your incident severity is genuinely low, the breach line rounds to zero and shouldn't be inflated to force the total.

The honest failure mode in the other direction is waiting too long: starting a SOC 2 the week a seven-figure deal asks for it means a Type II observation window pushes evidence delivery out six months to a year, and the deal doesn't wait. The model's most common output isn't "buy now" or "don't buy"; it's "start the clock two quarters before you think you need to."

Frequently asked questions

How should we present this to the board?

One slide, two columns, five assumptions listed on the page. Lead with the pipeline number because it comes from your own CRM and the board can pressure-test it live. Present the breach line as expected value with your probability and severity assumptions visible, not as a headline average from a report. Close with the payback period and name what you deliberately excluded (sales cycle compression, insurance premium effects) so the case reads conservative. Boards fund arithmetic they can argue with; they defer fear they can't.

What payback period should we expect?

In the worked model above, cumulative return passes cumulative cost inside year one, but that depends heavily on one enterprise deal landing. A more conservative read, assuming pipeline recovery takes two or three quarters to materialize after the audit report exists, puts typical payback at 12 to 18 months from program start. If your model shows payback beyond 24 months, either your pipeline assumptions are too timid or a full program is genuinely premature for you.

Do we need all three return lines for the case to work?

No, and pretending otherwise weakens the case. In most B2B companies the deals line is 70% or more of the modeled return, labor savings are reliable but modest, and the breach line is a rounding adjustment. If your case only works when the breach line is inflated to six figures, the case doesn't work. Build it so it survives with line two deleted entirely.