By Matt Hillary
Governance, risk, and compliance (GRC) occupies an unusual place in organizations of all sizes – from contemporary startups and fast-growth organizations to large enterprises – where GRC is seen as both a cost of doing business and a catalyst for bigger opportunities. Few businesses welcome being told what to do or fear being slowed down – especially regarding compliance – where rules can appear complex or out of step with how fast the business is moving. In recent years, however, compliance has evolved far beyond regulatory checklists to become a core, differentiating part of how businesses build credibility and scale.
The problem is that many organizations find applying any kind of meaningful compliance cost-benefit analysis challenging. For instance, GRC work is often scattered across a number of teams and departments, with sometimes little visibility of spend or impact on those areas of the business. Without that kind of insight, it’s hard to determine the cost of compliance and audit burden compared to the strategic, revenue-unlocking, impact that GRC has undoubtedly become to organizations. So, why and how should organizations go about calculating the cost (and benefits) of compliance?
The case for embracing GRC
When organizations start to calculate the benefits of compliance, as opposed to the cost, the role and perspective of GRC immediately shifts from being a back-office administrative burden to a true business enabler. For example, using automation tools to streamline processes such as audit preparation, evidence collection, and ongoing continuous control monitoring saves organizations hundreds of hours each year; and brings a noticeable reduction in operational overhead. Costs associated with cyber insurance – where an organization with a strong compliance posture can unlock lower premiums or even determine eligibility for cover in the first place – can be measured here as well.
Many organizations are also realising that GRC plays a tangible and growing role in commercial success. Certifications, Trust Centres (which are customer-facing portals that showcase a company’s security, privacy, and compliance information), alongside audit-ready documentation, are increasingly part of what customers expect to see as part of their due diligence. For high-growth businesses, this level of transparency creates a competitive edge. The more measurable that impact becomes, the easier it is to treat GRC as a source of value.
A good starting point is to recognise that compliance is rarely viewed through a financial lens. For many fast-growing companies, GRC is a function that sits somewhere between a legal obligation contractually mandated by customers and a risk-mitigation mechanism. GRC is seen as important, but often may be isolated from strategic organizational planning. In reality, calculating the ROI of compliance is absolutely doable and necessary if businesses want to demonstrate both the short- and long-term value of their efforts.
A practical approach
Moving on to the ‘how’, the first step is understanding the costs of GRC. These generally fall broadly into three categories: people, tools and services, and processes. A useful framework is to bucket expenses into the following:
- People: team members, travel, training, etc.
- Tools and services: Trust Centres, GRC automation platforms, privacy platforms, assessment fees, consulting fees, etc.
- Processes: audit preparation hours, evidence collection, policy reviews, risk assessments, internal audits, etc.
The operational overhead involved in day-to-day risk management – whether that’s manual reporting, automated workflows, routine audits, or various other processes supported by other departments – sometimes adds up.
Even if harder to quantify, these indirect costs can be included to reflect the full investment being made.
Once the costs have been identified, businesses can start to quantify the benefits. These benefits are not limited to the fines and penalties that, in an ideal world, will never arrive, but also include the proactive avoidance of the major financial, reputational, and operational risks associated with GRC failures.
One useful method is to calculate the cost per record in the event of a data breach and apply this to the volume and type of data processed, with this ‘avoided’ cost becoming a measurable benefit. Cyber insurance discounts are another benefit to realise, largely because many insurers now require minimum compliance standards before they’ll even consider coverage; and those that exceed them can expect more favourable premiums.
The same logic applies to operational efficiency. GRC automation tools can eliminate hundreds of hours of manual work per year, freeing teams to focus on value-driving activity. When calculated using average employee costs, these time savings translate into real margin improvements. In some cases, they also lead to faster audit cycles, adoption of new frameworks in a scalable way, and reduced disruption across the business.
Finally, effective compliance can have a direct impact on revenue, with customer trust in particular a competitive currency – especially in sectors where security and privacy are critical to build customer trust. Tracking how often compliance documentation is requested in deals as part of third-party risk management, or how frequently certifications are cited in customer wins, can also help quantify the commercial impact of a compliance activity.
GRC as a growth enabler
Against a backdrop where high-profile compliance breaches continue to make international headlines and incur huge costs, organizational leaders are shifting their perspective to focus on what really matters – building and maintaining customer trust in order to continue meeting their organizational objectives. As a result, proactive investment in GRC processes and tools is likely to continue accelerating as businesses see its value in strengthening resilience and enabling growth.
The author
Matt Hillary is SVP of Security & CISO, Drata
