Skip to content
ENExplore Calculators

Compliance Cost Calculator

Total the annual cost of a compliance programme across audit fees, consultancy, internal effort, tooling and evidence, per employee and per framework.

About Compliance Cost Calculator

The single biggest hidden line in most programmes is evidence collection, because it is spread across dozens of people in hours nobody books to compliance, and annualising the quarterly figure at a blended rate usually produces the largest surprise. The overlap saving reflects a real property of the frameworks: ISO 27001, SOC 2 and PCI DSS ask for the same access reviews and change records in different words. Compliance budgets are argued over audit fees, which are usually the smallest controllable line, while the internal effort that dwarfs them never appears in a business case. These are cost estimates from your own inputs, not quotes.

Formulas

Compliance Cost

Annual cost = audit fees + consultancy days × rate + FTE × loaded cost + tooling + evidence hours × 4 × hourly rate + penetration tests × cost each.

evidenceCost
Quarterly evidence hours annualised at the blended internal rate
internalCost
Fully loaded, so including employer costs rather than salary alone
× 3 × 0.95
Three-year cost with a modest efficiency assumption after year one

Overlap and automation savings

Control mapping saving = 8% of total cost per additional framework, capped at 30%, on the basis that overlapping frameworks share most of their control tests.

automationSaving
60% of evidence effort plus 20% of consultancy, the range typically achievable with continuous evidence collection
overlapSaving
Available only if controls are mapped across frameworks rather than tested per framework

Worked example

With the default values below, Compliance Cost Calculator returns Total Annual Compliance Cost of $560,900. Change any input above and every figure here is recalculated in your browser.

Inputs used

Frameworks in scopeaccepts 1–25 frameworks
3 frameworks
Employees in the organisationaccepts 1–1,000,000 people
1,200 people
Systems in audit scopeaccepts 1–100,000 systems
85 systems
External audit and certification feesaccepts 0–100,000,000 $/year
95,000 $/year
Consultancy days usedaccepts 0–10,000 days
40 days
Consultancy day rateaccepts 0–100,000 $/day
1,200 $/day
Full-time equivalents on complianceaccepts 0–1,000 FTE
2.5 FTE
Fully loaded cost per FTEaccepts 0–10,000,000 $/year
95,000 $/year
GRC tooling and licencesaccepts 0–100,000,000 $/year
60,000 $/year
Hours spent collecting evidence each quarteraccepts 0–100,000 hours
220 hours
Blended internal hourly costaccepts 0–10,000 $/hour
55 $/hour
Penetration tests per yearaccepts 0–200 tests
4 tests
Cost per penetration testaccepts 0–10,000,000 $
18,000 $

Results

Total Annual Compliance Cost
$560,900
Cost per Employee
$467
Cost per Framework
$186,967
Cost per In-Scope System
$6,599
Three-Year Total Cost
$1,598,565
Evidence Collection Cost
$48,400
Evidence as a Share of Total Cost
8.6%
Plausible Saving from Automation
$38,640
Plausible Saving from Control Mapping
$89,744
Where the Money Is
Cost mix is reasonable — hold audit scope steady and keep driving evidence effort down

Step by step

  1. 1Values used
  2. 2Compliance Cost
  3. 3Overlap and automation savings
  4. 4Total Annual Compliance Cost= 560,900
  5. 5Cost per Employee= 467
  6. 6Cost per Framework= 186,967
  7. 7Cost per In-Scope System= 6,599
  8. 8Three-Year Total Cost= 1,598,565
  9. 9Evidence Collection Cost= 48,400

Assumptions and limits

  • The result is derived only from the 13 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation or tax into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Compliance Cost calculated?

Annual cost = audit fees + consultancy days × rate + FTE × loaded cost + tooling + evidence hours × 4 × hourly rate + penetration tests × cost each. The single biggest hidden line in most programmes is evidence collection, because it is spread across dozens of people in hours nobody books to compliance, and annualising the quarterly figure at a blended rate usually produces the largest surprise. The overlap saving reflects a real property of the frameworks: ISO 27001, SOC 2 and PCI DSS ask for the same access reviews and change records in different words.

Why does Compliance Cost matter?

Compliance budgets are argued over audit fees, which are usually the smallest controllable line, while the internal effort that dwarfs them never appears in a business case. These are cost estimates from your own inputs, not quotes.

What values do I need to enter?

This calculator takes 13 inputs: Frameworks in scope, Employees in the organisation, Systems in audit scope, External audit and certification fees, Consultancy days used, Consultancy day rate, Full-time equivalents on compliance, Fully loaded cost per FTE, GRC tooling and licences, Hours spent collecting evidence each quarter, Blended internal hourly cost, Penetration tests per year, Cost per penetration test. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is the cost per framework not simply the total divided by frameworks?

It is here, deliberately, as a blunt unit cost — but the marginal cost of a second framework is much lower than the first because the control set overlaps heavily. Use the overlap saving line for the marginal question and the per-framework figure only for comparing your programme with a peer's.

Is automation really worth 60% of the evidence effort?

That is the upper end of what continuous control monitoring typically delivers, and only for controls whose evidence is machine-generated: access reviews, configuration baselines, patch levels, backup success. Controls that depend on human judgement, like risk assessment or supplier due diligence, barely improve.

Related Calculators

Compliance Cost Calculator | Calcrivo