Compliance Costs: Budgeting for DIY, Consulting and Software

The software subscription is the easiest cost to see. It is also an incomplete basis for choosing how to prepare for an audit.

Someone still needs to define scope, review evidence, resolve gaps and work with the auditor. A consultant can take on some of that work. Software can organise it or automate parts of collection. Neither removes the need for decisions inside your organisation.

Establish the deliverable

An ISO 27001 certificate, a SOC 2 report and an internal gap review have different scopes and costs. Confirm what the customer or board needs before comparing proposals. If you need one formal audit, do not add both ISO and SOC 2 audit fees into the total.

Describe the entities, services, locations and systems in scope. Discuss the relevant report categories and period with your CPA firm, or the ISMS boundary with your certification body.

Keep five budget lines separate

Budget line	What to include	Basis for the estimate
External assurance	Audit fees, follow-up and recurring reviews	A quote for the defined scope
Internal time	Coordination, review, implementation and decisions	Hours by role at your own cost rates
Specialist help	Advice, testing, policy or legal review	Agreed deliverables and responsibilities
Software	Subscriptions, storage, setup and add-ons	The proposed plan and renewal terms
Remediation	Engineering, process and supplier changes	The gap list, with assumptions recorded

Separate cash spend from staff opportunity cost. Management may be able to fund a subscription while having no spare engineering capacity to fix the findings it exposes.

Working internally

Spreadsheets and shared documents can work with a clear owner, manageable scope and reliable review. The constraint is whether the team has the time and experience to maintain the process.

Identify who will interpret uncertain requirements, challenge weak evidence and follow up overdue actions. If that person also owns a major product release, resolve the scheduling conflict explicitly.

Estimate effort from an initial review. Confirming an existing access process and rebuilding an untested recovery process should not receive the same allowance.

Hiring a consultant

Read the engagement scope. “ISO 27001 support” does not tell you who writes policies, implements changes, conducts the internal audit or coordinates certification.

Ask what staff input is needed, which deliverables you receive and what happens if the scope changes. Retain internal ownership of risks and operating decisions. A written policy still needs people and a process behind it.

Do not subtract an assumed percentage from staff costs because you hired help. Estimate the responsibilities that remain with your team.

Buying software

Distinguish guided self-assessment from connected automation. In AuditFront, you answer questions, provide evidence and review a report. Products with integrations can collect evidence or test selected controls, but also need setup and review.

Take one real evidence request through the proposed workflow. Establish what is collected, what requires manual work and how an exception is resolved. Check that the quote includes the features demonstrated.

AuditFront publishes a Free plan, Pro at EUR 49 per month and Agency at EUR 399 per month, with annual options. These are software prices. Formal audits and remediation remain separate. See the pricing page for capacity and storage limits.

Budget from your findings

For each gap, record an owner, action and effort assumption. Mark estimates that depend on a supplier quote, design decision or specialist review. Compare approaches against that same work list.

Consulting may help with an unfamiliar scope. Automation may help with repeated collection. A simple assessment tool may be enough to organise a review you already know how to run.

Start with the free templates, then build the budget from your findings and actual quotes. Retain the assumptions so you can explain why it changes.