The Calculation Nobody Makes
A number you can invoice will always beat a number you must estimate, whatever their true sizes.
Executive Summary
Every year, in regulated industry, the compliance budget rises. It rose last year; it will rise again next. The finance director who approves it does so with a particular expression — not agreement, but the resignation of a man paying a ransom he cannot argue down. What almost never happens is the calculation that would tell him whether the figure is right: an honest comparison between what compliance actually costs the organisation, fully loaded, and what non-compliance would actually cost it, weighted for likelihood and consequence.
This essay is about that missing sum. Why it is so seldom attempted; why the two numbers are almost never placed side by side; and what the omission tells us about the wider distance between transformation intent and transformation reality. The claim is not that firms spend too much on compliance, nor too little. It is that they spend without knowing — steered by fear on one side and fatigue on the other — and that organisations which model credit, market and operational risk to three decimal places will not bring the same discipline to the risk carried by their own control environment.
The cost of compliance is tallied to the penny because it arrives as an invoice. The cost of non-compliance is left as a shapeless dread because it arrives, if it arrives at all, as a probability. A number you can invoice will always beat a number you must estimate, whatever their true sizes. I will argue that the reasons for this are structural rather than foolish; that there is a serious case for refusing the calculation altogether; and that the case is nonetheless wrong — not because pricing non-compliance licenses it, but because refusing to price it guarantees the money is spent in the wrong places.
The budget that only moves one way
Consider a scene that repeats, with small variations, across every regulated sector. It is budget season. The head of compliance presents. The slides show the new obligations arriving in convoy — a markets directive that has been bedding in since the autumn, a card-security standard tightening its requirements another turn, an anti-money-laundering regime that now expects the firm to know not merely its customers but the source of its customers’ funds. Each obligation is annotated with a number, and the numbers sum to rather more than last year. Around the table, nobody argues. To argue would be to volunteer as the person who, when something later goes wrong, is remembered as having said no to compliance. The budget is approved in less time than the coffee order took.
That reflexive assent is the phenomenon this essay is about. It is not stupidity; the people in the room are, on any other line of the budget, ruthless. Put a proposal for a new distribution channel in front of them and they will interrogate its return on capital, its payback period, its sensitivity to three different assumptions. Put the compliance number in front of them and the interrogation stops. The number has acquired a kind of moral immunity. It is understood to be the price of being allowed to trade at all, and one does not haggle over a licence.
The trouble is that the number is not, in fact, the price of a licence. It is the sum of several hundred separate decisions about how much control to buy, where to buy it, and to what standard — and every one of those decisions is a genuine economic choice, made well or badly, whether or not anyone admits that a choice is being made. The immunity we grant the total quietly extends to each of its parts, and that is where the waste, and the exposure, both live.
Two numbers, never in the same room
There are two calculations that an organisation serious about this would perform, and they are rarely done at all, still more rarely done together.
The first is the true, fully-loaded cost of compliance. Not the compliance department’s budget — that is merely the visible tip — but everything the pursuit of compliance actually consumes. The systems and the people, yes, but also the audit and attestation overhead, the management hours spent in oversight committees, the deals slowed while a matter is cleared, the products withheld because the control to support them does not yet exist, and the opportunity cost of the capital and the talent tied up in all of it. Fully loaded, this figure in a large regulated firm is a substantial multiple of the compliance line everyone quotes.
The second is the true, expected cost of non-compliance. This is harder, because it is not a single number but a distribution: for each obligation, the probability that the firm falls short, multiplied by the consequence if it does — and the consequence itself is layered. There is the fine, which is direct and, increasingly, large. There is the remediation and forced re-work. There is the revenue lost while operating under sanction or restriction. And there is the reputational damage — to customers, to counterparties, to the firms whose ratings and credit lines the organisation depends upon — which is the largest term of all and the one no model captures cleanly.
Set the two out and the asymmetry is immediate:
| The cost of compliance | The cost of non-compliance |
|---|---|
| The programme budget — systems and staff | The penalty, direct and quantified |
| The audit and attestation overhead | Remediation and forced re-work |
| Management time consumed in oversight | Revenue lost under sanction or restriction |
| The drag on the business — deals slowed, products withheld | Reputational loss — customers, counterparties, ratings |
| The opportunity cost of capital and talent tied up | The regulatory relationship, harder to price still |
Notice what separates the columns. Almost every entry on the left is knowable in advance and arrives as an invoice. Almost every entry on the right is an estimate, contingent, and arrives — if it arrives — as a shock. That difference in texture, not any difference in true magnitude, is what decides which column gets managed.
The cost of compliance is counted because it is invoiced. The cost of non-compliance is feared because it is estimated. The organisation optimises the number it can see, and calls the other one prudence.
Why the sum is never done
If the calculation is so obviously worth making, its absence needs explaining, and the explanation is not laziness. Several structural forces conspire to keep the two numbers apart, and understanding them is the whole of the matter.
The first is the asymmetry of blame. The executive who under-invests in a control, and is later found out, is finished — his name attached to the failure for the remainder of his career. The executive who over-invests, buying reassurance the firm did not need, is merely thought careful. Faced with a wager whose downside is professional extinction and whose upside is a modest saving nobody will thank him for, any rational individual over-buys. The organisation thus spends not to the point where the marginal control stops paying, but to the point where the responsible manager stops feeling personally exposed — a quite different, and far higher, point.
The second is what might be called the fear premium. Compliance spending is sold, internally, on the worst case. The board is shown the largest fine ever levied in the sector, the depositors queuing outside a British bank on the evening news, the government department that put twenty-five million citizens’ records in the post and could not say where they had gone. These images do their work. They are also, precisely, tail events, and pricing an entire control portfolio off the tail is how an organisation ends up armoured against the catastrophe it will never suffer and exposed to the mundane failure it suffers every quarter.
The third is the diffusion of cost against the concentration of budget. The true cost of compliance is smeared across the whole business — a week of a trader’s time here, a delayed launch there — and so nobody feels its full weight. The compliance budget, by contrast, sits on a single line with a single owner. When money is needed, it is easier to grow the visible line than to recover the invisible drag, and so the firm optimises the thing it can point to.
The fourth, and most corrosive, is theatre. A great deal of what passes for compliance is designed less to reduce the probability of failure than to demonstrate, after a failure, that the firm had done the expected things. The distinction matters enormously to the economics and is almost never drawn. A control that genuinely lowers expected loss and a control that merely produces a defensible audit trail cost roughly the same to run; only one of them is worth the money, and the calculation that would tell them apart is the calculation nobody makes.
“We have taught ourselves to audit everything and to weigh nothing.”
The transformation that priced nothing
This is where the subject touches the larger theme of transformation, and where the gap between intent and reality opens widest.
Every few years the accumulated cost and clumsiness of compliance become intolerable enough to justify a programme. The programme promises to fix it: compliance will be embedded, by design, built in rather than bolted on; the manual controls will be automated, the duplicated evidence rationalised, the whole apparatus made efficient. The business case is approved, often at a scale — tens of millions over several years — that dwarfs the annual budget it is meant to tame.
And yet, with dispiriting regularity, the programme delivers a more elaborate, better-documented, more expensive version of what was there before. It catalogues the controls; it colours them red, amber and green; it builds the dashboard. What it does not do — because the intellectual work was never commissioned — is ask, of each control, whether the expected loss it prevents justifies the cost it imposes. The programme treats the existing control set as a given to be automated, not as a portfolio to be re-priced. It industrialises the spending without ever examining it.
The reason is that the programme inherits the same immunity the annual budget enjoys. Nobody sponsoring a compliance transformation wants to stand up and say that a fifth of the controls are theatre and should be retired, because retiring a control is the one act that carries the asymmetry of blame in its purest form. So the transformation confines itself to making the existing apparatus cheaper to operate and easier to evidence, declares the efficiency saving, and leaves the underlying question — are we buying the right controls at all? — exactly where it found it. This is the mechanism behind a familiar disappointment: the transformation that hits every milestone and changes nothing that matters. Intent and reality diverge not because the programme failed to execute, but because it executed flawlessly against a scope that had quietly excluded the only question worth asking.
The objection worth taking seriously
There is a serious case against everything I have just argued, and it deserves its strongest form rather than a convenient caricature.
The case is this: compliance is not an economic variable and should never be modelled as one. It is a licence to operate — a legal and, in places, a moral obligation — and the moment you begin computing the expected cost of breaking a rule, you have conceded that breaking it is a live option. You have invented an acceptable rate of money laundered, an acceptable volume of mis-selling, an acceptable probability of the client’s data on the open market. Regulators do not entertain expected-value arguments; to them a breach is a breach, not a line item that came in under its provision. And the firms that reasoned about safety rules or capital rules as bets with attractive odds are precisely the firms whose names become the cautionary slides in next year’s budget meeting. On this view, the refusal to price non-compliance is not a failure of rigour but a deliberate and wise refusal to think in the terms that lead honest institutions into disgrace.
This is a strong argument and I have some sympathy with it. But it answers a question I am not asking. The calculation I am describing is not a calculation about whether to comply. It is a calculation about where to spend the compliance pound — and that pound is finite whatever anyone says at the podium. Compliance is not one decision but ten thousand, and the budget that funds them does not expand to infinity merely because the obligation is absolute. Every pound is therefore already being allocated by a calculation; the only question is whether that calculation is explicit and disciplined, or implicit and driven by whichever control is most visible, whichever regulator wrote most recently, whichever failure would be most personally embarrassing to the person holding the pen.
The choice is never whether to make the calculation. It is only whether to make it consciously, against expected loss — or to leave it to fear, which makes it for you and makes it badly.
Refusing to price non-compliance does not abolish the trade-off. It hands the trade-off to anxiety, which is the worst possible allocator, because anxiety spends most where the imagery is most vivid rather than where the loss is most likely. The disciplined firm prices non-compliance not so that it may choose to break a rule, but so that it can tell the control that lowers real risk from the control that merely lowers the manager’s pulse — and fund the first out of the money it stops wasting on the second.
What the calculation looks like when someone does it
Abstraction is the enemy here, so consider a composite drawn from the pattern as it actually presents — invented in its particulars, entirely familiar in its shape.
A general insurer runs a compliance transformation. It catalogues some two thousand four hundred controls, rates each of them, and produces a board dashboard that settles, after eighteen months and a little over twenty million pounds, at ninety-four per cent green. The greenness is offered, quarter after quarter, as the evidence that the money was well spent. Nobody around that table asks the awkward question, because the dashboard is designed precisely so that the question need not be asked.
Somewhere in the amber remainder sits a single control governing the way one long-standing product was sold through an intermediary channel. It has been amber for three years. Turning it green requires a systems change — a change to how suitability is recorded at the point of sale — costed, when someone finally costs it, at around two million pounds. The change is declined three years running. It is declined not because anyone judges the risk acceptable, but because it falls under the IT change budget, which is being held flat, while the twenty-two million sits under the compliance budget, which is allowed to grow. The money to fix it exists in the building; it is simply on the wrong line.
In the fourth year the product’s mis-selling crystallises into a remediation exercise. The eventual bill, across the affected book, is of the order of eighteen million pounds, before the cost of the regulatory attention it draws to everything else.
Now run the sum that nobody ran. The eighteen-million liability, discounted by a frank assessment of the odds — say one chance in three that it would ever land in that form — carries an expected cost of roughly six million pounds. The fix cost two. On any reading, in any year, a two-million spend to retire six million of expected loss was the best-returning project anywhere in that portfolio, compliance or otherwise. It was turned down annually while money flowed, unquestioned, into re-documenting controls that were already green. The firm did not lack the funds and did not lack the risk information. It lacked the one act of arithmetic that would have set the two beside each other — and it lacked it because the two numbers lived on different budgets, under different owners, protected by different immunities, and were never once required to meet.
That is the calculation nobody makes, and that is what its absence costs. Not a failure to spend on compliance; a spectacular success at spending on the wrong compliance.
Spending truthfully
Stand back from the particular and the general shape is plain. An organisation’s handling of compliance economics is a fairly exact mirror of its relationship with its own uncertainty. The firm that cannot bear to price the risk it runs will instead buy reassurance by the yard, mistake the reassurance for safety, and discover the difference only when the mundane, unglamorous, amber control it never funded finally gives way.
The correction is not a cheaper compliance function, and it is emphatically not a smaller one. It is a more honest one. It means insisting that the fully-loaded cost of compliance be assembled and looked at, drag and opportunity cost included, rather than hidden across a dozen budgets. It means insisting that each material control carry an estimate — crude, contestable, revised often, but present — of the expected loss it exists to prevent, so that the theatrical controls can be told from the load-bearing ones. And it means giving the person who proposes retiring a control the same institutional cover we instinctively give the person who proposes adding one, because until we do, the asymmetry of blame will keep the whole apparatus growing in one direction only.
None of this lowers the obligation to comply. It raises, considerably, the intelligence with which the obligation is met. The mature organisation does not spend less on being safe; it spends the same money where it actually buys safety, and stops spending it where it merely buys the feeling of it.
“Maturity in compliance is not spending less. It is spending truthfully — where the loss is likely, not where the fear is loud.”
The calculation is difficult. Its inputs are soft, its probabilities arguable, its reputational terms barely quantifiable at all. But difficulty is a reason to do it roughly, not a reason to refuse it entirely — for the alternative to a rough calculation is not the absence of one. It is the precise, confident, and catastrophically misdirected calculation that fear performs on our behalf whenever we decline to do it ourselves.