Compliance is the voice in the room you cannot afford to be without. That voice is integral in the risk identification and management process.  The cost of not listening to that voice (or worse yet, not having that voice present), may not be seen for years.

In this case, a payment processor was fined $40m in 2020 from events that occurred in 2012-2014.  The size of the fine would indicate that appropriate risk mitigation failed on the part of leadership.

The most advantageous compliance voice is that of the independent practitioner.

https://www.bizjournals.com/milwaukee/news/2020/05/19/fiserv-to-pay-ftc-40m.htmlFiserv $40m article