Sounds like you're either not that big or you have an incompetent team. If you have PCI/HIPAA/whatever under control, it doesn't magically get harder as you get bigger. Outsourcing it just means you pay someone else to get it right, in addition to giving up control.