I've worked with compliance teams too. It used up 50% of the time of three engineers, plus three people whose full time job was interfacing with compliance. And this was just in the InfoSec group. So that's four and half FTEs averaging at the time about $100K a year (probably now $200K). So today that would be a million dollars expended dealing with compliance.

And do you know what value compliance brought to us? Nothing. We were already doing all the necessary things. All we were spending our time on was proving that we were already doing all the required things.

what the commentor said, may not be true, but you didn't actually make an argument or at least back it up with anything.

as far as I can tell, your comment boils down to 'hiring internal compliance employees/consultants is not a waste.'

but you didn't say anything to back up that the money going to compliance is not a drag. What value does it add to the business? It seems it just prevents catastrophe (legal problems) and has its own costs (termed 'drag') but doesn't add business value as it does not contribute to the USP of product/service to the customer.

Even in your own case, if compliance takes any % of time there is an opportunity cost: you can't work on something that adds to the product/service because that time is spent on compliance.

Does your comment aim to disagree with that?

If you could just not do something to not need lawyers and accountants, then yes, the same logic would apply. You can obviate the need for the compliances required of a public company by not becoming a public company.