What GRC costs: a cost model for a 25 to 250-person UK firm

The board has asked for a number. An audit finding, the operational resilience work or a new client's due diligence has landed on a budget that was already stretched, and every page you find on GRC cost prices software licences in US dollars. None of them tells you what it takes to run governance, risk and compliance at a UK firm of your size.

This guide is for ops directors, compliance leads and managing directors at UK regulated firms with 25 to 250 staff. It builds the annual cost of GRC line by line, splits one-off costs from run costs, and shows what moves each line, so the budget you take to the board holds up to its questions.

How much does GRC cost for a UK firm of 25 to 250 people?

GRC cost for a firm of this size is the sum of six predictable lines: people, outside help, tooling, certification and audit fees, training, and staff time spent on evidence and questionnaires. Building the system costs more than running it. Scope, meaning how many frameworks and regulators you answer to, moves the total most.

That is why no honest page can give you one headline figure. A 40-person firm holding Cyber Essentials and a 200-person insurer answering to the FCA, three client audit regimes and ISO 27001 are buying different things, even if both call it GRC.

The useful question is not "what does GRC cost?" but "which lines do we carry, and what drives each one?" The rest of this guide answers that.

A GRC budget with one line in it is a software quote, not a budget.

What are the cost lines in a GRC budget?

The cost lines in a GRC budget are people, outside help, tooling, certification and audit fees, training and awareness, and internal staff time. Each line behaves differently: some are one-off build costs, some recur every year, and one, staff time, rarely appears on any invoice. Budget each line separately so the board can see which costs fall away.

The first five lines arrive as salaries, quotes or invoices. The sixth arrives as hours lost from other work, which is why most budgets miss it.

What does a GRC role cost in salary and on-costs?

A GRC role costs its salary plus employer on-costs. The UK government's 2025 cyber skills study puts the median advertised salary for a core cyber security job at £55,000 in 2024. Employer National Insurance and pension then add to that, so the true cost of one full-time hire is well above the advertised salary.

The DSIT Cyber security skills in the UK labour market 2025 report draws on job postings from January to December 2024. Its headline figures for core cyber roles:

• Median advertised salary: £55,000, against £48,900 for the wider IT labour market.
• Mean advertised salary: £58,800 across the UK, and £69,800 in London.
• Experience: 63% of postings asked for two to six years' experience.

Treat these as a reference point, not a price. They cover core cyber roles in general, not GRC roles alone, and many postings in 2024 carried no salary at all.

On-costs are the part budgets understate. As a starting assumption, replace with your own payroll data:

1. Employer National Insurance at 15% on earnings above £5,000 a year, the HMRC rates for 2025 to 2026.
2. Employer pension at the 3% legal minimum on qualifying earnings between £6,240 and £50,270, as set out on GOV.UK's workplace pensions guidance. Many schemes pay more.
3. Everything else: recruitment, equipment, benefits and professional development, priced from your own records.

On those first two assumptions, a hire at the £55,000 median costs about £63,800 a year before the third line. At many firms of 25 to 250 people, though, GRC is not one hire. It is part of an operations or IT manager's job, and that share of their time is a cost too.

How should you budget for outside help?

Budget for outside help as two separate lines: a one-off build, priced as a fixed number of consultancy days, and an ongoing fractional role, such as a vCISO or vDPO, priced as a monthly retainer. Ask for both as fixed-scope quotes, so you can compare like with like rather than day rate against day rate.

Firms of this size lean on outside help more than larger firms do. The DSIT Cyber Security Breaches Survey 2025 found that 43% of medium businesses, those with 50 to 249 staff, sought cyber security information or guidance from external consultants or providers. Among medium businesses that ran vulnerability audits, 38% used external contractors only.

The build line usually covers:

• Gap analysis against the frameworks you need to meet.
• Policy set and risk method, written to match how the business actually works.
• Control design for the gaps the analysis finds.
• Internal audit before the first external audit.

The retainer line covers the ongoing judgement: risk reviews, board reporting, regulator and client questions, and the next audit cycle.

Two questions keep this line honest. What will we own when the engagement ends? And which hours does this remove from our own team?

What do certification and audit fees add to GRC cost?

Certification and audit fees add an initial fee for each certification or report, then a recurring fee to keep it. The size of each fee follows the headcount and scope you put in front of the assessor. The framework pages carry the detail; this line only needs one entry per certification you hold or plan.

For the certifications buyers ask for most, use the framework guides rather than a single figure here:

• ISO 27001: audit days come from your headcount in scope, then surveillance audits follow in the next two years. Our ISO 27001 certification cost guide breaks the fee down.
• SOC 2: the CPA firm's fee follows the trust services categories, systems and report type. Our SOC 2 cost guide sets out the four SOC 2 cost lines.
• Cyber Essentials: the NCSC states that certification is priced by organisation size, starting at £320 plus VAT. Cyber Essentials Plus, with independent technical testing, is quoted. Our Cyber Essentials page covers the scheme.

Budget the fee alongside the readiness work and staff time behind it. Those costs sit on the other lines, and they are the ones a quote never shows.

Where does the hidden cost of staff time go?

The hidden cost of staff time goes on gathering evidence, answering client security questionnaires, preparing for audits and running controls on their stated cadence. It sits in the diaries of engineers, IT staff, finance and HR, not in the GRC budget. Price it by estimating the hours and multiplying by what those hours cost you.

Start with the activities, then put an owner and an hour estimate against each:

1. Evidence gathering: screenshots, exports and sign-offs collected for each audit or review.
2. Questionnaires: client due diligence and vendor reviews, often asking the same questions in new formats.
3. Audit support: walkthroughs, sample requests and follow-up questions.
4. Control operation: access reviews, supplier reviews, risk reviews and policy updates.

For a reference point, the ONS Annual Survey of Hours and Earnings 2025 puts median hourly earnings for full-time employees at £19.67 in April 2025, excluding overtime. It is a national median across all jobs, so use it as a floor, not as the cost of your engineers.

The GRC line nobody invoices is the one nobody manages.

Engineering the evidence work is how this line comes down. Access logs, change records, backup results and configuration data already exist in your systems. Collecting them automatically and continuously, rather than by hand before each audit, removes most of the evidence-gathering hours. NIST SP 800-137 describes this approach as information security continuous monitoring. The same evidence then feeds the monitoring and measurement that ISO 27001 clause 9.1 already asks for.

What drives total GRC cost up or down?

Total GRC cost is driven by four things: how many frameworks and regulators you answer to, how wide the scope is, how mature your existing practice is, and how much of your evidence comes from systems rather than people. The first two set the size of the work; the last two set how much is done by hand.

1. Frameworks and regulators. Each framework adds requirements, but most overlap. One set of controls, mapped once to ISO 27001, SOC 2, Cyber Essentials and your regulator's expectations, costs far less than four separate programmes.
2. Scope. Every legal entity, site, system and critical supplier inside the boundary adds work to every line.
3. Existing maturity. A firm that already runs access reviews, change control and tested backups mostly needs to evidence its controls. A firm without them has to build them first.
4. Evidence automation. Evidence pulled from systems costs set-up time once. Evidence gathered by hand costs the same hours every cycle.

Regulation can also widen scope on its own. The FCA's operational resilience policy statement PS21/3 covers banks, building societies, insurers, payment and e-money institutions and enhanced scope SM&CR firms, among others. It required them to be able to remain within impact tolerances for each important business service by 31 March 2025. Work like this lands in the build year, and keeping it current lands in every year after.

What does an illustrative GRC budget look like?

An illustrative GRC budget for a 120-person FCA-authorised firm outside London sets the six lines against a build year and a run year, with every assumption shown. The figures are illustrations, not benchmarks. Replace each assumption with your own payroll data, quotes and hour estimates before the budget goes to the board.

The firm in this illustration is in scope of the FCA's operational resilience rules, holds Cyber Essentials and is working towards ISO 27001. It hires one full-time GRC lead.

Two lines are priced from public data, and four from your own quotes. That split is the point of the exercise: the board can see which numbers are researched, which are quoted and which are estimated.

The staff-time line also shows where automation pays. If automated evidence collection halves the run-year hours, the saving recurs every year, while the set-up cost is paid once.

What does it cost not to do GRC?

The cost of not doing GRC shows up as breach costs, lost deals and regulatory findings. None of these arrives on a predictable invoice, which is why they are easy to discount. The government's 2025 breaches survey gives the clearest UK data on the first, and client requirements drive the second.

The DSIT Cyber Security Breaches Survey 2025 reports, for UK businesses:

• Prevalence: 67% of medium businesses identified a cyber breach or attack in the previous 12 months.
• Cost: among medium and large businesses whose most disruptive breach had an outcome and a reported cost above £0, the mean self-reported cost was £14,360 and the median £1,410, from a base of 69 businesses.
• Staff time: staff time was the exception where the median cost for medium and large businesses was not £0, which the survey reads as a sign that even incidents with no specified outcome still took staff time.

The survey notes these are self-reported estimates that may understate the full impact. Read them as a floor.

Lost deals are harder to count, but the same survey found that medium and larger businesses were particularly likely to say client requirements determined whether they sought accreditation. Regulatory findings carry their own cost: remediation work under a deadline, at whatever rate is available that month.

GRC bought after the finding costs more than GRC built before it.

How can you reduce GRC cost without weakening it?

You reduce GRC cost by shrinking the hours, not the assurance. Build one control set and map it to every framework you need, collect evidence from systems instead of people, keep scope to what clients and regulators require, and buy outside help with a defined end point. Cutting the controls themselves is the saving that costs most later.

The savings that survive an audit:

1. Map once, report many times. Keep one control register, with each control mapped to every framework it answers. A new framework then becomes a mapping exercise, not a new programme.
2. Automate the evidence you collect most often. Start with the evidence every audit and questionnaire asks for: access reviews, change records and backups.
3. Keep a questionnaire answer library. Approved answers, linked to current evidence, turn repeat questionnaires into a review rather than a rewrite.
4. Scope to the requirement. Add a framework or a certification only when a client contract or a regulator needs it.
5. Fix gaps before the auditor finds them. A gap analysis costs less than a nonconformity.

We recommend reviewing the budget each year against the hours actually spent. The lines that fall are the proof that the system is working.

Frequently asked questions