In-house, consultant or compliance as a service: which GRC model fits a 25 to 250-person tech firm

A regulated buyer's supplier questionnaire has landed, the deal is waiting on a SOC 2 report or an ISO 27001 certificate, and nobody in the firm owns GRC. You can hire, bring in a consultant or buy compliance as a service. The verdict: hire in-house when GRC is continuous, core to the product and big enough for a full-time owner; use a consultant for a bounded project such as a first certification; and choose managed GRC when the work is ongoing but too small or too broad for one hire.

Accountability stays with your own leadership in every model. This comparison is for CTOs, COOs and founders at UK tech firms of 25 to 250 people selling into financial services, insurance and other regulated sectors. It sets the three models side by side, with an honest fit test for each, the triggers for switching and the questions to ask any provider.

What is the difference between in-house, consultant and managed GRC?

An in-house hire is an employee who owns GRC full time. A project consultant delivers a defined piece of work, such as a first certification, and leaves. Managed GRC, often sold as compliance as a service, is an ongoing external service that runs the programme. Many firms end up with a hybrid: an internal owner plus a managed service.

The table compares the four on the points that decide the choice.

The accountability row is identical in every column on purpose.

When should you build GRC in-house?

Build GRC in-house when the work is continuous and close to the product. That means several frameworks running all year, customers who test your controls often, compliance-heavy features you sell, or a capable owner who already exists and needs tooling rather than more people. In those cases an employee's product knowledge outweighs an external provider's breadth.

In-house is the right answer more often than provider pages admit. A platform that processes payments or claims data for regulated customers faces frequent security reviews, and the person answering them needs to know how the system works and what changed last month.

The risks are single-person dependency and a narrow view: the programme stalls when that person leaves. If you hire, plan outside help for the frameworks they have not run.

When should you bring in a project consultant?

Bring in a project consultant when the work has a clear end: a first ISO 27001 certification, a SOC 2 readiness project or a gap analysis before a bid. A consultant brings a tested method for one target, and the engagement ends when the target is met. The model fits best when someone inside will run the programme afterwards.

The weakness is what happens next. ISO 27001 certification is followed by surveillance audits, and a SOC 2 Type 2 report covers a period of operation, so the controls must keep running after the project closes. Our guides to the ISO 27001 certification process and SOC 2 readiness assessment show how much of the work is ongoing.

A certificate nobody inside the firm can explain is a liability at the next audit.

What does compliance as a service include?

Compliance as a service is an ongoing, externally delivered GRC programme on a subscription or retainer. A typical offer covers policy and control upkeep, risk register reviews, evidence collection, internal audit support, supplier questionnaire answers and audit liaison across one or more frameworks. The names vary: managed GRC, GRC as a service and managed compliance describe much the same model.

Offers differ in where they stop. Some include tooling, some expect you to bring your own, and some add a part-time security leader, the vCISO, as one form of managed GRC. Two services with the same name can cover very different work, so read the scope line by line.

When is managed GRC the right fit?

Managed GRC fits when the work is ongoing but too small, or too broad, for one full-time hire. A 40-person firm holding ISO 27001 and answering regular supplier questionnaires has continuous work, but perhaps not a full-time job's worth. A 120-person firm running three frameworks may need more breadth than one employee can bring.

Managed GRC is weaker where the product is the compliance story. The provider depends on your people for product knowledge, its attention is shared across clients, and priorities are agreed within the scope rather than set by you.

Managed GRC works best with a named internal owner who has the time in their objectives.

What can't you outsource?

You can outsource the work of GRC, but not the accountability for it. Your management owns the risk decisions, signs the SOC 2 assertion and answers to customers when something goes wrong. Regulated customers check this when they assess you, because their own rules say that outsourcing never moves responsibility, and they apply the same test to their suppliers.

The sources are consistent:

• SOC 2. The AICPA's illustrative SOC 2 report includes management's assertion alongside the service auditor's report. The assertion is your management's statement, whoever drafted it.
• Your financial services customers. Under the FCA's SYSC 8.1.6R, a firm that outsources critical or important operational functions "remains fully responsible for discharging all of its obligations". Expect your customers to apply that principle to how you run your own security.
• Your board. The UK government's Cyber Governance Code of Practice, published on 8 April 2025, sets out the governance actions directors are responsible for, including gaining assurance about supply chain risk.

What should make you change model?

Change model when the shape of the work changes: a first enterprise deal, a second framework, a regulated customer's audit right, a DORA flow-down, or headcount crossing about 100 or 150 people. Those thresholds are illustrative, not rules. The real test is whether the current model still covers what customers ask for.

Each trigger shifts the balance:

1. A first enterprise deal. Usually a project trigger: the first report or certificate.
2. A second framework. Breadth starts to matter. An in-house owner who has not run the new framework needs help, and managed GRC or a hybrid becomes a stronger fit.
3. A customer's audit right. Someone inside must host the audit and know where the evidence sits.
4. A DORA flow-down. Under DORA, EU financial entities stay fully responsible when they use ICT providers (Article 28), and contracts supporting critical or important functions must give them unrestricted rights of access, inspection and audit (Article 30). Those terms reach you as a supplier.
5. Growth past about 100 or 150 people. The volume of reviews can justify a full-time owner, often alongside a managed service.

How do you evaluate a GRC provider?

Evaluate any GRC provider, consultant or managed service, on five tests: you own the deliverables, you keep the evidence, the contract has a clear exit and handover, the people doing the work are named, and there is no conflict if the same firm also audits you. A provider that fails one of these leaves you weaker when the contract ends.

Ask these questions before you sign:

• Deliverables. Do policies, risk registers and control documents belong to you, in formats you can edit?
• Evidence. Does the evidence sit in systems you control, and does it stay if the provider goes?
• Exit. What does handover include, and how long does it take?
• People. Who will do the work, and what happens if they leave the provider?
• Conflicts. If the provider also offers audit, how does it protect its independence? A Journal of Accountancy article on nonattest services explains that a CPA firm helping a client it audits "cannot assume management's responsibilities".

If the evidence leaves when the provider does, you rented compliance rather than built it.

Your customers apply similar tests to you. The NCSC's supply chain security guidance sets out 12 principles for supply chain oversight, and our page on ISO 27001 Annex A 5.19 covers the supplier relationship control.

Which GRC model fits your firm?

Most firms can choose a model in under a minute by answering four questions in order: is the work a one-off project, is it continuous and core to the product, is there a capable owner already, and is it ongoing but not full time? The first yes points to a model, and accountability stays inside whichever you pick.

Follow the path:

1. Is the work a bounded project with an end date? Use a project consultant, and name the person who will run the programme afterwards.
2. Is GRC continuous and core to what you sell? Hire in-house, and buy specialist help for the frameworks your hire has not run.
3. Do you already have a capable owner who is stretched? Keep them, and add tooling or a managed service for the routine work.
4. Is the work ongoing but too small or too broad for one hire? Choose managed GRC, with a named internal owner.

Whichever model you choose, write down who owns what.

Frequently asked questions