The cost that never appears on the invoice

When a governance platform is on the table, the conversation almost always opens with the licence fee. It is the number in the business case, the number finance interrogates, the number procurement negotiates down by fifteen per cent and records as a win. It is also, in our experience, the least important number in the entire decision.

We are an independent advisory firm. We do not sell a platform. We help privacy, risk and governance teams work out what they actually need, choose between the options on the right criteria, and build the operating model that makes the choice work. We have sat inside enough of these consolidations to know where the money really goes, and it is rarely where the invoice says. The true cost of running multiple overlapping governance tools is structural, it is largely invisible, and for a large regulated institution it is the thing quietly setting the ceiling on how fast the organisation can move.

The invoice illusion

The licence fee anchors the conversation because it is convenient. It is a single line, it arrives once a year, and it can be compared across vendors on a spreadsheet. Almost everything that matters about fragmentation is harder to see, because it never arrives as an invoice. It arrives as people, as time, and as data you cannot quite trust.

Consider the scale of the underlying problem. In research published in 2025 by IBM’s Institute for Business Value with Palo Alto Networks, organisations reported juggling an average of 83 separate security tools from 29 different vendors. More than half of the executives surveyed, 52 per cent, said fragmentation was actively limiting their ability to deal with threats, and 41 per cent said it had driven up their procurement costs. Most telling of all, those executives estimated that fragmentation and complexity were costing them, on average, 5 per cent of annual revenue. That figure describes security tooling specifically, but anyone who has run a governance estate will recognise the shape of it. The licence is the part you can see. The five per cent is the part you cannot.

Where the cost actually lands

Break the structural cost apart and it surfaces in five places, none of which appear on a vendor quote.

The first is dedicated headcount. Every overlapping tool needs someone to feed it, reconcile it, and explain why its numbers differ from the tool next door. Over time you find skilled governance professionals spending most of their week keeping systems in step rather than doing governance. The role exists to manage the tools, not the risk.

The second is contractor resource. What begins as temporary help to bridge an implementation becomes load-bearing. The contractor who understands how the assessments map between two systems is often the only person who understands it, and they never leave, because the moment they do the reconciliation breaks. That is not a staffing decision, it is a dependency you did not choose.

The third is cross-functional manual effort. The gaps between systems are bridged by people out in the business, exporting from one tool and rekeying into another, stitching reports together by hand the week before a committee meets. It is quiet, it is everywhere, and it rarely shows up as a cost because no one books it anywhere.

The fourth is assessment fatigue. The same stakeholders are asked the same questions by different teams using different tools. Writing in early 2026, ISACA observed that standard third-party questionnaires now run to between 200 and 1,000 questions, and that the sheer volume of vendors is pushing risk teams towards operational burnout. The same article noted, drawing on Verizon’s 2025 Data Breach Investigations Report, that 30 per cent of breaches now involve a third party. The burden rises at exactly the moment the exposure does, and the questionnaires end up generating paperwork rather than protection.

The fifth, and the most corrosive, is inconsistent data. When the same vendor, entity or risk is recorded differently in each system, no single number can be trusted. This is not a rare edge case. In a 2024 study by Precisely and Drexel University’s LeBow College of Business, 45 per cent of organisations named inconsistent data definitions and formats as a barrier to data quality, and 67 per cent admitted they did not completely trust the data they rely on for decisions, up from 55 per cent the year before. Every hour spent arguing about whose number is right is an hour not spent managing the risk the number describes.

Why fragmentation is structural, not merely annoying

For a global insurer, the consolidation in question usually spans five workstreams: information governance, third party risk management, operational risk, business continuity and resilience, and the cross-cutting workflows that sit across all four. The mistake is to treat them as five separate problems. They are not. They share the same entities, the same vendors, the same controls and the same evidence. A critical supplier is a third party to manage, an operational risk to assess, a continuity dependency to plan around, and a set of records to govern, all at once.

Run those workstreams on separate tools and you pay the integration cost forever, in people and in data drift. The supplier is recorded one way in one system, another way in the next, and under a different legal entity code in a third. So the blast radius of a single supplier failure, the one thing your resilience team most needs to know, cannot be answered without a fortnight of manual reconciliation. ISACA makes precisely this point: when a critical vendor fails, the downstream impact should be immediately visible, not the subject of a two-week investigation.

Regulation removes any remaining comfort. The EU’s Digital Operational Resilience Act, which entered into application in January 2025 and covers some twenty types of financial entity including insurers, requires firms to maintain a register of their information and communications technology third-party arrangements at entity, sub-consolidated and consolidated levels, and it hands supervisors an oversight regime aimed squarely at concentration risk. A regulator now expects you to produce, on demand, a consistent and consolidated view of your third-party estate across every jurisdiction you operate in. Fragmented tooling makes that a project. It should be a query.

The AI consequence

This is where the hidden cost stops being a matter of efficiency and becomes a hard blocker. Every institution in this position is also under pressure to adopt AI; in the IBM research, 90 per cent of executives expected to scale, optimise or innovate with AI within two years. AI does not transcend your data, it inherits it. Run a model on inconsistent, untrusted governance data and you do not get insight, you get the same inconsistency, faster and at greater volume, wrapped in a veneer of authority that makes it harder to challenge.

The evidence that this is the binding constraint is already clear. In the Precisely and Drexel study, only 12 per cent of organisations said their data was of sufficient quality and accessibility for effective AI, and 62 per cent named a lack of data governance as the primary obstacle to their AI initiatives. The barrier is not the models, and it is not the talent. It is the data foundation and the governance over it.

Regulation again raises the stakes. Under the EU AI Act, AI systems used to assess creditworthiness, and to carry out risk assessment and pricing in life and health insurance, are classified as high-risk, which places them squarely in the working world of most large insurers. The Act’s data governance requirements, in Article 10, demand that the data sets behind such systems be relevant, sufficiently representative and, to the best extent possible, free of errors and complete; those obligations apply from August 2026. You cannot meet a legal standard for data quality on a foundation of records that disagree with one another. Framed properly, consolidation is how you earn the right to use AI at all.

The questions worth asking before you look at any platform

The reason these costs stay hidden is that buyers ask the wrong questions. They ask what the platform does and what it costs. The questions that actually predict success are different, and a buyer should be able to answer them before a single demo is booked.

Where does our data disagree with itself today, and what would one trusted version of each entity, vendor and control be worth to us? How much of our current effort is reconciliation that would simply disappear under a single model, and how much is genuine governance that any tool must still support? Which of the five workstreams share the same objects, and is the option in front of us designed around those shared objects or around separate modules bolted together? What is the true cost of the operating model, not the licence, including the people and contractors currently holding the seams together? When a regulator or our board asks a cross-cutting question, how many systems must we touch to answer it, and how long does it take? And what happens when we put AI on top of all this: does the design give the model trustworthy data, or does it simply automate our inconsistencies?

Notice that none of these is a question about software. They are questions about operating model and data integrity. The platform decision sits downstream of them, and a platform chosen without answering them first will faithfully reproduce the mess it was bought to fix.

We help privacy, risk and governance teams define what they actually need, select the right platform on the right criteria, and build the operating model around it. The expensive mistakes in this space are rarely the licence fee. They are choosing the wrong thing, or choosing the right thing and implementing it badly. We help you avoid both.

Sources

1. IBM Institute for Business Value and Palo Alto Networks, “Capturing the cybersecurity dividend: How security platforms generate business value,” 28 January 2025. ibm.com
2. ISACA, “Enhancing Third-Party Risk Management: Moving from Questionnaire Fatigue to Contextual Assurance,” 4 May 2026. org
3. Precisely and Drexel University’s LeBow College of Business, “2025 Outlook: Data Integrity Trends and Insights,” 18 September 2024. com
4. EU Artificial Intelligence Act (Regulation (EU) 2024/1689), Article 10 (Data and Data Governance) and Annex III (High-Risk AI Systems). Article 10 applies from 2 August 2026. eu/article/10; Annex III
5. European Insurance and Occupational Pensions Authority (EIOPA), “Digital Operational Resilience Act (DORA)” (Regulation (EU) 2022/2554), in application since 17 January 2025. europa.eu