Fractional Compliance Officer

The compliance function itself, owned, with a name on your org chart.

Not advice about compliance, and not a quarterly check-in. Policies current, the risk register live, BAAs tracked, training documented, and the annual analysis refreshed on schedule. For under a third of what that function costs as a hire.

Book a call See the tiers
The arithmetic

Run the numbers before you run the search.

A compliance officer at the size of organization that asks me this question costs $95K–$130K loaded: salary plus employer taxes, benefits, and the cost of recruiting for the role. The retainer at the tier most organizations take is $2,500/mo, which is $30,000 a year. Against that band, that is 23% to 32%.

Under a third, and that holds at both ends of the band, so you are welcome to check it. You also skip the ramp: a new hire spends their first quarter learning your environment. I spend it working, because the assessment already told me what your environment is.

What you give up is headcount and full-time availability. If you need someone in the building five days a week, hire someone. I will help you write the job description and interview for it. Most organizations at this size do not need that yet, and buy it anyway because the alternative was not on the menu.

The function

What "the program runs" actually means.

The list below is the standing work, not a menu of things I could be asked to do. Each item has a cadence, an artifact, and my name against it in your policies.

Policies and procedures
Current, approved, dated, and mapped to the provisions they satisfy. Reviewed on a schedule rather than when someone asks for them.
The risk register
Live. Findings tracked to closure with evidence, not a spreadsheet that was accurate the week the assessment landed.
The annual risk analysis
Refreshed each performance period, per 45 CFR 164.308(a)(1)(ii)(A), and reviewed as your environment changes rather than annually by calendar accident.
Business associate agreements
Tracked, current, and negotiated against 45 CFR 164.504(e)(2) rather than signed as sent.
Workforce training
Assigned, completed, documented. The part that is trivial until an investigator asks for completion records.
Incident response
A plan that has been walked through, and someone who picks up the phone when something happens at 4pm on a Friday.
Tiers

Three levels, monthly, no minimum term.

Most organizations start at Program and move up when the AI surface or the board reporting makes it necessary. Moving between tiers is a conversation, not a renegotiation.

most start here

Program

$2,500/mo

The compliance program runs: policies current, risk register live, training and BAAs tracked, the annual analysis refreshed on schedule.

Program + Oversight

$4,000/mo

The program, plus standing oversight: vendor review, incident response, and a seat in the room when architecture and procurement decisions get made.

Full

$6,000/mo

The named compliance officer function, board-facing, with the AI governance surface included.

Half your assessment fee credits to your first month on retainer. $1,750 of your starting at $3,500 assessment fee comes off month one at every tier, the same value whichever tier you take. Your diagnosis pays forward into the work that acts on it.
How it starts

The assessment comes first, and that is not an upsell.

I will not take a retainer to run a program I have not assessed. The first ninety days of a retainer without one go to discovering the environment, and you would be paying a monthly rate for work that a fixed-price engagement does better and cheaper.

The Security Risk Assessment at starting at $3,500 comes first. Then the retainer, with $1,750 of that fee credited against month one. If you already have a current risk analysis that holds up, bring it and we skip straight to the retainer.

Book a call Start with the assessment