Fractional Compliance Officer

The compliance function itself.

Not advice about compliance, and not a quarterly check-in. Policies current, the risk register live, BAAs tracked, training documented, and the annual analysis refreshed on schedule. For under a third of what that function costs as a hire.

Book a call See the levels
The arithmetic

Run the numbers before you run the search.

A compliance officer at the size of organization that asks me this question costs $95K–$130K loaded: salary plus employer taxes, benefits, and the cost of recruiting for the role. The retainer at the entry level is $2,500/mo, which is $30,000 a year. Against that band, that is 23% to 32%.

Under a third, and that holds at both ends of the band, so you are welcome to check it. You also skip the ramp: a new hire spends their first quarter learning your environment. I spend it working, because the assessment already told me what your environment is.

What you give up is headcount and full-time availability. If you need someone in the building five days a week, hire someone. I will help you write the job description and interview for it. Most organizations at this size do not need that yet, and buy it anyway because the alternative was not on the menu.

The function

What "the program runs" actually means.

The list below is the standing work, not a menu of things I could be asked to do. Each item has a cadence, an artifact, and an owner.

Policies and procedures
Current, approved, dated, and mapped to the provisions they satisfy. Reviewed on a schedule rather than when someone asks for them.
The risk register
Live. Findings tracked to closure with evidence, not a spreadsheet that was accurate the week the assessment landed.
The annual risk analysis
Refreshed each performance period, per 45 CFR 164.308(a)(1)(ii)(A), and reviewed as your environment changes rather than annually by calendar accident.
Business associate agreements
Tracked, current, and negotiated against 45 CFR 164.504(e)(2) rather than signed as sent.
Workforce training
Assigned, completed, documented. The part that is trivial until an investigator asks for completion records.
Incident response
A plan that has been walked through, and someone who picks up the phone when something happens at 4pm on a Friday.
Board reporting
A written report to your board on a schedule, and the person who answers their questions. Every level includes it.
Levels

The same function at every level. The difference is pace.

Every level runs the standing work above. Anything that becomes a project goes in your queue, and the level sets how many projects are in progress at once. Monthly, no minimum term. Moving up or down a level is a conversation, not a renegotiation.

One active project

$2,500/mo

The standing function, with one project from your queue in progress at a time.

Two active projects

$4,000/mo

The standing function, with two projects in progress at once.

Three active projects

$6,000/mo

The standing function, with three projects in progress at once.

Month one is the risk analysis, billed at the assessment price. For an organization without a current risk analysis, that is the Security Risk Assessment, starting at $3,500. Every month after is the monthly price. Month one is billed at the assessment price or the monthly price, whichever is higher.
How projects run

One queue, a set number in progress.

What a project is
A project is one deliverable with a defined done-state, usually from your risk register, sized to about a month of work. Bigger work is split into phases that queue one after another. The queue has no limit; only the number in progress at once does.
When something happens
A real incident pauses the queue and is handled inside the retainer. Projects resume when it is closed.
A month that needs more
For a month that needs more at once, ahead of a renewal, an audit or a buyer's security review, a sprint adds one active project for that month at the difference to the next level. That is $1,500 from one active project, or $2,000 from two.
What sits outside the retainer
Custom software, which you own outright and which is scoped as its own engagement. Building an AI program, a training routine or a tool, which is the AI Enablement Retainer. Bounded AI work around a program that already runs, such as an AI vendor analysis or adding a tool to the inventory, is a project like any other. Legal representation is never included.
How it starts

Month one is the analysis.

I will not run a program I have not assessed. Without a current analysis, the first ninety days go to discovering the environment, and you would be paying for discovery when you meant to pay for the work.

So month one is the Security Risk Assessment, conducted on site, billed at its own price of starting at $3,500. The program runs from month two at the monthly price. If you already have a current risk analysis that holds up, bring it, and month one is an ordinary month at the monthly price.

If all you want is the analysis, the assessment is also sold on its own.

Book a call What the assessment covers