Audit Fatigue Is a Retention Problem Wearing a Compliance Costume
Your best engineers did not join to fill out duplicate compliance spreadsheets. When you run SOC 2, ISO 27001, GDPR and AI governance as separate programmes, the cost lands in your attrition numbers.
Compliance is treated as a cost centre and staffed accordingly — one or two people with no authority to change how work is done. Their only available mechanism is to ask other people for things. Evidence for SOC 2 in Q1. Evidence for ISO 27001 in Q2. A GDPR update in Q3. AI governance documentation in Q4. Each request is reasonable. Each lands on the same twenty or thirty senior engineers.
The real cost, itemised
- Direct time. The smallest component — a few days per person per cycle.
- Context switching. Considerably larger. Deep technical work does not resume instantly after an interruption with a deadline attached.
- Quality degradation. By the third cycle the evidence is being produced to satisfy the request rather than to be accurate — this is how organisations end up with documentation that fails external audit.
- Attrition. Nobody resigns citing audit fatigue. They cite "wanting to do more building". But the accumulation is real, and replacing a senior engineer costs multiples of the compliance programme.
What changes it
Ask once. Integrated internal audit, one interview per process owner, mapped to every applicable standard. Collect evidence where the work happens. If your change management process is a ticketing system, the tickets are the evidence. Close the loop. Tell people what the audit found and what improved. Give compliance real authority — a function empowered to change how work is instrumented can eliminate requests entirely, rather than just generating them.