Compliance assessment: in-house or external?
Updated: 2026-11
An in-house compliance assessment makes sense when someone in the company knows the regulations, has time, and the results serve mainly internal purposes. External is better when several new regulations must be examined at once, time is short, or customers, banks and investors expect independent evidence.
The question often arises after a customer or investor has asked about the compliance position. Both paths are legitimate, and many companies combine them.
What matters is not what looks cheaper but what leads to a robust result in the time available.
Head to head
| Criterion | Do it in-house | Commission externally |
|---|---|---|
| Expertise | Available if someone knows the relevant regulations | Brings knowledge across several regulations and countries |
| Time required | Competes with day-to-day business | Plannable, with a fixed timeline |
| Knowledge of the business | High, no onboarding needed | Must be built during scoping |
| Independence | Limited, own work is self-assessed | Higher, an outside view |
| External evidential value | Low to medium | Higher, especially in due diligence |
| Direct cost | Internal time instead of an invoice | Fee for a fixed scope |
When Do it in-house wins
- —Someone in the company knows the relevant regulations and has time for it.
- —It concerns a single, well-known regulation.
- —The result serves mainly internal management.
When Commission externally wins
- —Several new regulations arrive at once, for example after expanding into the EU.
- —A customer, bank or investor expects independent evidence.
- —Internal time is lacking and deadlines are approaching.
Our take
For most SMEs a mix is most economical: an external assessment for applicability and prioritisation, followed by internal implementation with targeted support.
Those starting in-house should at least document the applicability check with reasons. Our free regulatory check helps with the first overview.
Parent service: Compliance assessment
Matching offers
Compliance assessment for companies
The compliance assessment establishes in one pass which regulations apply to your company, from data protection to the AI Act, NIS2 and the Swiss ISA, the Data Act, accessibility and e-invoicing. You receive a reason for each regulation, a risk and deadline rating for each gap and, at the end, an action plan.
Building a compliance management system
A compliance management system ensures duties are not only identified once but met over time. We build it to fit your company: roles, an obligations register with owners, a few effective controls, training and concise reporting to management, guided by ISO 37301.
FAQ
Can the regulatory check replace the assessment?
No. The check shows which regulations may be relevant. The assessment examines this in detail and rates the gaps.
How much internal time does an external assessment need?
Mainly for interviews and providing documents, typically a few hours per unit involved.