Compliance software or compliance consultant? You're asking the wrong question.

The market sells this as a choice. Platforms promise you can get SOC 2 without a consultant. Consultants warn that software without expertise is shelfware. Both are partly right, and the companies that pick only one usually find out which part they missed about six months later.

My position: what you're choosing is who does the thinking and who does the remembering. Software should do the remembering. People should do the thinking. Companies get into trouble when they buy one and expect it to do the other's job.

I sit on both sides of this. I run compliance engagements as a consultant, and we build Steppe, a compliance platform, because my own clients kept losing their programs after I left.

What compliance platforms do well

The category, which includes Vanta, Drata, Sprinto, Secureframe, Scrut, Steppe and others, is good at work that is repetitive and checkable. Connecting to your cloud, identity provider, HR system and code repositories to collect evidence automatically. Running checks on configurations. Reminding owners about access reviews and policy reviews. Versioning policies and tracking employee acknowledgements. Publishing a trust page. Bundling evidence for the auditor.

Before these tools existed, all of that lived in spreadsheets and shared drives, and it fell apart within a year. They solved a real problem.

What they can't do

Decide your scope. Which systems, products and entities are in the audit is a business decision with cost and sales consequences.

Decide your risk appetite. A platform can list risks from a library. It can't tell you whether your company should accept a shared admin account on a legacy tool for another quarter.

Write policies that match you. Templates are a starting point, and a template policy that doesn't match your operations becomes an audit finding.

Interpret regulators. How a new RBI circular or a DPDP rule applies to your exact business model is a judgement call.

Handle the auditor. Negotiating sample sizes, explaining compensating controls, pushing back on a finding that misreads your environment.

If you've bought a platform, connected the integrations, watched the readiness score sit at 60% for three months and wondered what to do about the other 40%, the answer is that the remaining 40% was always going to need a person.

What consultants do badly

They leave. The traditional engagement ends with a report and a folder, and nothing in the model rewards the consultant for the program still running a year later. A consultant without a system to hand over is renting you their memory, and the rental ends with the invoice.

How to combine them

If you have someone in house who knows compliance, buy a platform and give it to them. If you don't, you need judgement from somewhere: a consultant, a fractional CISO, or a platform that comes with people who know your regulators.

That last option is what makes Steppe different from most of the category. The consulting and the software are one engagement, so the person who scoped your program is the person who configured the tool, and India's regulators sit in it as first class frameworks alongside SOC 2 and ISO 27001.

Whatever you choose, ask one question before signing: when we hit a question the dashboard can't answer, who answers it?

Buy software for its memory, pay people for their judgement, and never expect either to do the other's job.