Is it too late to just finish the implementation?

No — and finishing is usually faster than you'd guess, because the expensive parts are already done. You've bought the platform, connected the first integrations, and learned the basics. What a restart mostly requires is a named owner, a triage pass on the dashboard (the failing checks are not all equally urgent), and an audit date on the calendar that forces sequencing. Companies restarting after six or more months of drift typically find the work is measured in focused weeks, not the months the red dashboard implies.

Should we just switch to a different platform instead?

Usually not — if the platform was never fully implemented, you don't yet have evidence that it's the wrong platform. Switching a stalled program tends to re-stall it on the new platform, because the usual causes of a stall (no owner, no sequencing, no deadline) travel with you. The exception is genuine misfit: integrations your stack needs that the platform doesn't have, a framework roadmap it handles badly, or pricing that no longer fits your size. The finish-or-switch page walks the fork honestly, and the self-check on this page gives you a first read.

How long does it take to get audit-ready from a stall?

For a typical company under about 100 people with one framework, restarting a stalled implementation usually means several focused weeks — often somewhere in the 4 to 12 week range at a few hours per week of real attention, depending on how much was set up before the drift and how many findings are real versus noise. That's a hedged range, not a promise: the honest number depends on your integration count, your policy state, and whether one person actually owns the push. The finish guide has the fuller effort picture by company size.

Do we need a consultant to finish, or can we do it ourselves?

Plenty of teams finish on their own once someone owns it and the dashboard has been triaged into a sequence — the finish guide on this site is written for exactly that. Help earns its keep in two situations: nobody can genuinely give it a few hours a week (the same condition that caused the stall), or the audit date is close enough that mis-sequencing would blow it. A finish-line engagement is a smaller, cheaper thing than a migration — nothing is being moved, only completed. And for the record: we take no commissions from any platform, so we have no stake in whether you finish, switch, or do it all yourself.

Bought a Compliance Platform, Still Not Compliant? You're Not Alone

The eight-month arc

A big customer's security team asked for SOC 2 — or a deal stalled in procurement until you could produce a report. You did the sensible thing: picked a well-known platform (Vanta, Drata, Secureframe — the story is the same on all of them), signed for five figures, and blocked out a kickoff week. You connected AWS, Google Workspace, maybe GitHub. The dashboard lit up with a hundred-something failing checks.

And then… the quarter happened. The person who did the kickoff had an actual job. Every failing check looked equally urgent, which is another way of saying none of them did. Someone said "we'll pick it back up after the launch." That was eight months ago. The platform bills on time. The dashboard is still red. The customer who asked for SOC 2 is asking again, or has quietly stopped asking — which is worse. And the renewal notice is either in your inbox or coming.

If that reads less like a hypothetical and more like your admin console, this page is for you. One thing up front, because it shapes everything here: we're an independent advisory — no commissions from any platform, ever — and most of what we're going to tell you is not to buy anything new.

Is it normal to buy a compliance platform and stall?

Yes — common enough that, in our experience, it's the default outcome for self-serve compliance purchases made under deal pressure without a named owner. The platforms are genuinely good at what they do, but what they do is surface work, not perform it — and a tool that surfaces two hundred tasks at a team that hasn't assigned anyone to do them produces exactly the outcome you're living in. Stalling is not evidence that you bought badly, and it isn't evidence that the platform is wrong for you. It's evidence that a purchase happened and a project didn't.

That distinction matters because of what stalled buyers do next: they search for alternatives. "This tool isn't working for us" feels true, so the fix feels like a different tool. Sometimes it genuinely is — there's a self-check below for that. But most of the time the honest diagnosis is unfinished, not unfit, and switching platforms would just move the red dashboard somewhere new.

Why programs stall

Nobody owns it. The platform was bought by whoever felt the deal pressure — a founder, the COO, the engineering lead. None of them acquired a new job title that day. Compliance became a shared responsibility, and shared responsibilities lose to everyone's actual responsibilities every single week. Programs with a named owner move; programs with a committee of the willing drift. This is the single most common stall cause, and the cheapest to fix.

Dashboard overwhelm. The platform's first act is to show you everything that's wrong: failing checks, unaccepted policies, personnel tasks, unreviewed access. It presents them as a wall of equal-looking red. But they are not equal — a handful block your audit, many are quick administrative wins, and a long tail barely matters for a first report. Without a sequencing frame, the wall reads as "two hundred hours of undifferentiated work," and undifferentiated work gets scheduled for never.

The missing sequence. Related but distinct: even motivated people stall when they can't tell what order to work in. Access and policies before evidence automation. Evidence automation before the long tail. An audit date before all of it, because a date is what turns a backlog into a plan. (The finish guide lays out the whole sequence.)

The day job. The person best positioned to finish the implementation is almost always someone whose calendar was already full when the platform was bought. This isn't a character flaw. It's arithmetic. The fix isn't resolve — it's either carving out real, recurring hours with leadership's blessing, or deciding openly to bring in help. Both beat the third option, which is what you've been doing.

What staying stalled actually costs

The renewal you'll pay either way. The platform renews whether the dashboard is green or red. A stalled implementation means paying five figures a year for software that is, functionally, a very expensive to-do list you don't read. Nobody feels good writing that check — which is often the moment people find this page.

The deals still waiting. The customer requirement that triggered the purchase didn't go away; it's been waiting the whole time. Every enterprise deal that needs a SOC 2 report is either delayed, discounted, or quietly lost while the program sits. This cost is invisible on any invoice and usually dwarfs the software line.

The restart tax — and it grows. A program dead for three months restarts almost where it left off. At eight months, integrations have broken quietly, the person who did kickoff may have left, policies drafted last year no longer match reality, and some findings on the dashboard are now stale enough to be misleading. The longer the drift, the more of the restart is re-discovery rather than progress. It never gets cheaper to finish than it is right now.

The self-check: stalled but salvageable, or genuine misfit?

Check everything that's true. The first five describe a stalled implementation; the last three describe a platform that may genuinely not fit. Your verdict updates as you go — nothing leaves this page.

What to do about it

If the stall signals dominate: don't shop for a new platform — finish the one you're paying for. It's the cheaper, faster, and far more likely-to-succeed path, and it starts with a triage pass, not a heroic sprint. Here's the finish guide: how to sequence the red dashboard, what a realistic restart week looks like, and honest effort ranges by company size.

If you checked two or more misfit signals: you might be one of the cases where switching is right — but check the diagnosis before acting on it, because a misread here costs a full migration and a re-implementation. The finish-or-switch page walks the fork honestly, including the signals in both directions.

If you'd rather just talk it through: that instinct is right for this situation — a thirty-minute conversation resolves the finish-or-switch question faster than any page can. The consultation is free, and since we take no vendor commissions, "finish what you have and don't pay anyone anything" is an answer we give regularly and happily.

You Bought the Compliance Platform. You're Still Not Compliant.