Yup, and for this reason, I will never work on a compliance app again in my life.
Compliance is all about reducing risk to an acceptable level, but if you care about it, it is also about reducing risk to as close to zero as possible. Compliance generally affects multiple organizations, and that means convincing a bunch of people to do something that doesn't help them accomplish their primary goals.
To be clear, I'm not alleging any wrongdoing whatsoever against any group that I worked with. I'm simply saying that it's hard enough to get people to do the job they accept as their main job; adding 'extra' work is never a rewarding experience - especially as an individual contributor.
...yeah, there are several roles/functions that are by definition thankless tasks. In compliance, the best you can produce is nothing, as in no incidents that could have been prevented through better compliance, while causing a ton of cost and frustration across the organization. The worst you can produce is ruining the company and sending people to jail in a way that you were tasked with preventing and could actually have prevented.
It sort of reminds me of this thought experiment that Nassim Nicholas Taleb mentions in one of his books: What if a bureaucrat had figured out, pre 9/11, that terrorists flying a commercial airliner in to a building was a risk worth trying to prevent and had passed legislation for all cockpits to be bulletproof cells that could only be opened from the inside, or something like that. 9/11 would have never happened, and that bureaucrat would have caught shit for the rest of his life for championing legislation that is causing a lot of people a lot of cost and frustration and has never had any observably positive impact anywhere in the observable universe.
Compliance is all about reducing risk to an acceptable level, but if you care about it, it is also about reducing risk to as close to zero as possible. Compliance generally affects multiple organizations, and that means convincing a bunch of people to do something that doesn't help them accomplish their primary goals.
To be clear, I'm not alleging any wrongdoing whatsoever against any group that I worked with. I'm simply saying that it's hard enough to get people to do the job they accept as their main job; adding 'extra' work is never a rewarding experience - especially as an individual contributor.