The third place is in audit findings that should have been preventable through proactive infrastructure investment. The findings happen, remediation gets done, the corrective action plans get accepted, and the organization absorbs the cost of remediation as if it were a normal cost of doing business. The cost isn't normal. It's the cost of operating with infrastructure that produces conditions that generate findings, when proactive infrastructure investment would have prevented the conditions from existing. For organizations with chronic findings in two or three areas, the annual cost of remediation, including external consultant time, internal staff effort, system or process changes, and follow-up work, typically lands between one hundred thousand and four hundred thousand dollars. That's before counting the compounding reputational cost with funders, which doesn't show up on any line item but shapes future funding decisions in ways that are real and substantial.