Compliance activities and fines cost organizations nearly $4m per year