English to French Other General / Conversation / Greetings / Letters

Bonjour à tous,

Voici le contexte dans lequel apparaît cette expression :
The problem for many organisations is that just like other compliance-driven activities, such as Sarbanes Oxley, PCI DSS is difficult – and expensive - to manage. IT Directors can spend a lot of money on something which the Board may not feel they have gained any tangible benefit. And that perception will only be made worse by the scarcity of spare corporate budgets in the aftermath of the credit crunch. Security, like insurance, has always been a ‘what if?’ payment.
Je vois plus au moins l'idée mais la formulation m'échappe.
Merci de m'éclairer...