Most organizations focus on passing the first audit. The better question: how does your architecture affect ongoing compliance effort? Systems where evidence generates automatically and violations are prevented by design cost dramatically less to maintain than those where compliance is bolted on afterward.