Audits are a way to earn money. Don't forget to charge by time and effort then charge for time spent for being audited.

Additionally as always with complex regulations and specifications there are ways to comply maliciously. This means comply by letter but charge for bullshit.

Another bonus are hurdles to enter the market for your competitors. If they don't know how to talk with government and comply they can't sell to government. This makes things expensive for government.