"What happens when security becomes a shared service is there is no competitive advantage from using appropriate security. Will a customer swap banks because they are Sarbanes-Oxley compliant?

"It is just the cost of doing business and banks want to drive costs down, but the smart ones will use compliance as a way to improve performance and use compliance as a performance capability rather than just see it as a cost."