You actually have to ensure that someone isn't just checking boxes the tests passed and the tests actually passed.

I worked for a regional ISP that had a major outage when the redundant fiber provided by the telephone company was cut in one place triggering a full loss of connectivity. It also caused a massive 911 outage for 200,000 people as it isolated the 911 center from the city core.

Turns out the phone company didn't connect one side of the ring topology even though they certified they did. Needless to say lawsuits abounded.

And auditing that is expensive and you always get given hell from the assholes going “why am I paying for this if nothing has gone wrong”

The amount of shit I was given everytime I went through a checklist working at a fedramp certified company working with emergency alerts on the phone system made me prematurely gray.

I could feel the barely contained seething rage everytime I told the execs that the reason this release will take 3 days and not be instantaneous like your friends releases at a faang and that information made you embarrassed at your dinner party, is because you agreed to this process contractually years ago and now it’s a crime if I just sign off on it being ok without actually checking that it’s ok.