That’s not true at all - in high compliance industries if the dependency has been validated and is working changing it brings risk.