when it comes to maintaining code that affects financial data and customer information the certification can be pretty extreme to people not familiar with the risks. Even two teams of auditors can be involved for some work (internal and external). Even after it deploys you watch new changes like a hawk