Some places require sign-off by legal for every (transitive) dependency. Less draconically, you really ought to have that list so you can check whether you're exposed to any licensing obligations that you don't want and if you are meeting other license terms (e.g. attribution). If the list is hard to create, that's a strong hint you don't know what code you're actually running.