One day someone will ask who authorized it

Tell us the decision you are worried about. A scoping call takes twenty minutes, and we will tell you plainly whether HOP applies to your decision class, including when it does not. We never implement the controls we assess, so there is nothing for us to sell you on the other side of that answer.