You don't have to. You can absorb the risk. Which most orgs do.