I don't really have this experience. A lot of business I have worked with followed the "let's just do it and figure out the risk later" approach. In highly regulated environment it was different, but then looking for ways to squirt around the rules was the game. See for example the CumCum (don't blame me, it was called like that) tax-evasion scheme put in place by french banks.