What 'IT' often fails to fully appreciate is that, when there is a breach, management will close ranks and be united in the purpose of making sure that only 'IT' will get to walk the plank over it.
Completely true, until you have several IT-staff, who have experienced that a couple of times. They will know how to cover themselves and document all requests, with double back-up for anything even the slightest irregular. When (not if) management tries to make IT walk the plank, there will be an Auto-da-fé resulting in a lot of terminally terminated careers. Been there, done that and the marshmallows tasted damned good.