And even at Large publicly held companies the guy trying to implement a fix that matters is going to over ride those controls and get it out, the auditor might complain later but who cares. I know some devs that will do it at midnight while smoking weed at Fortune 50 companies. Sometimes you ignore the normal process and get it done and basically work around any locks/restrictions