Yep, this is common practice.

I do a lot of pen testing, and one of the easiest ways to get access to important things is figure out a way to go into the IT department under some premise. Passwords galore, the rest is just memory :)

(this is, sadly, only a slight exaggeration)