As an IT Executive, I have always had a poster hung in my office no matter which organization I was privileged to be working with, that simply read:
“There are no IT issues, only business issues. Solve the business issue.”
In fact, I’ve frustrated more than a few trainees and auditors asking them to walk me from “minimum password length” to the financial statement risk without quoting “Microsoft recommended settings”. Frankly, I remember one particularly difficult conversation with an IT Auditor who was in the process of writing an exception over my area regarding Business Continuity Planning.