I think this is true 90% of the time, but that 10% of the time is really risky. The high stakes of the bad case make it wise (imo) to avoid saying your company's policy "sucks"