When you combine risk management with certain corporate cultures and market verticals, you get a combination of the following:
Risk aversion
Lack of technical knowledge in the management layer
Technology viewed as overhead vs. a value provider
These three things are deadly to an ambitious corporate IT project. Unskilled management can't appreciate requirements, manage scope nor understand trade-offs very well. The business wants guarantees on budget and timelines. Budgets are fixed, and management rarely wants to ask for more since ROI may be hard, if not impossible to quantify.
So what do you end up with? The standard "over-promised and under-delivered technology" solution that are endemic across so many enterprises.
[edit - formatting and spelling]