Precisely, such a change represents substantial risk in an incredibly risk-averse industry. People at orgs in such industries are in constant CYA mode, looking to point responsibility (and therefore blame) to anyone else.

The time to go and implement such a change probably pales in comparison to the amount of time spent in meetings getting people to agree to make the change.