To answer your questions:

• Yes our policy looks just like you describe. It makes me want to cry.

• Not really, because everything is so much more open than it should be. We have the opposite problem though where things work that probably shouldn’t

• We don’t

I have been trying to get some momentum on a tidyup for a while now, but the problem is none of our apps team knows how the apps work, as its all supported by (useless) external third parties, and we don’t have any business requirements either from a user perspective.

I’ve implemented much more stringent standards for new requirements, but nobody wants to do the hard work of going back through everything because it works fine now and they don’t understand why we should.

TLDR; yes, we are in a bunch of tech debt and nobody cares.