In my experience, it is the good business lawyer (whether in-house counsel or outside counsel) who will tell you what the risks are, and then it's the choice of the business to decide which risks they want to take.
However, there's also the case where the shitstorm is so bad that they lawyers have a legal and moral obligation to tell you (and the CEO, and the Board of Directors) that what you're doing is wrong and illegal, and maybe even quit over grossly inappropriate or negligent activities.
However, there's also the case where the shitstorm is so bad that they lawyers have a legal and moral obligation to tell you (and the CEO, and the Board of Directors) that what you're doing is wrong and illegal, and maybe even quit over grossly inappropriate or negligent activities.