We struggled with this for a long time in my organization but over time we were able to gain buy-in from the business to avoid customization wherever possible. Our analysts work hard to identify whether delivered functionality (configurable) can be used to meet a particular business requirement. When there are gaps, we assess the level of complexity of a potential customization - and how that mod will impact support and the maintainability of the software.
That describes our approach at a very high level... however things did evolve with the introduction of the following capabilities:Related Content Framework Event Mapping (RCF-EM) Page and Field Configurator
These frameworks provide us with an incredible amount of flexibility without having to modify/customize any delivered objects. Using RCFEM we can inject our logic (e.g. validation, workflow, overriding default values) before or after the delivered PeopleCode for a number of events (e.g. Component SavePreChange). Using Page and Field Configurator we can hide fields on a page, change labels, or assign default values to simplify data entry.
Hopefully this helps address your question. Feel free to reach out for a lengthier discussion and I'd be happy to connect your team with my lead developer if they'd like to get into the details.
Director of Information Systems
Beth Israel Deaconess Medical Center