Isn't SSL often terminated at some network equipment in front of the real webserver? An IDS can still work behind that..
It's worth noting that in such an environment, he likely controls the client machines themselves (ie, only corporate machines on the corporate network), so it's straightforward to just push out a trusted Certificate Authority and intercept anyways.