She said that her central security group had recognized that policies, no matter how detailed, could never address every scenario that might lead to a security incident.
Policies are inadequate for providing blanket coverage of all scenarios.