Setting the scene:
Let’s say you have an extremely sensitive and dangerous piece of equipment. Misuse could result in deaths of hundreds of thousands of people. Terrorists might target this equipment, either to use it themselves or to cause an incident.
So, you have a group of people who are responsible for protecting the equipment, and for using it when required. You train these people in their duties and routinely (once a month) test them on their readiness. Could be safety issues, could be operational issues — you want to make sure they’re up to speed.
You hear rumors that some of the supervisors were involved with illegal drugs. Scary, huh? You investigate and, in addition to the supervisors’ drug involvement, you find that the employees were cheating on the monthly exam by sharing the answers to the quiz. Some others knew of the cheating and failed to report it. Your controls have some weaknesses. Who has the oversight responsibility?
“Air Force Finds Cheating Among Nuclear-Missile Crews,” Wall Street Journal, January 16, 2014 A5 http://on.wsj.com/1eUSzA6
My point isn’t about the hazards and the procedures followed to control those hazards, or even the failure of those controls. It’s about the culture in that missile unit in Montana. The officers were allegedly involved in drugs. People knew that others cheated on proficiency tests but didn’t report it. Who’s responsible for the culture? Is there a major somewhere who’s got some explaining to do? Is that the appropriate mitigation?