For more than a decade, a debate has been going on in the Communications of the ACM (as well as other places, thats just where I've read of it most often). You

For more than a decade, a debate has been going on in the Communications of the ACM (as well as other places, thats just where I've read of it most often). You can't make charges of negligence stick against companies using technology. There are no 'standard practices' they are negligent of following. If they were building a bridge, they would hire licensed certified engineers, and they would be legally bound to give those engineers access to the tools needed to do their job, the time needed to do the job correctly, and even if the CEO wanted to push the project forward despite misgivings of the engineers over safety, he would be legally forbidden to do so (and criminally personally culpable if he did). The same is not true of software-driven systems. There are no licensed developers, no regulatory body determining what tools must be made available, no guarantee of primacy of technical engineering concerns over business management. If a software engineer says "it needs more testing" or even "there is a bug that will kill people" and the CEO says "ship it", it ships and the courts will do nothing. This was proven to be true even in cases where incompetent management results in bad software that gets people killed in the case against Toyota with their "unintended acceleration" due to a firmware bug that would have been caught immediately if the developers had static analysis tools. Companies fight against the establishment of any sort of standards because it would reduce their profit margins. Developers fight against the establishment of any sort of standards because it would raise the barrier to entry in the field and no matter who the standards body consists of, they will select standards which people disagree with, they will be reluctant and slow to change or update them, etc. Both sides are right. But the alternative is companies having free reign up to and including incompetence of the degree which gets people killed with no accountability. People are overall very bad at decisions between two scenarios with clear negatives on both sides. They feel entitled to a 'clean' option and are uncomfortable with saying "I embrace the negatives and accept the burden of working hard to try to minimize their harm in order to gain the benefits of this option." Accepting the negatives implies taking some responsibility for bringing them to fruition and no one wants to be responsible for that - even if the alternative is worse. Not every decision is easy.