Agreed, and I think you could coin that as the Risk Corollary to Pournelle's Iron Law of Bureaucracy. Because a bureaucracy's control is eventually driven by po

Agreed, and I think you could coin that as the Risk Corollary to Pournelle's Iron Law of Bureaucracy. Because a bureaucracy's control is eventually driven by political considerations rather than results, a bureaucracy's risk management policy will eventually be driven by politics rather than results, and as such, policy will attempt to reduce the appearance of risk rather than reduce risk itself.