> Sometimes there is blame, though. Sometimes a root cause is simply that a person or group was not competent in their execution of a task. It is true that som

> Sometimes there is blame, though. Sometimes a root cause is simply that a person or group was not competent in their execution of a task. It is true that some people are not good at their jobs. It's also true that the only way to discover that people are bad at their jobs is their performance. However, I think the process approach is applicable to a much larger domain than many people give it credit. One of the greatest software development quotes I've read comes from DJB [0]: > For many years I have been systematically identifying error-prone programming habits—by reviewing the literature, analyzing other people’s mistakes, and analyzing my own mistakes—and redesigning my programming environment to eliminate those habits. The difference in security bugs found in qmail and sendmail speaks for itself. This is an example of the superiority of process: it shows that what some people consider a "root cause" is actually only a proximate cause - that the root cause is the programming environment that allows the bugs to occur. [0] https://cr.yp.to/qmail/qmailsec-20071101.pdf https://cr.yp.to/qmail/qmailsec-20071101.pdf