For too long, there has been an unspoken assumption in traditional risk management and regulation that organisations are quasi-mechanical and that decision making is essentially rational. The implication is that you if can devise the right rules, risks will disappear because people will respond to them logically.
In truth, all organisations consist of real people who exhibit the range of normal human feelings, emotions and behaviours and have individual characters. These, and well-understood me
