She said that her central security group had recognized that policies, no matter how detailed, could never address every scenario that might lead to a security incident.
The most severe possible security incidents are often unaddressed by policies.