- It was against the rules to put sensitive information on disc and then post it out, but someone did it.
- It was against the rules to accept third-party donations, but someone did it.
- It was against the rules to withdraw arrest warrants for no-show defendants, but someone did it.
So when things go wrong, we can always find a rule-breaker to pin things on. (And we'll be right, of course). But if we want to stop things going wrong, how can we make breaking the rules a less attractive option?
Enforcement is an obvious answer. Check up on people constantly, and operate a zero-tolerance policy for errors. You need to pay for your auditing staff. You'll probably pay a cost in employee morale as well, especially if you end up firing people for honest mistakes, but if you're sufficiently rigorous you'll have fewer transgressions. However, the risk is that obeying the rules becomes nothing more than a pain in the neck; something done to keep others happy that gets in the way of the "real" job. This, of course, is an incentive to break the rules.
The alternative is to make the rules matter: to make it as much a part of the job as hitting revenue targets, or saving money, or being efficient. This means "changing the culture" which is something people talk about a lot, without saying exactly how you do it. Training would be a part of it; rewarding "rules-obedience" even when it came at a cost (and punishing mavericks even when they "won") would be another; I think the biggest part would be removing the reasons people break rules: stress, pressure, ignorance, contempt, hassle. You pay for this too of course: if you're going to give people the training, support and resources they need to do their job properly then you're going to have to undo a lot of "efficiency" savings.