Training Programs and Advisory Boards?

I'm all for tightening security protocols at Metro, but last Christmas' security breach seemed to be the result of a security company with a lax track record, the failure to turn on a security camera switch, the absence of an alarm system, and a nonchalant atmosphere about computer passwords at the Election Commission. All of those things could still exist with training programs and advisory boards. Where is the negative reinforcement for the lack of oversight?