Here, I am not talking about the fundamental of information security, the CIA aspects.
Most often, we trust the policy enforcement is honestly executed. Imagine the parking ticket is issued to vehicle with time expired. How do we ensure this is done unbiased, i.e. the actual time is expired in the meter rather than issuing the parking ticket at wish? We are not yet coming to the point of technology failure (incorrect display, incorrect calculation etc.).
Personal integrity is important and that’s why human is the success factor in cyber security. I have seen incompetent cybersecurity practitioner raising subjective opinions or manipulate the situation based on a buggy policy without looking in the real situation nor listen to feedback. This is the most biggest risk to an organization. The risk is no longer due to hackers, human error, insecure configuration, lack of cyber maintenance and those typical FUD issues.
Therefore, evaluating the competency of the cybersecurity practitioners should be included in cybersecurity assessment or audit.