One example: regulatory compliance and internal audit departments (and by extension, employees working within those groups) generally trump nearly every other department in terms of dictating processes and procedures, because ensuring that the company isn't sanctioned/fined into oblivion by regulators is an imperative for continued operation of the company. This is a necessary power structure because employees specializing in product delivery or other internal operations don't have the domain knowledge to effectively self-regulate to compliance standards, nor understand the legal and fiscal implications of non-compliance.