I was actually working for a company that was a subcontractor to the USAF in the distant past. There is little room for individual creativity and ingenious problem solving in such a process heavy environment. It's actually like trying to work on an engineering project with Siri. The outcome of this is that only the problems allowed to be solved by the process are solved and none of the risks not identified by the process are reported, because it's too much paperwork already if you find a new one and you're not going to want your job to get any harder.
Ergo, all unidentified risks get taken because they are attractive solutions to many problems. Looking at the spanner incident pointed out by two sibling comments, the "dont carry heavy tools or anchor then when working on the big explodey thing" rule was not enforced and double-checked but hundreds of minor rules with precisely no benefit were being applied. Someone knew of that risk but didn't put the mitigation in place, probably because it was too hard.
Now military rigour and all of that doesn't like to be seen to be a turd sieve of a process so what happens is the answer is to add more processes, not look at the fundamental problem in the approach.
Overall, you need to focus on the key places where risk is considered high, but for most things, meh. Listening to people and making sure risk is managed effectively is a win.