Definitely agree. In my experience, the financial industry tends to lean heavily on checklists and bureaucracy to enforce security. This requires additional headcount and prevents automation.
Technology companies lean the other way and enforce security through comprehensive automation of the controls they must follow.