At a certain point (size of org, number of incidents) you decide that mere stupidity is not an adequate explanation. It doesn't have to rise to the level of actual malice, but willful negligence is on the table.