I Apologise for trivialising this very well informed thread but it has parallels across MOD. Workflow below taken from JSP000 - MOD policy for dummies.
1. Draft a policy without properly assessing the consequences - especially the cost of compliance.
2. Realise that as a country we have outsourced most r&d and de-skilled the procurement element with generalists.
3. Pay a manpower sub to write a risk/safety/security/<add specialism here> case to explain why complying with the policy is a bit difficult.
4. Escalate until you reach the top of the pyramid.
5. GOTO 1.