Intent/attitude is everything. We recently had a situation where the #2 guy on one of our SAPs, a very senior director, inadvertently took a laptop into a secure area, never even turned it on, and left with the laptop after an hour or so. He self-reported it 3 days later. They grilled him on why it took 3 days for him to self report. His answers were along the lines that he was too busy, didn’t think it was that big of a deal, and just didn’t get around to it. The customer revoked his program access on the spot, because they could not tolerate anyone in a leadership position having such a cavalier attitude toward security.
Mistakes can be tolerated. Disdain for procedures cannot.