> I think IT incompetence should lead to audit fails or even better delisting from exchanges.

Fear of policy is why you get things like "force us to change our passwords every 6 months and block the last twenty". Getting a central arbiter of IT competence is a hard problem.