"Schools and other organizations use accounting systems that only record one type of mistakes. If you do something you should not have done you pay the price, but not when you don't do anything.
Now look at the situation most of us are in: working for an organization that says that making a mistake is a bad thing. But only one kind of mistake can be caught: doing something that you should not have done. Now, if you want to maximize your security in that context what's your best strategy? Don't do anything!!"
-- Paraphrased from the video, emphasis added.
Starts at 8:55 until the end of the video.