Why is it that so many password management policies fail? There are a number of reason, many of which can be fixed but it requires effort by management.