You don't even need to go as far as saying someone didn't follow the policy, you can just say you need to review the policies. That way, conveniently enough, nobody is really ever at fault!