Institutions are also vulnerable to institutionalisation. My amateur (but not entirely uninformed) feeling is that organisations have to be carefully constructed to constantly question their operations and their ethics, without that questioning being captured by unethical operators. Which is hard!
