I think that there are roughly 4 causes:

• As you mentioned, people promoted all the way up to the first position they are truly incompetent at, i.e. the Peter Principle
• Nepotism and cronyism - people are getting the jobs because who they know (i.e. "the old boys network") or who their family are, not competence.
• People get the job because they're good at personal image management and social networking - they mingle with the right people and project the right impression with things like speaking in a firm confident manner about things they know nothing about - which are fine skills to have and even applicable to some of the job of management (at the mid and above management levels), just not enough for the rest of the job of management, and that part missing is in most management positions the biggest chunk (and includes the stuff for recognition of risks and accounting for them).
• Upper level managers hire people like themselves to work under them. This partly overlaps with number 2 but goes further. When said upper level management is incompetent because they got in due to one or more of the other 3 problems, they hire people the same profile as themselves even if not due to those reasons directly (a simple example: managers who look and behave posh because they attended a posh private school will tend to hire managers who look the same hence are likely to have attended such schools themselves - this isn't directly cronyism but ends up producing a similar effect as they're selecting people from their social domain even if they don't know them personally)

I would say that nowadays in management the first one is a pretty small fraction of it (except maybe in the less prestigious and less paid low level management positions) because people are rarely "promoted from the ground floor" nowadays and hiring for more prestigious positions is very heavy on the impression people project, so most of the problem are numbers 2 and 3 plus a bit of number 4.

Number 4 is especially pernicious because it means that once an institution is managed at the top level by people who do not recognize the importance of certain skills in management (like caring about and understanding risk analysis) it tends to mainly hire people who are the same for other management positions and even for replacements for the top job - people who don't think a certain skill or mindset is important for the job are not going to have as a hiring criteria that candidates have such skill or mindset.