The Polyjuice Potion can give you the appearance of anyone you can get a sample of hair from- not just a clever disguise, but it alters your body so you have the same fingerprints, hair, and body shape. Thus anyone important can be replaced. You'd Expect: The potion to be illegal for use by anyone but Aurors and high-ranking Ministry officials. Instead: Although the Polyjuice Potion is considered very advanced magic, it is not only legal, the recipe and the ingredients can be acquired in the school library and the closet of the Potions class respectively. Also, an (albeit very bright) second year student is capable of brewing the stuff. Also even within the Ministry there is no form of regular polyjuice/identity check.
And that's not even getting into Hermione's little accident where she mistakes a cat hair for a human hair. How the Hell can the smartest witch of her generation, or even just a person of average intelligence, possibly mistake a cat hair - or any animal hair for that matter - for human hair?
It turns out that there's a way to dispel the Polyjuice transformation - a magical waterfall that washes the false appearance away. You'd Expect: That such crucial institutions as the Ministry of Magic and Gringotts bank would install such wards right at the entrances. Instead: The Ministry of Magic doesn't have it at all. Gringotts does, but only deep inside the building. As a result, the heroes are able to infiltrate both places using Polyjuice Potion.
From the second book onwards the same situation repeats itself: some crucial events take place with either no witnesses or kids (usually Harry) as witnesses, and afterwards nobody believes them. You'd Expect: They would use the Time Turners to send back an invisible observer and oversee the events in question. Instead: They never do, and it constantly gets worse.
Speaking of which, Time Turners, potentially the most powerful and destructive artifacts in the world are kept in the Ministery of Magic. You'd Expect: Them to be kept in the most secure, out-of-reach place, accessable only to the select few. Instead: They are kept on an open shelf, with no guards or wards, accessable to a bunch of kids. As a result, they immediately get destroyed, once the Trio even gets near.
Despite having Horcruxes, Voldemort is still horribly crippled after being hit by his own Avada Kedavra as he tries to murder Harry. In order to regain his power, he needs someone to perform a ritual involving bone of his father, flesh of his servant and blood of his enemy. Harry knows all of this and so does Dumbledore You'd Expect: The heroes to try and take out Voldemort, ignoring the Horcruxes until he's dealt with. Sure, it's almost impossible, but Harry was lucky to even have a shot at this guy during the Battle of Hogwarts. While Harry and his companions are above killing people, Dumbledore was someone who could do it and after learning about Voldemort's immortality he was dying anyway, so why not try yourself against the guy who's slightly weaker than you, and you have nothing to lose? Of course, Voldemort wouldn't die, but he'd be out of the picture at least. Death Eaters wouldn't last without him. Instead: They hunt the Horcruxes first, without no plan to kill Voldemort and defeat his army after finding and destroying them.
Dumbledore is aware that someone is attempting to steal the Philosopher's/Sorcerer's Stone, that they were good enough to make a serious attempt to steal it from Gringott's, and there's a strong possibility that it involves Voldemort. You'd Expect: Him to recruit former members of the Order to protect it, to surround it with spells that only let the right person past them and to keep its location a secret from everyone outside of that very small group of people. Hell, a Fidelius Charm would be enough, and Dumbledore has an extremely skilled Charms user on his payroll. Instead: He relies on less than competent people like Hagrid to supply guards and didn't quiz Hagrid on potential problems for those guards. Worst of all, his security used obstacles that were really less security and more puzzles. Admittedly they were tricky but first year students were able to get past the same puzzles that were intended to stop a dark wizard controlled by Voldemort. If not for the last spell cast on the mirror you would have to wonder if Dumbledore was unconsciously trying to let Voldemort return to life.
Chamber of Secrets
Harry and Ron for some reason cannot pass the magical barrier leading to the Platform 9 3/4, but all the other Weasleys are already there, the train has already left, and the boys are afraid that Ron's parents might leave the station another way. Harry suggests that they return to the car they arrived by, because people are starting to stare at them. You'd Think: That the boys would just go to the car and wait for Mr and Mrs Weasley to get back, since they obviously wouldn't abandon their car. Instead: Ron gets a "brilliant" idea to steal the car and drive it to Hogwarts. Car's stealth mode malfunctions, it gets seen by non-wizards, kids get detention, Arthur is fixed with a huge fine, and the Weasleys lose the car.
Voldemort gives a Horcrux, his old school diary, to Lucius Malfoy, but since he's incapable of trusting anyone, he doesn't tell Lucius what it is, just that it's a powerful magical artifact. You'd Think: He would tell Lucius that he values the diary's safety more than he does Lucius', and that if Lucius does anything without Voldemort's express orders, death itself will not be enough to save Lucius from very slow, very painful retribution. Hell, Voldy could suggest that the diary has powerful wards on it that will be activated if Lucius uses it without permission, so that Lucius would hesitate to use it in a cavalier fashion even if he was 100% convinced Voldy was dead. Instead: Voldy does none of this, apparently confident that Lucius would never take any initiative whatsoever regarding Voldy's stuff. So Lucius decides to use the diary to block the passage of a minor law, and gets a portion of his master's soul destroyed.
Said diary ends up in the hands of Ginny Weasley, who eventually suspects that it's connected to the attacks on other students. And she's right: It's possessing her and having her set a basilisk on people. She tries to get rid of the diary by flushing it down a toilet, but later discovers that it's in the hands of Harry Potter. Not wanting him to discover her crimes, she steals the diary back. That's understandable, but her next actions really take the biscuit. You'd Expect: Ginny to try and dispose of the diary a bit more thoroughly than she did last time. Instead: She writes in it again, and as a result, the diary has her attack two more people and Ginny herself almost dies. Granted, she probably wanted to confirm how much the diary had told Harry, but it was still a bad idea.
Prisoner of Azkaban
In the backstory Harry's parents are warned that they've been targeted by the Big Bad and need to hide. They choose a spell that perfectly conceals one's domain, as long as a chosen person (the Secret Keeper), well, keeps the secret. You'd Expect: They would become Secret Keepers themselves. Instead: In gross violation of the Evil Overlord List #222 they make another person the Keeper, and it fails. Granted, that person betrays them, but even without that their plan wasn't as foolproof as it could have been.
Dumbledore accepts a kid into his school who's a werewolf and once a month goes into rampage for several hours. You'd Expect: him to equip a secluded, soundproof, padded room somewhere in the dungeons, behind an inconspicuous or, better, a hidden door. When the full moon approaches, escort the kid there under invisibility charms, lock the door and keep guard while he's transformed. Instead: They either build or use a shack at the outskirts of the nearby village, make an underground tunnel leading there from the school grounds and plant a belligerent tree above the entrance to guard it, then bring the kid there without any concealment. It works for a while, in that it keeps Lupin inside, but it is still tremendously flawed, which leads to the following. You'd Also Expect: Whoever's in charge of the kid not to let him know how to get past the tree, or whatever protection there was, really. Instead: They don't, and as a result, the protection eventually fails and nearly leads to the death of another student.
Years later Dumbledore employs the same werewolf as a teacher. This time, however, they have a remedy that allows him to retain his sanity while transformed, so he can just wait through "those times of the month" in his office. The remedy must be taken regularly for several days following to the full moon. You'd Expect: That they'd provide for some reminder and a contingency protocol, like a lockdown on his office when the ôzero hour" approaches. It's not some flu medicine he's taking - it's supposed to keep him from going rabidly insane in a castle full of children. Instead: Nothing of that kind is done; on one occasion he neglects to take the potion and nearly kills several students.
Sirius Black, an innocent man believed to be responsible for the death of Harry's parents, wants to kill Peter Pettigrew, the Traitor who was responsible (Who conveniently turned himself into a rat 12 years ago and is still in disguise as Ron's pet) and prove to Harry he's innocent. To do so, he turns himself into a dog, grabs Ron and Peter Pettigrew, drags them into a secret shack, and waits for Harry to follow You'd Expect: That first chance Sirius got he would cast the spell to return Pettigrew to human form and explain to Harry what happened. Instead: He just leaves Pettigrew in rat form. When Harry arrives it looks like a trap, and Sirius says things like "Only one will die tonight" which just confirms to Harry that Sirius wants him dead, making Harry try to kill Sirius.
A murderer and traitor has been captured by the trio and two adults, and they need to escort him to the castle. They know full well that he's an Animagus who can turn himself into a rat. You'd Expect: They'd use a simple Stunning Spell on him then float him to the castle, like they're doing to Snapeat the exact same time. Or summon/conjure a jar, put him in it and make it unbreakable so he can't transform just like Hermione does with Rita Skeeter's bug form in the fourth book. Instead: They leave the murderer awake and chain him to two of them, one of who is about to turn into a werewolf. As soon as he does, the murderer transforms and falls out of his chains, leaving Ron chained to a hungry werewolf. But just before that happens... You'd Expect: Hermione, or Sirius, who's currently carrying Snape's wand, to Stun Lupin, or magically restrain him in some other way as he's in mid-transformation (e.g. Hermione's full-body-bind curse). Instead:Siriusshapeshifts into his dog form in order to fight Lupin off. He succeeds, but ends up in a great deal of pain, and nearly has And I Must Scream invoked on him by Dementors as a result.
We learn in this book that the Wizard World has Time Turners, devices which can be used to actually travel back in time. Admittedly they are limited in how far back they can go but even a short distance would allow someone to get access to a huge amount of secret information or, if they were careful, actually interfere in the past. You'd Expect: The devices to be kept under the strictest guard possible, for knowledge of them to be suppressed as much as possible and for them to only be used at times of the greatest need. Instead: One was given to a child so she could attend more classes. While Hermione is more competent than most adults we see they still ran a horrible risk the moment they made it available to her, if only because someone might have realized she had one and stolen it.
Goblet of Fire
Hermione first learns of the Hogwarts house elves during this book. She isn't happy when she finds out that the elves work without pay, sick leave or pensions, and decides to set up the Society for the Promotion of Elfish Welfare (S.P.E.W.) to try and improve things for them. You'd Expect: That if Hermione was serious about fighting for elf rights, she'd look for cases of elves who had genuinely suffered abuse and mistreatment from their masters and/or the ministry (e.g. Dobby, Hokey, the elves of the Black family, etc) and base her arguments around them. Or to at least make sure to know what the elves want. Instead: She only uses the Hogwarts house elves as an example of why elves need rights. Elves who, despite not being paid for their work, are quite happy with their lot in life. As a result, no-one takes her case seriously.
Near the end of the book, Minister for Magic Cornelius Fudge is told that Lord Voldemort has regained his power. The evidence to support this includes the news coming from Albus Dumbledore, who isn't known for making stuff this serious up, and two testimonies. One of these is from a Death Eater who admits to having been in contact with Voldemort and working to ensure his return, and the other's from Harry Potter, who claims to have seen firsthand the ceremony that restored Voldemort to full power, and has the injuries to show it. As well as this, Professor Snape shows him a very clear Dark Mark on his arm. The last time it was easily visible was during Voldemort's reign of terror. You'd Expect: Fudge to figure out that with all this evidence supporting it, it's quite likely that Voldemort's back, and then take the actions suggested by Dumbledore to prevent him getting power and resources. Even if he doesn't believe it, he could still try and have the matter investigated, to confirm it for himself. Instead: Not only does Fudge take no appropriate measures, he somehow gets it into his head that Dumbledore's making all this up to try and take Fudge's place as Minister, nevermind that Dumbledore has never wanted the Minister's post as far as Fudge has known him, all because he doesn't want to deal with Voldemort's return. The result of this is that during the next book, Voldemort's side is able to operate quite freely, recruit the giants to their cause and break out a load of their supporters from Azkaban, while Fudge does absolutely nothing useful. Thankfully, Voldemort doesn't choose to focus all his efforts on taking over, but if he had, the situation could have become a lot worse. And when the truth does get out, Fudge is pretty much fired.
Order of the Phoenix
Voldemort is trying to lure Harry to the Ministry of Magic in order to retrieve a Prophecy about the two of them. His strategy is to use Legilimency to make Harry dream about the place, and want to explore it in person. Dumbledore realises this, and arranges to have Harry learn Occlumency, so that he can stop having these dreams. You'd Expect: Dumbledore to just tell Harry about the Prophecy and Voldemort's plans for retrieving it, and explain that this is why he has to learn Occlumency. That way, Harry might be more motivated to do so. Instead: No-one tells Harry anything other than "you MUST learn Occlumency". As a result, Harry doesn't take the lessons as seriously as the Order would like him to, and is surprised when they consider it a big deal that Snape's no longer teaching him.
Cho Chang decides to join the illegal defense group Harry had set up under Professor Umbridge's nose. She also has a friend called Marietta Edgecombe, whose mother works at the Ministry of Magic, and would therefore be likely to lose her job if her daughter got on the wrong side of Umbridge. You'd Expect: Cho to either keep Marietta in the dark about the group, or tell her about it, but not put her under any pressure to join. Instead: She makes Marietta come to the meeting with her (her words), effectively lumping her with the group whether she likes it or not. Things are all well and dandy for about six months, but then Marietta reports the group to Umbridge, and Dumbledore is forced to take the blame for it to protect all the students involved. Marietta meanwhile is left disfigured, and viewed as a traitor, as a result of her "betrayal", whereas Cho - who was technically responsible for all of this - faces absolutely no consequences as a result of her actions.
Harry gets given a package from his godfather, who implies that Harry can use it to keep in contact with him while he's at Hogwarts. You'd Expect: That Harry would at least have a look at the package, to see what it is, even if he doesn't plan on using it. Instead: He doesn't, apparently afraid that if he so much as opens it, his godfather will get in trouble. It turns out to just be a magical equivalent of a walkie-talkie. Result: Whenever he wants to talk to his godfather, he has to break into Umbridge's office. You'd Also Expect: That the Order in general would take care of providing Harry with means of emergency communication, not to mention extraction. They know that the boy is a trouble magnet, and that the enemy is after his head. Instead: Nobody gives a damn, except Sirius, and he has such a... peculiar way of doing things, that of course it leads to a disaster.
Professor Umbridge gets Snape to give her some truth potion, which she plans to use to interrogate Harry on the location of two of his most important people, both of whom are fugitives. Snape tells Umbridge that she only needs to use three drops of the stuff for it to work. You'd Expect: Umbridge to remember this when the time comes to do the deed. Instead: She uses up the whole bottle. Worse, it's Snape's last sample of that potion, and it takes a month to make. The result is that the next time she needs it, naturally there's not a drop in the castle.
Voldemort lures Harry to the Ministry of Magic and sends his goons there to retrieve the important Prophecy that only Harry can touch. You'd expect: Lucius Malfoy, who's in charge of the operation, would only take those Death Eaters who, like him, had weaseled their way out of Azkaban and into the Ministry ranks, and thus would have a legitimate excuse to be there (or send only the escapees). When the kids arrive, ambush them in the atrium, disarm and take them hostage therefore ensuring Harry's cooperation. Walk him to the storage room and make him take the Prophecy. Instead: He a) takes the recent escapees from Azkaban with him, so when the Cavalry arrives, his true allegiances are exposed, and b) has them wait for the kids inside the storage room, thus wasting time, and only reveal themselves after Harry takes the Prophecy ball, and they can no longer shoot him with spells for the fear of breaking the ball, though to be fair it has been suggested that only the person or people the prophecy is about will be able to grab the prophecy. The whole, taking a bunch of convicts however...
During the events at the ministry, we see that the Time Turners are kept on an open shelf, without any locks, guards or alarms and in a room accessible to a bunch of kids. The power to rewrite the timeline is there for the taking. You'd Expect: That of the numerous people who infiltrated the Ministery that night, someone, be it heroes or villains, would realise the tremendous potential and help themselves to a Turner or two. Instead: They are completely ignored.
The prophecy ball Voldemort wants is kept in the Department of Mysteries in the Ministry of Magic. It can only be obtained by himself, or Harry Potter. You'd Expect: That Voldemort would simply sneak in and steal it, seeing as Harry and 5 other kids practically waltzed in there undetected, despite the fact that Harry is high on the list of people the Ministry is against at the time. Instead: Voldemort decides that it is too dangerous to attempt this as he will probably be discovered and the world will know he is alive again. Naturally, Voldemort tricks Harry into stealing the prophecy, then the Death Eaters try to steal it from him before he escapes, and then Voldemort, who claimed it was too dangerous for him to enter the Ministry, enters the Ministry, just after the prophecy gets destroyed, revealing himself and making his plan less than useless.
Half Blood Prince
In Order of the Phoenix, Harry failed to listen to the advice of someone who was not only a good friend, but the most intelligent of his friends. When Hermione repeatedly told him that there must have been a good reason for Dumbledore to want him to learn Occlumency, and later, that his vision of Sirius being tortured was probably a trap, he angrily brushed her off, and his refusal to listen to reason ultimately culminated in his godfather getting killed and most of his friends ending up hospitalized. You'd Expect: That in the future Harry would at least give some serious consideration to the advice of a friend who could have saved him a whole lot of grief if only he'd listened to her from the beginning. Instead: He continued to brush her off when she repeatedly warned him about the fishiness of the so-called Half-Blood Prince, deciding that an easy Potions grade was worth more to him than the concerns of one of his closest friends. As a result, he ended up nearly killing a fellow student and landing himself in detention for the remainder of the year, and was unable to play Quidditch as a result.
And then the Half-Blood Prince's book itself. It had some unknown hand-written spells without any kinds of notes of what they actually do. You'd Expect: That a person, who'd been studying magic for six years and had more then once witnessed firsthand how dangerous and unpredictable it could be, would know better then to wantonly use unknown spells. Instead: Harry tries one of them in their own dormitory. Luckily, it turns out to be a type of levitation spell that yanks a person by an ankle and hangs them in the air, but otherwise does no serious harm. You'd Expect: Harry to take a hint, that some of the spells in the book are unsafe and discontinue such reckless experiments. Instead: The next spell he uses is denoted "for enemies", and he casts it during a school brawl. Lo and behold, it turns out to be an actual combat spell, and he very nearly kills a fellow student. You'd Expect: Harry to really take the hint and either destroy the book or surrender it to the teachers. It's not like he could've gotten into any more troubles than he already was in, and giving up the book could even be counted in his favor and alleviate his sentence. Instead: He hides the book, apparently intending to retreive it once things calm down. Thankfully, one of the villains inadvertently burns the damn thing before any more damage could be done.
Following from the above Snape deserves a mention as well. Whether he honestly left the book after he graduated from his classes, or it was actually given to Harry with his leave as a part of DD's next elaborate scheme to inconspicously supply him with the Luck Potion, You'd Expect: Snape to go through the book first and make sure it doesn't contain something as dangerous as "Sectumsepra". Instead: He doesn't.
And then there's the matter of the brawl itself. Harry is about to have the Cruciatis Curse cast on him by Malfoy. You'd Expect: Harry - who knows enough about Defence Against the Dark Arts to illegally teach it - to use one of the spells he knows (Expelliarmus, Stupefy, Levicorpus, Pertrificus Totalis, etc) to take Malfoy down non-lethally. Instead: He uses a spell he doesn't know the effects of. It turns out that it inflicts nasty wounds on a person, and as a result, Snape gets an excuse to give Harry a crapload of detentions that cause him to miss the last Quidditch match of the year, and stop him from being able to spend time with his girlfriend.
In this book we find out about Voldemort's set of six magical MacGuffins keeping him immortal. You'd Expect: He'd make them impossible to discover either by using nondescript objects that wouldn't stand out to someone or by hiding them in places only he knows about, that are unconnected to him in his history. Instead: He uses rare and impressive artifacts and hides them in places connected personally to him, most notably, at Hogwarts, where most of his enemies have been for the past 6 books.
As the expiration date of the Blood Wards on the Dursley's house grows near, the Order needs to extract Harry from his house and get him to safety, but Harry cannot use magic yet, and Voldemort's agents have already infiltrated the Ministry and passed a bill, prohibiting the use of Apparition, Floo Powder and Portkeys inside the house, ostensibly for Harry's safety. Not made it impossible, mind you, just prohibited. You'd Expect: Them to ask an Elf, be it Dobby, Kreacher, or any of the Elves employed in Hogwarts (which is by that point still under their control) to side-apparate Harry, since, as was shown in book 2, the Ministry cannot detect Elves apparating at all. Or have Harry put on his Invisibility Cloak and fly away. Or get him and an escort to leave like the Dursleys. Or, if they're going to use the Polyjuice, use it to turn Harry into someone else. Instead: They go with an incredibly convoluted and unsafe plan involving Harry's dopplegangers. They only barely make it, and it costs Moody his life, and Fred his ear.
Voldemort finds out that his wand and Harry's have identical cores, causing them to malfunction when used against each other. You'd Expect: Voldemort to let someone else kill Harry. It's too dangerous to risk going wand-to-wand against Harry personally when all it does is reflect your spells and cause Harry's own wand to become more powerful. Instead: Voldemort insists HE must kill Harry, and wastes time on futile schemes to find a loophole, such as using another servant's wand, or searching for the Elder Wand. So Harry survives. Again. And again. And again.
The bad guys at one point capture the heroes. You'd Expect: Knowing full well that in the wizard world even the most innocuous tackle can be a magical artifact of unknown power, they would strip their prisoners of all possessions, down to the clothes. Instead: They content themselves with taking away the heroes' wands. Naturally the heroes have some spare artifacts that help them escape.
The heroes themselves aren't much better. Harry accidentally summons a load of bad guys by saying Voldemort's name. The bad guys appear, and aim their wands at the heroes' tent. You'd Expect: They would first try side-along apparating to a short distance away from the tent and the bad guys. They've got the hang of it by now, and they've used it to get out of a number of similar situations. For bonus points, they could then sneak up on the bad guys, stun them and leave. Lacking that, Ron and Hermione could've gone out and distracted the baddies, while Harry sneaks out under the invisibility cloak and then snipe them all. Instead: Hermione uses a spell to disfigure Harry's face, to prevent the bad guys from identifying him as such, and they try to talk themselves out of the situation. They fail.
Voldemort realises that Harry has gone Horcrux hunting and checks several vaults, finding them all ransacked. You'd expect: Voldemort would keep his snake Nagini, who's also a Horcrux, by his side at all times, and preferably under magical protection. Instead: While he does both these things, he removes the protection on Nagini when he thinks he's won. The result is Nagini dies, and Voldemort loses his immortality.