Half Your Business Is Built to Check the Other Half
A policy is a document that gets read once by a committee, signed off, and brought out during the post-implementation review when somebody needs to establish whose fault it was. On its own it does nothing, because intent has never stopped anybody. Most of the checking layer in a large organisation exists because somebody wrote down a rule and never built the thing that would make it true.