Most organisations are not short of policies. Information governance frameworks, security policies, data classification standards and data loss prevention (DLP) controls are often well documented and formally approved. On paper, the intent is clear: data is valuable and must be protected.
In practice, however, many organisations stop short of enforcing what those policies require. Controls are softened, delayed or avoided altogether. The unspoken rationale is familiar: nothing serious has happened yet, so the risk must be acceptable.
This gap between policy and enforcement is rarely accidental. It reflects how organisations weigh risk, disruption and accountability.
The comfort of writing policies
Creating policies is relatively straightforward. It is usually driven by regulation, audits or customer assurance requirements and allows organisations to demonstrate intent and maturity. Crucially, policy creation rarely forces meaningful behavioural change. Day-to-day working practices often remain untouched.
This can create a false sense of control. Risks appear “managed” through documentation, even when the way data is actually handled has not changed.
Why enforcement is resisted
Enforcement brings reality into focus. Introducing tangible controls, such as tighter access management, mandatory classification or DLP rules, immediately exposes friction. Files fail to send, access is restricted and familiar workarounds no longer function.
Where policies are abstract, enforcement is visible. It disrupts habits and introduces short-term inconvenience. For many leaders, that disruption feels more immediate than a potential data incident that has yet to materialise.
Treating luck as a control
A common justification for delaying enforcement is the absence of incidents. Because no major breach has occurred, organisations conclude the current approach must be “good enough”.
This is a risky assumption. Data risk is often invisible until it isn’t. Sensitive information can be overshared or misclassified for years without consequence, until a single event exposes the gap. Absence of evidence is mistaken for evidence of absence, and luck becomes the control.
Policy versus commitment
The willingness to publish policies while avoiding enforcement highlights a simple truth: policy demonstrates intent, enforcement demonstrates commitment.
Policies satisfy regulators and boards. Enforcement tests leadership resolve and organisational maturity. Accepting risk because “nothing has happened yet” is not risk management, it is inertia.
The real measure of data governance maturity is not what an organisation says about protecting data, but what it is prepared to change in order to do so.
How Evolve North can help
If you’d like to discuss how to move from policy-led assurance to practical, proportionate enforcement, our team can help you assess where controls add value and where they don’t. Get in touch to talk it through. Reach out to us on 01748 905 002 or email mailto:info@evolvenorth.com