There are many barriers to policy acceptance and enforcement. Without acceptance and enforcement of policies, employees could operate in a laissez-faire state. This runs counter to the business goals. It will inevitably lead to an employee not taking policy seriously. Employees taking shortcuts or ignoring policy can have serious impacts. Within an organization, there must be support at all levels, from the top to the bottom. Employees must have a stake in ISS. They must understand how those policies and procedures affect them and their business area. If they have a stake in creating or approving policies, they will be more likely to accept those policies. The following is a list of policy acceptance challenges:

• Organizational support at all levels—Without cohesive support from all levels of the organization, acceptance and enforcement will fail.
• Giving employees a stake—There must be something to motivate employees to buy in to the process. This could be some kind of award for participating, or disciplinary action if they don’t.
• Policy awareness and understanding—Employees must know a policy exists and understand what it means. Crafting the document to make this easy can be challenging.
• Rewarding and recognizing behavior—Employees must see good examples to model their behavior after.
• Hold individuals accountable—Employees must know there is a consequence for repeated noncompliance.

Enforcement of policies can be just as difficult as policy acceptance. There are several reasons why enforcement is challenging. The language in which policies are written can be vague enough to be unenforceable. Infractions are not reported, which is often a key contributor to the lack of enforcement. Other business areas in the organization, such as human resources or the legal department, might not be part of the enforcement process. This can give employees license to either disregard the policies or perform actions contrary to them. The following list recaps policy enforcement challenges:

• Poorly written policies
• Failure to report infractions
• Lack of involvement in enforcement of key departments and management
• Lack of clearly defined roles and responsibilities