Having a piece of paper in the filing cabinet is not enough. Having everyone sign it when they join is not enough. Is it being followed? What's the penalty for not following it? That's the bit we need.