Every enterprise has a compliance policy - NDAs for vendors, safety inductions for contractors, health declarations where required. That's not the gap.
The gap is between having a policy and knowing it's actually enforced.