I work for a fortune 500 with 100,000 + employees, and I can say without reservation that the company guideline is that compliance (or any kind of written policy) is more important than actual security.