Well, from what I have seen over here it isn't that there aren't policies with the processes and procedures to support them.

It is more that the rank and file are not properly educated in applying them, or even understand why they are there?

A chain is only as strong as its weakest link

I do recall getting a filing cabinet........... seemed a bit "heavy" when it was delivered to my office.............. what I found in it was disturbing.......... even though well within my security clearance. And that was all paper documentation........... no computer systems involved.