I'm not saying that's all they should do but, fundamentally, all the policies, training, press releases, investigations, CEO statements, etc. are secondary to the core test of whether bad behavior is encouraged, ignored, tolerated, slapped on the wrist or punished severely.