Policy compliance is a constant battle of wills in most large organisation. Enough of a battle in some places that they have compliance staff.

Just because they sign up to do something in a particular way doesn't mean everybody in that org is going to follow those rules.