Most organisations think compliance is about policies. Get the right documents in place, run the training, tick the box. But well-worded policies don’t form a defence to section 250 of the CPA; it doesn’t matter how robust your compliance framework looks on paper.