Some laws, regulations or policies can be very well motivated or self evident, but others are more difficult to motivate. The policy may for example be a legacy from an earlier era or issue that has ceased to exist. Other are just based on wrong assumptions from the start, perhaps invented to locally optimize some aspect in the organization at the cost of the whole. Bad policies can also be the result of corruption or ignorance.
But what happens to policies that is not current any more in your organization? Typically it seems like they at some point stop being enforced. A policy that is not being enforced is kind of useless. I would further more say that it is even more damaging to society or the organization at large, since it can undermine the trust between individuals in the organization. "If one person can break that policy why can't i, break some other policy?" seems to be the reasoning...
The efficient way of dealing with bad policies would be to just admit that the policy and the policy maker was wrong. In society bad laws are replaced by newer laws eventually, but within an organization it may not be possible to have that kind of overhead. Motivation for the policies should in stead be made clear so that spotting wrong assumptions is possible and enabling corruption to be ruled out as the primary reason for the policy. I wonder if this could actually happen in IT...
