Which of the following is the MOST effective way to ensure information security policies are followed?