What are the consequences for not following correct procedures at any time? Basically none. Seriously? Major problems happen, this is backed up by your own points below. IT policy is considered a list of suggestions at most companies. This is part of the problem. It would also raise the profile of IT within the organisation As an IT worker, you don't want a high profile. The tall nail gets hammered down. You don't want to be easily visible when it's time to pick a scapegoat. An IT department is doing its job when nobody knows who you are. As an individual I agree, however IT needs to take its place as a key component of business! Yes I have worked in places where they barely noticed us because everything "just works". However this creates a rod for our own backs, they can't see what we do, so they do not respect us and think we are disposable. Too often IT is treated like the red-headed step child janitor, until it hits the fan. The janitor has better job security. And when it hits the fan, it doesn't spray all over the people who caused the problem. IT, however is in the kill box. Why correct someone's behavior or train them, when it's so much easier to just fire people. Hell, they're probably mostly contractors to begin with, so they're about as disposable as a paper towel. This is part of the problem that needs to be fixed. The focus on IT needs to come from the top however, I'm not suggesting that IT just does it. Please note: not every IT problem is caused by chair moisteners out in the cube farm. Recently our IT department lost our source control server. As in it's gone. As in there were no backups. As in the source of our flagship product just went in the bit bucket. Fortunately we were able to reconstruct from local copies on people's machines, but there's really no excuse for that sort of thing. That's just stupid and unacceptable! Why was it like that?! If they wouldn't fund redundancy and backup them it's their problem and fault, not IT. This is one case where IT being highly visible is a symptom of the problem, which is gross incompetence in IT. That's being visible for the wrong reason. Being invisible because you're doing your job well is just as bad, not in and of itself, but because of how business people think, as explained above. IT needs to be an important part of any organisation, and needs to be treated as such. Your own example shows what happens when it's done wrong. We can't just quietly do our jobs, if C level people made IT a priority and running drills with full management support is part of that, then we'd be much better off. The organisation would be too, IT is vital, it needs to be treated as such.
What is now proved was once only imagin'd. -- William Blake