The problem is that you can ALWAYS get around rules. It isn't possible to make perfect rules for anything above a minimal level of complexity - that's just a variant of the Turing-Church Halting Problem.
So you are forced to invert the dynamics. There's no real alternative. Instead of you creating a high level of complexity that the departments will work their arses off to avoid, you force the departments themselves to create the regimens that they're prepared to live with. But you have to do so cleverly. They will always create regimens that mean they do the least work necessary (because that's cheap on resources and they will ALWAYS consider this sort of extra work to be an imposition) and have the least amount of culpability.
So you need to meet three conditions:
1. The department can't evade the bits they're actually able to do
2. The department CAN pass on work they're not equipt to do, but ONLY if it's their responsibility to oversee the department they pass it onto
3. The department IS inescapably culpable for failure to either do the work OR ensure that others do it
You do NOT need the frameworks for each department, and should not attempt to draw those up. Those will be departmentally-specific and timeframe-specific. Far, far better have people who actually know the specific context do that work. No department likes to look like it's being forced to do anything, so making the actual detailed specifics internal, you're utilising their psychology. They're not being "forced", they're defining their additional responsibilities and duties. From a psychological angle, they're much more likely to be receptive to this perspective.
But because the departments are all internally writing their own management protocols, YOU DON'T HAVE TO. You only need to have a framework which obliges them to write up what they will request. This is MUCH lighter and, because it is much lighter, it is far less prone to have failure points where generic ideas don't work for a specific type of work.
If we want to look at this in software terms, only an idiot would write an overly-restrictive langauge that imposes a strict model of thought regardless of the type of work. If you want to provide a high level of confidence in correctness, you don't try to impose it through a myriad of complex hurdles and rigorously controlled APIs. You achieve it by incorporating contracts (function X is guaranteed to take in data meeting these requirements, and is guaranteed to deliver data meeting these other requirements). Contract programming is much, much lighter on the development process, doesn't impose on the programmer, and yet creates a very high level of assurance. Mostly because programmers aren't working to try and cheat with irritating APIs.
In Linux terms, you want a lightweight virtual layer handling filesystems in general, the filesystem policies should be handled by the filesystem not the main kernel. You want the main kernel to be doing as little of the work as possible. As soon as it is heavy and micromanaging everything, you're going to end up with something slow and unstable, that really can't do a whole lot.
You want to push the complexity to the edges, that's where complexity belongs. The bit that changes slowly, can't handle special cases, has least visibility into what is needed, and is really a very blunt instrument wants to be lightweight. One reason for having things like Common Law and Case Law is precisely because the legal system figured all this out centuries ago.
