The FSA made an interesting comment on risk policy in its industry feedback on Advanced Measurement Approaches (March 2006)

Typically, firms we visited stated that responsibility for day-to-day risk management lay with business functions. However, this was rarely reflected explicitly in business management objectives, appraisal or remuneration; few firms required staff to read and accept the ‘OR Policy’. This suggests to us that the OR framework may not yet be properly embedded into business activity.

Other empirical evidence seems to support this observation: producing a risk policy is not the same embedding it as part of the risk culture of the organisation. While this review was conducted some time ago, my experience is that risk policies are still not widely viewed as essential reading by senior managers let alone all personnel.