Policy and procedure is the responsiblity of the Dept. Manager. No matter what anyone else says, it is his / her responsiblity. Now mind you, they may delegate down the chain if it is deemed necessary.
The reason it is supposed to be the Dept. Manager is due to the daily manager meetings and briefing they are supposed to attend with all the other dept. managers. They are supposed to provide input on what they "would like to have" / "would like to happen" / and "would like to see". From there, the manager should interpret all of that info, disseminate it throughout the IT group for further input as to what can and cannot be done. Finally, the dept. manager should submit new changes to the CEO for appoval. Once changes have been done, implementation is carried out first by the dept. manager informing both in a meeting and hard copy to the other dept. managers. Lastly, posting the information in the workers public area, e-mail, and company intranet.
It is not the MIS Dept's. duty to fully inspect on a daily basis every pc. That is the job of each groups managers to ensure workers conform to the policy.
Possibly on a random basis, the computer dept. can do checks of systems through the back doors of the systems and report an analysis to the IT manager.
Good luck.
