Security culture

Culture is what people do when no control is watching, and it is set by what the organisation rewards rather than by what it says.

If shipping late is punished and cutting a security corner is not, the culture is clear regardless of the policy. The most reliable indicator is what happens to the person who raises a problem that delays something, and everybody learns it very quickly.