Re: If you dislike change, you're going to dislike irrelevance even more @gv
That's true, policies do not protect you from these things by themselves. Good people who you know and trust who apply sane access control policies can.
But if things go wrong, at least you can knock heads together, and if necessary sack people if you employ them, rather than having to have to claim against a contract that will probably end up in an expensive court case before it offers any redress.
If you go down a managed service route, then your protection is only as good as the people who your service provider employ, and you have no control over that.