Is this an issue with not having appropriate policy, policy not being followed, or failure to train?
1) Not having appropriate policy
2) Policy not being followed
3) Failure to train