A few times now I have worked for organizations that are basically IT shops — that is, their core business now depends on being very good at doing Computer Things. However, many of these places were pretty terrible at computers. Let’s keep picking on Telstra, because its an easier example.
All signs exist for a reason.
Making a sign (or a policy) takes work. Therefore, this work is only done when some incident has caused someone somewhere to decide that the correct response is to expend effort ensuring this thing does not happen again. Now, one issue with this is that it is also a lot of effort largely in the form of risk acceptance to remove a policy or sign. So these things tend to accrue. It is rare for someone to ask if the number of mandatory training courses is still reasonable for example, because they don’t want to be the one to remove one and then eventually have to explain that in a lawsuit or coronial inquest.