Around 60% of organisations have a drink and drug policy. Fewer than 20% carry out any testing against it. A written policy that is never tested against is not a control. In the event of a serious incident, it is evidence of what you knew you should have been doing all along.