The policy should also specify the punishment for non compliance