I believe policies are driven by consequences. If someone buys and loads software on the network, and didn’t go through the configuration and Change Management process. Remove it immediate and suspend their credit card.
WE can create process deviations tickets for the person that deviated the process somehow. Problems Ticket could be created and assigned to that specif person whre an cation plan would have to be created and implemented.