System security and risk management

Establishing security policies within an organization is a necessary endeavor. However, it is fruitless unless the information is effectively disseminate. How would an organization go about getting this information out to the masses? 

Policy monitoring procedures must be implemented for any policies that the organization configures. Internet usage policies is a great example, what are your thoughts on the validity of monitoring Internet usage on company assets.?