This is a great point. If something is overly complex and arduous often times people will find a way to go "under the table" and do something in a way that accomplishes the goal but undermines the process.

The classic example is password rotation. It used to be standard to force users to rotate their passwords every 30/90 days, but that led to users having a sticky note on their monitor with their password on it, so security authorities no longer recommend this practice.