Enforcement case demonstrates the risk and expense of faulty compliance policies