OP wasn't talking strictly about legally protecting company.

Correct.

I suppose this comes down to what you think the purpose of a policy is. To me, it is to communicate something. To communicate the company's policy, guidelines, what have you, about X, Y or Z. If you create some obnoxiously complex, long, unreadable document... you are failing to communicate that policy to people.

If, however, you think the purpose of a policy is to build some legal defense foundation, then I can see why you would insist it was 2 to 3 times longer than necessary and written by lawyers in legalese.

The other interesting part of the conversation that has sprung out of this is that I was not just talking about policies that might have legal implications. But that is where everyone's minds seemed to go. I was talking about IT policies in general.

A policy explaining how we expect staff to sign out travel laptops. Do we really need to a hire a lawyer to make that a 3 page document so that it can stand up in court if someone sues us?!

Another example, this data security plan I'm reviewing right now has 2 and a half pages of paragraphs waxing poetically about passwords. None of this is legally relevant, and almost none of it actually outlines this companies actual password policies. It is all just fluffy words added for reasons that are not clear to me, but I suspect it is because whoever wrote this up thought they needed to type lots of stuff in here to make it sound official.

It is all very silly, and very unnecessary.