Some organisations have policies for everything, right down to the brand of pencil used. Is that overkill, or is it necessary for an effective organisation? I think the answer lies in society.
Think about the stereotypical lawyers bookcase, filled with hundreds of acts of law, and all the amendments too. How could any regular person ever know all of those laws? They couldn’t.
A great deal of what is written down in acts of law represents common sense and “moral” behaviour. People may not necessarily know about each specific law, but on the balance people behave in a responsible manner.
Now, all the laws of society need to be codified and recorded, but organisational policies don’t. Think about a front line staff member who has to comply with 300 organisational policies in addition to legal and regulatory requirements. It’s not going to happen. That employee will conduct themselves according to the culture of the organisation, and their own internal moral compass.
When you’re thinking about policies, excercise caution. Don’t create hundreds of policies that will never be read. It’s a pointless exercise. Instead, create policies and codes of conduct that influence the culture of the organisation. The rest will take care of itelf.

This is great, but are cultures in large organizations created because of rules made by the mistakes of the few? How do you prevent those? Most people don’t surf YouTube for 6 hours a day, but one person did and so everything misses out and the culture is brought down (or at least smiles less)
How to prevent…
Thanks for your comment Brandon. I think the key to your question lay with control. Managers often have a need or desire to control everything they can, including how their staff use the Youtube, Facebook or anything else for that matter. Once managers in an organisation understand their job is not to control, but to enable, the culture will be much improved.
Sure, there will still be the guy who flaunts the rules outright, but managing the many for the mistakes of the few is fruitless. By the way, I also wrote a post on the social networking monitoring and management conundrum you alluded to.