Thanks for that!
Would it be fair to say then, as a generalisation, that it works best when organisations (big or small) simplify standards and contextualise them, whether they do that in-house or hire 3rd party companies to do it for them?
In terms of enforcing them, how do people ensure these guidelines are followed? And what happens when they're not?