Many organizations rely on institutional knowledge rather than written policy. Why do you think all major information security regulations require a written information security policy? Do you agree? Explain your opinion.

Many organizations rely on institutional knowledge rather than written policy. Why do you think all major information security regulations require a written information security policy?
Do you agree? Explain your opinion.