I'd go further to say that rules without any verification aren't really rules. You don't make a rule without the suspicion that it'd be more efficient to break them, and if you're not verifying their adherence to those rules, your rule is meaningless.

This is the iterated game that morally bankrupt manufacturers (IE the vast majority) play to insulate themselves in these sort of scandals: - First, they get caught doing A,B,C, so they pass rules about A,B,C - Then they outsource to someone who is willing to do A,B,C, then they get caught outsourcing to violators - Then, they impose rules about A,B,C on these firms, but do no verification of the firms adherence to those rules. It insulates them of liability without ever increasing costs (because the firms still get to break the rules and the company gets to say "I'm Shocked! I told you not to do that!")