No offence, but if your not going to fire people when you find their password written down then there going to write their password down. Written policies are practically irrelevant it's enforced policies people pay attention to.

One example of security. Someone (A) giving a breafing has someone (B) grabs at it so they can read the document. At which point (A) pulls his sidearm and threatens (B). Later (A) is given an intense debriefing to verify that he was willing to shoot (B) and simply wanted to clarify the situation vs being unwilling to shoot (B). (B) was later told he was lucky not to have been shot.

One of the most common failure modes is screen captures which are often used for auditing. So there enabled even when everything is working correctly. For encrypted passwords that are sent directly to the clipboard you still get those files backed up which means you can brute force the password file without throwing up any red flags. Also, pasting passwords is disabled on many secure applications. For apps there stored on an unsecured device with a wide range of failure modes.