Ask why any particular internal rule exists and you will usually get a shrug, and occasionally a story. The story is always the same story. Somebody did something once, it caused a problem, and a policy was written so it could not happen again.
That policy was a proportionate response to a real incident. It is also, years later, being applied to several hundred people who have never done the thing, by managers who do not know what the thing was, in a company that has changed shape twice since.
Nothing in the process removes a rule
The asymmetry is what does the damage. Writing a policy is a visible, defensible act performed by someone senior in response to a problem everyone agrees was a problem. Removing one is an invisible act with a clear downside and no upside: if nothing happens, nobody notices, and if the original problem recurs, the person who removed the rule owns it entirely.
So policies accumulate the way sediment does. Each layer was reasonable, and the aggregate governs a company that no longer resembles the one each layer was written for.
What it costs is not mainly compliance time, though that is real. It is the signal it sends. An expense policy requiring three approvals for a modest sum tells every employee that the company's default assumption about them is theft, and it says so several times a month. Most people are not stealing, and the policy is a message to all of them about how they are regarded.
It also lands unevenly, which is the part that rarely gets discussed. Rules written to constrain a particular individual are enforced against the people least able to push back, while the senior person the rule was actually aimed at finds the exception they always find. The blunt version of the same instinct produces the reorganisation used to avoid making a decision — a structural response to a problem that had a name.
I would propose something narrower than a review, because reviews of this kind get scheduled and never happen. Give every new policy an expiry date at the moment of writing. Eighteen months, then it lapses unless somebody actively renews it. That inverts the asymmetry: continuation becomes the act requiring justification, which is the only way anything ever gets removed.
The objection is that important rules would lapse through inattention. In my experience the rules people actually rely on get renewed without difficulty, and the ones that lapse quietly were the ones nobody could explain — which is the same test that empties a calendar of the meetings nobody would reinstate.
