There's even a specific policy on consequences: now there's a policy that describes the consequences that may be considered in the context of the Financial Administration Act, which is essentially the act that enables the Treasury Board to put these mandatory policies and directives in place.
On November 24th, 2009. See this statement in context.