I may sound cynical, but I think the best approach is to assume a certain level of laziness on the part of end users. If you assume that people will always take the path of least resistance, you will know from the beginning that there is bound to be use of default passwords, sending sensitive files via regular email, use of unauthorized apps, and other security faux-pas. Starting with that assumption, you have to then assume that "soft" enforcement such as email reminders aren't going to work, and you must instead then look towards implementing technological enforcement. For example, if your policy calls for people to use a certain level of password complexity and to change passwords once a month, lock them out if they don't do so. If your security policy prohibits use of IM on company computers, then block IM at the firewall level.