Paradoxically, the first responsibility of the security training is to show why the security training is important, interesting to you (the employee), and relevant (for your work).
Any training (at least the first-time awareness trainings) must start with this, or at least lead up to it very quickly, otherwise its pointless.
Though it seems from your WTF example that you were referring to testing on the training, which is very different... Training needs to first and foremost TEACH the information.
If the first job (showing why its important) was done well, you don't need to test the rest. If it wasn't - well then, there's not really any point, is there? People will always find some way to cheat if they think its not important.
In addition, having an interesting trainer helps a lot... But not as much as giving the training over a free lunch!
I've done this at some of the biggest banks, to much success - employees are interested in coming for the food (but not just simple sandwiches, mind you); they have reason to hang around and not run out the first chance they get, so they sit and listen; they're enjoying themselves (studies have shown people enjoy themselves when there's food around, go figure); and they have their mental guards down, because of the food.
(Okay, thats more of a strategy than a policy, but still... the policy is making the employees want the training and enjoy it.)
One small addition, again not so much a policy per se, but part of the attitude towards awareness should be offering solutions and practicality of those solutions.
This of course includes proper tools, enough resources to "do" security, etc.
It would be worse than pointless if management got everybody to be aware of security, but then refused them the ability to do anything about it.