Agree with Steve - however a common source of non-compliance is director or board level. These individuals often want the latest technology, or want more freedom or flexibility than their staff, and are in a position of power so can demand it, so sometimes the Information Security team need to proactively identify solutions to upcoming technology issues in order to provide a secure solution by exception in these cases.
Where senior/executive management are utterly bought in to security policies, an organisation is typically more robust and governance and compliance are more easily demonstrated, but in the more usual business organisation the aim is to make compromises which allowm to enable business while not impacting security too much.
In my experience this doesn't vary that much between countries in Europe, America or the Middle East, or across industries. The point being that individuals in senior positions want to do business their way, and usually their way is considered right for the business if they make revenues and that is where we as Information Security professionals come in.
The circumstance where an individual sits on more than one board is a major problem. The security ideal is obviously to completely segregate each role, however getting a director to carry round multiple laptops is unlikely. What typically happens is they use one account and manage all emails and accesses from one machine - and you end up relying on them not making a mistake.
Segregation by virtual machine would seem to be a logical next step, but I have only ever seen this once. This can be secured to a high level, but requires a certain amount of communication between organisations to agree the configs etc.