If you have a policy that says e-mail can be monitored but...

If you have a policy that says e-mail can be monitored but in 10 years you've never monitored anybody's e-mail, then your de facto policy is that e-mail is not monitored.