I've been several places where this was the unofficial policy and saw it happen a few times. Once while the CISO was abusing someone else's computer, he forgot

I've been several places where this was the unofficial policy and saw it happen a few times. Once while the CISO was abusing someone else's computer, he forgot to lock his own. Credit due to him - he kept his word - and since he was CISO, he paid for donuts TWO weeks running. The policy worked most of the time though.