We do have a policy....as I stated before. It's kept for a period of time and then purged. If we as users want to keep it longer it's on us to take the necessary measures. You suggested that was "terrible" policy and I didn't (still don't) understand why. Doesn't matter though...we can move on.
Without going into it a whole lot more, the reason I think it's bad policy is because, generally, attorneys don't like to be surprised at trial or during discovery. Counsel wants to know going in what evidence there is, both for and against. In a way, allowing end-users to keep their own copies of e-mail, separate from the servers, is like allowing users to randomly take copies of company documents home with them. When the company later decides to shred the document, the attorney is going to be pissed when an unknown copy of the (presumed shredded) document shows up in an employee's car during discovery.
So your issue was with allowing the user to keep info on their computer outside the email retention policies. Got it. No policy in the world is going to fix this issue for an attorney. You can't write a policy that prevents this. It's impossible. The best you'd be able to do is use a document library package instead of allowing attachments in email. We have that in some areas. We use Oracle's Content Management suite in some areas of our organization. Even then, there is nothing preventing the user from storing a doc on their desktop in addition to (or in lieu of) loading it to that app unless, of course, what you gave them was only a terminal of sorts. That's highly problematic for most companies.
It's pretty simple to disable the use of PST files in Outlook. It's also pretty simple to give end-users read-only access to their local desktops. It's reasonably simple to disable web sites such as Dropbox, Gmail, etc. at the firewall level (although this costs some money in software or hardware, plus administrative expertise).
It's also very simple to write a formal policy stating that users aren't allowed to do X (e.g. take copies of documents home, or store e-mail on local drives), and will be reprimanded or fired if caught doing X (whether or not the technology exists to enforce it). At the very least, having such a formal, written policy can provide some legal protection for the company in certain instances.
I think we're on the same page here now, though.