What role, in your opinion, do policies and/or procedures play in avoiding risk?

What role, in your opinion, do policies and/or procedures play in avoiding risk?