Every 'must' is a commitment somebody has to keep
Modal verbs are the load-bearing part of a policy.
The difference between will, must, should and may is the entire structure of obligation in a document, and it is frequently applied without thought. A drafter reaching for stronger language to convey seriousness converts a reasonable expectation into a binding requirement, and the organisation is then in breach whenever the expectation is not met.
The practical discipline is to read a draft counting only the obligations and asking, for each one, who performs it, how often, and whether they have the time. An obligation with no identified performer is not a control, it is a wish, and it will be discovered as an absence at exactly the wrong moment.
Conditional obligations deserve particular care. A requirement that applies where practicable or as appropriate has moved the decision to whoever is doing the work, which may be correct and should be deliberate. Frequently that qualifier is inserted to make an unachievable requirement acceptable, which leaves the document unenforceable and the practice unguided.
The count itself is informative. A short procedure containing forty obligations is not more rigorous than one containing six; it is one that nobody can comply with fully, which teaches everybody that partial compliance is normal, and that lesson generalises to the six that mattered.
The other reason to count obligations is that they interact. Two documents can each impose a reasonable requirement that together are impossible, particularly where both specify a timeframe for the same person. Nobody notices because the documents are reviewed separately and by different owners, and the person caught between them resolves it by ignoring one, which is a decision the organisation never made.