I'm not being obtuse - but if you can't trust your employees to run the updates they're asked to, then what are you able to trust them with?
But the incentive structure may prioritize getting their deliverables done over doing patching at least in the short term. The corporate hierarchies for IT and their main organization might only have a common manager at the very top of the company.