Set rules against visits to pornography sites and against making offensive contributions to message boards. Make it clear that the company is responsible for transmissions made over its net and that the internet is like any other resource. Assess the risks with directors, other department heads and staff. Spread the word - An AUP is useless if people don't know about it. If you face litigation over staff misuse, your case will be strengthened if you can prove that all employees were notified that they were subject to monitoring.
Training is the key.
This also helps prevent accidental virus intrusions.