Safeguard Enterprise 6.1 - Policy doesn't take effect for File Encryption

This is the first time we're trying to evaluate Safeguard Enterprise 6.1 and we can't get the policy to take effect for certain OU.  

Here's the scenario:

"hr01" and "hr02" will have access to file "HR document" and is under the "HR Folder"

"hr03" has access to "HR folder" but "hr03" doesn't have the right to access or read "HR document".  If "hr03" opens the said document, he will only be prompted with some garbage text

"hr01" and "hr02" is under the "Access" OU

"hr03" is under "No Access" OU

Here's what we did:

1. under the File Encryption policy (default), we specified that the key will be given to "Access" OU

2. under Users and Computers, the Root (Filter is active) is using the Default policies

Result: no encrytion done 

3. under the users "test01" and "test02"(of the domain), we've added a certificate for each user

4. under Computeres, we've added "test01" and "test02" to one of the desktops listed

5. we've saved the settings and synchorized it to the said desktop.  we can view the a grey key for the document and yellow key for the folder.

6. "test03" who has no access can still view the said file.

any idea where we went wrong?

here's the link for the screenshots from the SGN.