The Eleven Secret Sauces of Business Process Maturity

Why Some Organizations Build World-Class Internal Controls While Others Simply Check the Box

Every organization has business processes.

Every organization has policies.

Most organizations have internal controls.

Yet only a handful operate at what could be called a mature level.

Why?

The answer isn't found in another policy manual or another audit checklist. Mature organizations combine several disciplines that work together to create a culture where quality, accountability, and continuous improvement become part of everyday operations.

I refer to these as the Eleven Secret Sauces of Business Process Maturity. Together, they create the environment where key controls become sustainable rather than temporary compliance exercises.

What Is Business Process Maturity?

Business process maturity measures how consistently an organization performs its work while managing risk, achieving objectives, and continuously improving.

Immature organizations often depend on individual employees to "save the day."

Mature organizations depend on well-designed systems.

That's an important distinction.

As W. Edwards Deming taught decades ago, quality is created by systems—not heroics.

The eleven secret sauces represent the ingredients that transform a collection of procedures into an integrated management system.

1. Discipline

Everything begins with discipline.

Policies are only effective when employees consistently follow them.

Processes become mature when people perform work the same way every time unless management deliberately changes the process.

Discipline creates:

• Consistency

• Predictability

• Reliability

• Accountability

Without discipline, even the best-designed controls eventually fail.

2. Understanding the Risks

Controls should never exist simply because "we've always done it that way."

Every control should address a specific risk.

Organizations that understand their risks can:

• Prioritize resources.

• Design better controls.

• Eliminate unnecessary procedures.

• Respond more quickly to emerging threats.

The best organizations constantly ask: "What could prevent us from achieving our objectives?"

Risk-based thinking is now a cornerstone of the COSO Framework and the 2025 GAO Green Book.

3. Standards

Standards define what "good" looks like.

Without standards, every employee develops their own interpretation of quality.

Standards create:

• Common expectations.

• Repeatable processes.

• Easier training.

• More objective evaluations.

• Better audit evidence.

Whether based on the GAO Green Book, COSO, ISO 9001, or industry regulations, standards provide the foundation for operational excellence.

4. Formal Training

People cannot execute processes they do not understand.

Training should explain:

• The process.

• Individual responsibilities.

• Required documentation.

• Common errors.

• Internal controls.

• Why the process matters.

Organizations that invest in training experience fewer errors, fewer control failures, and stronger compliance.

5. Understanding the "Why"

One of the most overlooked aspects of process maturity is helping employees understand why a control exists.

When people understand the purpose behind a control, they are far more likely to follow it consistently.

Instead of saying:"Complete this checklist."

Explain:"This checklist prevents unauthorized payments and protects taxpayer dollars."

Purpose drives commitment.

6. Metrics

"If you can't measure it, you can't improve it."

Although often attributed to Deming, the sentiment captures an essential management principle.

Metrics provide objective information about whether processes are improving or deteriorating.

Useful metrics include:

• Error rates.

• Cycle times.

• Exception rates.

• Customer satisfaction.

• Compliance percentages.

• Audit findings.

• Corrective-action completion rates.

The goal is not measurement for measurement's sake—but measurement that supports better decisions.

7. Exception Handling

No process is perfect.

What separates mature organizations is how they respond when exceptions occur.

Rather than ignoring problems, mature organizations:

• Identify exceptions quickly.

• Analyze root causes.

• Correct deficiencies.

• Prevent recurrence.

• Share lessons learned.

Exceptions become opportunities for improvement rather than sources of blame.

8. Mentors

Experienced employees accelerate organizational maturity.

Mentors help new employees understand:

• Organizational culture.

• Best practices.

• Practical judgment.

• Lessons learned.

• Professional expectations.

Knowledge transfer reduces risk and preserves institutional expertise.

Without mentoring, organizations repeatedly relearn the same lessons.

9. Monitoring — Management by Walking Around (MBWA)

Deming emphasized that leaders must understand how work is actually performed.

One effective technique is Management by Walking Around (MBWA).

Managers who leave their offices and observe operations firsthand can:

• Identify emerging risks.

• Remove obstacles.

• Reinforce expectations.

• Coach employees.

• Verify that controls are operating.

Monitoring is one of the five components of both COSO and the GAO Green Book because controls cannot improve if management never observes them.

10. Layers of Testing

One review is rarely enough.

Mature organizations build multiple layers of assurance, including:

• Employee self-checks.

• Supervisory reviews.

• Quality assurance.

• Internal audits.

• External audits.

• Regulatory examinations.

• Independent assessments.

Each layer increases confidence that controls are functioning effectively.

This concept reflects the "Three Lines Model" used in governance and risk management.

11. Ownership and Certification

Perhaps the most important ingredient is ownership.

Controls should never belong solely to Internal Audit or Compliance.

They belong to management.

Every process should have a clearly identified owner who is responsible for:

• Process performance.

• Risk management.

• Control effectiveness.

• Documentation.

• Corrective actions.

• Continuous improvement.

Certification reinforces accountability by requiring managers to periodically confirm that their controls are operating effectively.

The Federal Managers' Financial Integrity Act (FMFIA), OMB Circular A-123, the GAO Green Book, and many state internal control programs—including Virginia's ARMICS—are built on this principle.

Why the Eleven Secret Sauces Matter

The eleven elements reinforce one another. Discipline supports standards. Standards improve training. Training strengthens ownership. Monitoring validates performance. Metrics highlight trends. Exception handling drives improvement. Together, they create a culture where quality and control are embedded in day-to-day operations rather than bolted on for an audit.

Organizations that excel in governance rarely succeed because of a single breakthrough. They succeed because they consistently apply these foundational practices.

A Blueprint for Continuous Improvement

Whether your organization follows the GAO Green Book, COSO, ISO 9001, or another governance framework, these eleven "secret sauces" provide a practical roadmap for strengthening business processes and internal controls.

The strongest organizations do not wait for an audit to reveal weaknesses. They build systems that encourage accountability, measure performance, learn from mistakes, and improve continuously.

As W. Edwards Deming reminded us, quality is not an act—it is the result of a well-managed system.

The Eleven Secret Sauces of Business Process Maturity help transform that philosophy into everyday practice.