Implementing best practices: why maturity needs time, method and evidence
Implementing best practices is not simply about approving policies, defining procedures or delivering training. Maturity begins when requirements are understood, applied and demonstrated through consistent practices, reliable evidence and real response capability.
⏱️ Estimated reading time: 6 minutes
Implementing best practices does not solve everything when real application is missing
Many organisations already know their requirements. They know they have legal, normative, contractual or internal obligations. They know they need policies, controls, plans, assessments, audits and training.
The challenge lies in turning all of this into practice.
A policy may exist without being followed.
A procedure may be approved without being understood.
A control may be designed without being operational.
Training may have taken place without changing behaviours.
For this reason, the most important question is not always: “have we defined this?”
The right question is: “is this really being applied, understood and demonstrated?”
The maturity of best practices is not born on the day of implementation
Organisational maturity does not appear at the moment a policy is published, training is completed or a project is closed.
It is formed through repetition.
It is formed when teams apply criteria in real situations. When those responsible make decisions based on reliable information. When deviations are identified early. When the organisation learns from incidents, audits, exercises, complaints, failures or changes.
Time is important, but time alone is not enough.
It can also consolidate poor habits, informality, excessive dependence on certain people or practices that no longer respond to the current risk.
That is why maturity needs time. But it also needs direction.
Method helps implement best practices consistently
Many initiatives begin with good intentions.
The organisation wants to strengthen security, meet requirements, improve quality, protect data, prepare for incidents, respond to regulatory demands or develop internal competencies.
But, without method, the initial energy loses momentum.
The topic becomes dependent on a small number of people. Teams apply different criteria. Evidence remains incomplete. Responsibilities become unclear. Training takes place, but it is not always connected to real work.
Method helps prevent this dispersion.
It helps clarify priorities, responsibilities and criteria. It helps distinguish what is urgent from what is structural. It helps transform technical knowledge into practical application. It helps create useful evidence, not just accumulated documentation.
Evidence shows whether best practices really exist
An organisation may state that it has defined processes, trained teams and implemented controls.
But evidence is what makes it possible to understand whether the practice really exists.
Evidence shows whether an activity was carried out, whether a decision was made against clear criteria, whether a responsibility was assumed, whether an assessment was performed or whether a deviation was followed up.
This is particularly relevant in areas such as information security, privacy, business continuity, compliance, governance, quality, anti-bribery, artificial intelligence, service management or operational resilience.
In these areas, it is not enough to say that there is concern. It is necessary to demonstrate capability.
And that capability is demonstrated through coherent practices, reliable records, traceable decisions and people prepared to act.
Training helps transform best practices into capability
Training plays an essential role in the implementation of best practices. But it only creates real value when it is linked to the function, context and level of responsibility of each person.
Not everyone needs the same depth.
Some professionals need to understand the fundamentals. Some teams need to know how to act in specific situations. Some people are responsible for implementing processes and evidence. Auditors need to assess conformity and effectiveness. Decision-makers need to understand risks, responsibilities and priorities.
And Human Resources areas need to align training with the organisation’s real needs.
The question is no longer simply: “what training are we going to buy?”
It becomes: “what capability do we need to develop, in which profiles, with what priority and for what organisational outcome?”
This difference changes the way training is planned.
Ultimately, the maturity of best practices is seen in consistency
Implementing best practices is not about creating more bureaucracy.
It is about creating more clarity, more coherence and greater response capability.
Maturity is seen when teams know what to do. When those responsible make decisions with clear criteria. When evidence exists because the practice took place. When processes withstand the pressure of day-to-day operations. When the organisation learns, adjusts and improves.
Ultimately, some things can only be formed over time.
But, in organisations, time only builds maturity when it is accompanied by method, responsibility, practice and evidence.
It is this combination that transforms best practices into real capability.
Developing maturity requires the right pathway to implement best practices
At Behaviour, the best practice training areas have been structured to support professionals, teams, decision-makers and organisations in transforming requirements into real capability.
Explore Behaviour’s training areas and find the pathway best suited to your context.
You can explore Behaviour’s training areas or visit the Planning for Companies and HR page to identify priorities, profiles and next steps.
Author: Behaviour
Published on: 7 May 2026
Copying or reproduction of this article is not authorised.
This reflection also connects with a broader reading of The Devil Wears Prada 2 and professional maturity, where we explore how pressure, behind-the-scenes work and responsibility help us understand why knowing best practices is not always enough.