Who need security procedure?

Many friend of mine keep asking me the same question when i'm performing Information System Audit in their area.
"Are you really need that document?"
"Gosh, for what? everybody understand the procedure here"

JP Callahan, a former counter-intelligence agent with the U.S. Department of Defense in techtarget.com once ever write some article that said
"...In this age of compliance and assurance, whether it's HIPAA or Sarbanes-Oxley (SoX) or National Institute of Standards and Technology (NIST), every audit of the IT system has some physical security component, so it's absolutely vital that the physical security program be crafted around the logical security controls...."
Security procedures are key to data center security, expert says

Even when your data center already implemented the latest technology in access control using biometric maybe. Your data center still need detailed security procedure to strengthen the security level.

So what is the ideal data center security procedure?
The best solution to deploy detailed data center security procedure is to see the entire data center process as an integrated process such as below:

framework: www.ptsdcs.com