There is a big difference between mediocre companies and well structured companies working in same set of business. Let us see a set of software development companies. This set contains two types of companies having different project management methodologies. All other types of companies with different ratios of two extremes lie in between these two types of companies.
First type of companies are those which have no methodologies in place. All that works is person dependant as there is no system (or per se well defined system in place). Other type is those having well documented, adhered and audited systems in place to manage all projects they work on.
First type are very dangerous though they exist, survive and sustain. But everything is ad-hoc – the business, the projects, the existence, the survival and their sustenance. Such type have no written or documented procedures, methodologies or systems in place. Since last project they succeeded in had no reported leaks, the next project will follow the same route or process.
Risk level is high in such type of companies. Best thing is, since there is no risk assessment, or audit (internal or external), there is no realization of leaks, holes or lack of process in place.
Such companies may declare project initiation without even formation of proper team, defining of requirements, roadmap, milestones or a project plan in place. Things are done as they come, or as they fail. Actions are taken not on the basis of proactive approach but based on stakeholder’s reports, complaints, system failures, shouts etc.