Should control be centred around the operational process or operational process be designed in accordance with the best controls ?

In my opinion, Controls should be designed around the existing operational process along with recommendations for process changes rather than revamping the entire operational process in order to be inline with best operational controls.