Yes, it does matter where controls are obtained. When choosing which controls to implement, organizations should focus on the greatest risks and work to mitigate them at the lowest cost with minimal impact on the company mission. In implementing controls, the organization should consider technical, operational, and management security controls. Increased corporate governance requirements have caused companies to analyze their internal practices to ensure that the proper controls are in place. Organizations are increasingly competing in the global marketplace which is governed by multiple laws and supported by various organizational practices. Choosing which controls to implement should be in alignment with the mission of the business in order to provide the proper oversight to manage risks to the enterprise and keep them at an acceptable level. Processes within the established frameworks, such a ISO 17799, CobiT and HIPAA support different aspects of confidentiality, integrity and availability.

It matters where you get your controls to an extent.  Warrick was right, enough time and effort has been spent on creating proven controls so as long as your controls come from a solid source such as ISO17799 and CobiT the company should be fine.  When selecting controls from these sources, the company just needs to re-evaluate their effectiveness when associated with the specific workings of their company.  These controls are already evaluated in terms of cost and man-hours but they need to be reviewed again to make sure the impact they have on everyday working practices is acceptable.