Content governance, and who is allowed to change what

Governance as a set of decisions

Content governance is the set of decisions about who may change what, what has to stay the same everywhere it appears, and who settles it when 2 people disagree. That is the whole subject.

Most writing on this describes a framework: models, pillars, workflows, a digital leadership group. Those exist because large organisations have many people publishing into the same brand and need a structure to hold it together. My position is that for a business with fewer than about 20 people the framework is the failure mode. You end up producing the governance document instead of making the decisions, and the document is not the thing that keeps your pricing consistent.

The version that works at small scale fits on one page and names 4 things per item: what it is, where it appears, who may change it, and what has to happen when it changes.

Governance, strategy and lifecycle answer different questions

These 3 get run together constantly, and the corpus of articles on this topic asks the difference explicitly.

Content strategy asks what you say and why. Who the content is for, what it needs to do, what you are choosing not to cover.

Content governance asks who decides. Who owns each thing, who may change it, who approves a claim, and what happens when the website and the sales deck disagree.

The content lifecycle asks what you already have and what to do with it. Auditing, updating, retiring, and what the URL returns afterwards. I cover that separately in the content lifecycle nobody plans for, and this article does not repeat it.

The reason to keep them apart is that they fail differently. A strategy failure produces content nobody needed. A governance failure produces 3 versions of the same fact. A lifecycle failure produces a site full of things that were true in 2023.

The failure is 3 versions of one fact

Here is what governance is preventing, stated concretely rather than as a principle.

Your price is on the website. A different price is in the PDF you email to enquiries. A third figure is in the proposal template because someone updated it locally 8 months ago. The response time you promise on the contact page is not the response time in your email signature. Your LinkedIn description says you specialise in something you stopped doing 2 years ago.

None of this comes from carelessness. It comes from nobody owning the sentence in more than one place at once. Each version was correct when it was written.

There is a compliance edge to it as well. Under the unfair commercial practices provisions of the Digital Markets, Competition and Consumers Act 2024, in force for practices from 6 April 2025, a misleading action includes giving false or deceptive information about the price or the main characteristics of what you are selling. An out-of-date claim you forgot about is still a claim you are making. I set out the wider position on those rules in the role of emotions in purchase decisions and the psychology of value perception.

Data protection sits alongside it. The ICO's fining guidance sets the higher maximum under UK GDPR and the Data Protection Act 2018 at £17.5 million or 4% of total worldwide turnover, whichever is higher, with a standard maximum of £8.7 million or 2%.

I would not build a governance case on that figure for a small business, and I have removed the version of this article that did. The ceiling is not the risk you face. The realistic risk is a privacy notice that describes a mailing list you no longer run, or a form collecting data nobody decided the purpose of. Both are governance problems rather than legal ones, and both are fixed by knowing who owns the page.

The one-page governance record

This is the artefact and it replaces the framework. List the things that have to be true in more than one place, then fill in the last 2 columns. The third column is the one people skip and it is the one that does the work.

What has to stay consistent	Everywhere it appears	Who may change it	What has to happen when it changes
Price, and what is included	Website, proposal template, email replies, any published rate card	One named person	Every listed location updated the same day, and the proposal template checked
What you do and who for	Website, LinkedIn, directory listings, email signature, invoices	One named person	Directory and profile listings reviewed, because these are the ones that rot
Claims about results	Case studies, testimonials, sales conversations, social posts	One named person, and nobody else may add a new claim	The evidence for the claim recorded next to it, and a date
Response and delivery times	Contact page, autoresponder, signature, proposals	One named person	Checked against what you can currently deliver, not what you could last year
Policy and legal pages	Privacy notice, terms, cookie information	One named person	Checked against what you are doing now, including forms and mailing lists
Terms for your own services	Everywhere	One named person	The old term searched for and replaced, not merely stopped

That is 6 rows, which is usually enough. If a business needs 30, it has a content operations problem rather than a governance one.

The smallest approval rule that works

Approval chains are where governance goes wrong at small scale, because every added approver reduces how much gets published and nobody notices the cost.

The rule I would use is that approval applies to claims and commitments, not to prose. If a piece of content states a price, a result, a timescale, a guarantee or a legal position, one named person checks it before it goes out. Everything else publishes without approval.

The same rule decides what to do about machine-drafted content, which is why a separate AI policy is usually unnecessary. A draft that states a price, a result or a legal position needs the same named checker regardless of what produced it, and the check has to cover whether the sources exist. AI in content strategy, and what you have to decide sets out the decisions that sit alongside this one.

That distinction matters because most approval processes exist to police writing quality, and quality is better handled by a standard than by a person reviewing each item. A short style guide and a terminology list do more than a reviewer, and they do it without adding a queue. The clarity standard I would apply is in plain English as a conversion tactic.

The terminology list is the underrated half. Pick one word for each thing you sell and each stage of your process, write them down, and use only those. Most small business inconsistency is 3 names for the same service, which readers experience as 3 different services. The wider set of writing rules this sits inside is covered in brand messaging versus brand voice.

What I learned from governance that had real teeth

Most of my public sector work operated under governance far heavier than anything a small business would want. Content design for a devolved legislature meant published material was subject to accuracy requirements, review by people with authority to stop it, and a standing assumption that anything wrong would be found and would matter.

There are 2 things that carried over. Ownership is the load-bearing part, and it has to be a person rather than a team, because a team owning something means nobody does. And separating the accuracy check from the writing check is what stops governance strangling output, since these are different skills and merging them creates a reviewer who blocks on both.

I should be clear about the limits of that. I am describing what the working arrangement taught me over more than 20 years in communications and marketing, not a measured comparison between governance models. I have never run the same content operation both ways.

When governance becomes the problem

Governance has a characteristic failure that its own literature rarely mentions. Past a certain point the process costs more than the inconsistency it prevents.

The signs are recognisable. Publishing slows and nobody can say by how much. People route around the process, which is worse than no process because the routing is invisible. The governance document is itself out of date, which is the pure form of the problem.

The test I would apply is whether the process protects a decision that would be expensive to get wrong. Prices, claims and legal positions qualify. A blog post does not. Applying the same gate to both is how organisations end up with careful governance and nothing published.

Name an owner for each row

Open the 6 rows above and fill in the third column for each. Just the name. If you cannot name a person for a row, you have found the thing that is going to be wrong on your site in a year.

Then take the first row, price, and check every place it appears today. In most small businesses that check finds at least one inconsistency, and finding it is the argument for doing the rest.