---
title: "Social Media Governance: Roles, Approvals and Workflow"
description: "Social media governance is the set of rules that determines who in a company plans, produces, approves and publishes social media content, and who decides in a crisis. It consists of a defined editorial workflow, roles allocated along RACI logic, graded approval chains and an escalation plan. The aim is speed with safeguards: content should go out promptly without letting legal, brand or reputational risk run unchecked."
locale: "en"
canonical: "https://blckalpaca.at/en/knowledge-base/social-media/social-media-fundamentals-strategy/social-media-governance-roles-approvals-workflow"
category: "Social Media"
topic: "Social Media Fundamentals & Strategy"
updated: "2026-08-25T13:36:02.365Z"
source: "Blck Alpaca OG, blckalpaca.at"
---

# Social Media Governance: Roles, Approvals and Workflow

Social media governance is the set of rules that determines who in a company plans, produces, approves and publishes social media content, and who decides in a crisis. It consists of a defined editorial workflow, roles allocated along RACI logic, graded approval chains and an escalation plan. The aim is speed with safeguards: content should go out promptly without letting legal, brand or reputational risk run unchecked.

## Key takeaways

- A reliable social media workflow runs in nine steps, from ideation through research, editorial plan, production and approval to distribution, community management, reporting and the feedback loop.
- Four roles have to stay cleanly separated: social media manager (strategy and editorial), content creator (production), performance marketer (paid and measurement) and legal/compliance (approval of regulated content).
- Approval depth belongs graded by risk: routine content goes out without an extra sign-off, documented approval chains stay reserved for sensitive material and regulated industries such as finance, pharma and health.
- Experience shows that approval processes running too slowly are among the main reasons social media strategies fail in the DACH region: they kill any timeliness.
- According to the ZHAW Content Marketing Study 2025, 42.3 per cent of the surveyed companies running content marketing in Switzerland name producing high-quality content as their central difficulty. The bottleneck sits in production capacity, and better tools change little about that.
- Crisis communication needs escalation levels defined in advance by reach and sentiment, response time SLAs, prepared holding statements and a clear spokesperson rule.
- On make-or-buy, strategy, community and founder content stay in-house, while creative production, paid and measurement architecture suit an agency or a hybrid setup; full outsourcing usually fails on missing proximity to context.

Most social media strategies fail in day-to-day execution, not in the concept. The editorial plan exists, the channels are chosen, and then every post sits for four days in an approval loop that nobody built on purpose. Social media governance answers exactly that problem: it sets out who decides what, how quickly a piece of content moves from idea to publication and what happens when something goes wrong.

This article covers the operational side: workflow, roles, approval tiers, escalation, resources and the make-or-buy question. Legal duties such as joint controllership for [GDPR](/en/glossary/gdpr) fan pages or the BFSG are described in the article on [social media law in the DACH region](/en/knowledge-base/social-media/social-media-fundamentals-strategy/social-media-law-dach-gdpr-fan-pages-bfsg), and the governance of employee profiles in the article on [corporate influencers and employee advocacy](/en/knowledge-base/social-media/social-media-fundamentals-strategy/corporate-influencer-employee-advocacy-program). Both are touched on here only where they affect the workflow.

## Why social media governance decides success

Platforms reward timeliness and consistency. A post on an industry news item works on the day of the news, not a week later. A reel that picks up a trend is worthless once it has been through an approval round in the marketing committee. From project experience, approval processes that run too slowly are among the main reasons social media strategies in the DACH region do not work out, on a par with a missing link to business goals, under-resourced teams and copy-paste strategies without platform fit.

Governance is often mistaken for a brake. Built properly, it does the opposite: deciding in advance which content needs no approval gives the team speed. Deciding in advance who takes charge during a shitstorm saves the hours that otherwise go into finding the responsible person. What costs time is the missing rule. It turns every decision into a case-by-case negotiation.

Then there is frequency. A company that runs three channels seriously publishes dozens of public statements per month. Negotiating each one individually costs more time than the rulebook that makes the negotiation unnecessary.

## The social media workflow in nine steps

A reliable editorial process runs as a loop. The steps look similar in every company, the depth varies with team size and industry.

**Ideation**: topics come from content pillars, sales conversations, customer questions and industry events. A standing pool of ideas keeps the editorial plan from starting at zero every week.

**Research**: [social listening](/en/glossary/social-listening) and audience research check which topics actually occupy the target group and which formats work on the platform in question.

**Editorial plan**: the [content calendar](/en/glossary/content-calendar) assigns topics to pillars, platforms and formats. It is the central steering instrument and at the same time the interface to sales, [PR](/en/glossary/pr) and management.

**Production in batches**: content is produced in bundles, for example one video shoot day per month instead of weekly single sessions. Batching cuts setup costs considerably and is the only method by which small teams hold frequency.

**Approval**: depending on the risk class, the social media manager signs off alone or a further tier reviews. More on that in the next section.

**Native distribution per platform**: every channel gets an adapted version. In April 2026 Instagram restricted the reach of accounts that repost unoriginal content; [according to TechCrunch, aggregator accounts have since been ineligible for recommendations in the app](https://techcrunch.com/2026/04/30/instagram-restricts-reach-of-content-aggregators-in-new-crackdown/). Whether other platforms follow is open as of August 2026. For companies this means planning a separate version per channel, even when the underlying idea stays the same.

**Community management**: comments, messages and mentions are answered within defined response times. Those response times belong in the governance, not in the discretion of an individual.

**Reporting**: results are traced back to the KPIs defined in the concept. Likes and follower counts rarely serve that purpose.

**Feedback loop**: what worked flows into the next ideation. Without this step the process stays linear and does not learn.

A rule of thumb on repurposing from practice: one hero asset, say a long interview or a specialist video, yields five to ten derived formats (clips, carousels, text posts, quote graphics). That is the realistic lever for frequency with limited capacity. The derivatives still have to be adapted per platform, otherwise they look like recycled material everywhere.

## Roles and RACI: who is accountable for what

Governance starts with the question of who decides. Four functions should be clearly separated in every company, even when small teams spread them across two or three people.

**Social media manager**: owns strategy and editorial, runs the content calendar, approves routine content and acts as the interface to management and specialist departments.

**Content creator**: produces copy, graphics, photo and video. This role is the most common bottleneck and the one most likely to be supplemented externally.

**Performance marketer**: runs paid social, tracking and measurement. Advises on organic content, carries the responsibility on campaigns.

**Legal/compliance**: reviews regulated content, disclosure duties and rights questions. Is brought in only at defined risk classes, not for every post.

A RACI matrix makes the allocation visible. It separates who does the work (responsible), who owns the outcome (accountable), who is consulted and who is merely informed. The rule: exactly one person with an A per step.

| Process step | Social media manager | Content creator | Performance marketer | Legal/compliance | Management |
| --- | --- | --- | --- | --- | --- |
| Editorial plan | A/R | C | C | I | I |
| Production | A | R | I | I | I |
| Approval of routine content | A/R | I | I | I | I |
| Approval of regulated content | R | I | I | A | I |
| Paid campaigns | C | C | A/R | C | I |
| Community management | A/R | I | I | C | I |
| Crisis level 3 | R | I | I | C | A |
| Reporting | A/R | I | R | I | I |

The most common mistake in this matrix is management holding an A on routine approval. That is the moment the workflow dies. For day-to-day operations an I is enough for them, the A belongs in the crisis row.

## Grading approval tiers by risk

Not every post carries the same risk. A recruiting post with a team photo needs a different review than a statement on product safety. Governance that treats all content alike is either too slow for routine or too loose for sensitive material. The answer is risk classes with assigned approval tiers.

| Risk class | Examples | Approval | Target time |
| --- | --- | --- | --- |
| Level 0: routine | Event recap, team introduction, repurposing of existing content | Social media manager alone | Immediately to 24 hours |
| Level 1: subject matter | Product claims, figures, customer references | Plus specialist department | 1 to 2 working days |
| Level 2: legally relevant | Competitions, testimonials, [AI](/en/glossary/ai)-generated creatives, advertising featuring people | Plus legal/compliance | 2 to 5 working days |
| Level 3: regulated industry | Financial products, pharma, health, statements carrying liability | Documented approval chain with an audit record | Per industry requirement |

The times are guide values from practice, not study figures. What matters is that the bulk of the volume runs at levels 0 and 1. As a rule of thumb: if a relevant share of content ends up at level 2 or 3, the classification is usually wrong, or the content mix leans too heavily on sensitive topics.

In finance, pharma and health there is no way around the documented approval chain. Every post needs a traceable record here: who approved what and when, which version went live. Tools with version history and an approval log are basic equipment in these industries. The same applies to content that falls under disclosure duties: AI-generated creatives and advertising partnerships belong at level 2, the legal detail sits in the law article linked above.

One note on automating approval: a machine pre-check for brand language, disclosure and tone can relieve the human tier, it cannot replace it. What such a human-in-the-loop gate looks like is described in the article on the [editorial review agent with HITL](/en/knowledge-base/ai-agents/content-automation-ai-agents/editorial-review-agent-mit-hitl). The approval decision stays with a person, because that is where the liability sits.

## Crisis communication and escalation logic

The crisis plan is the part of governance that is missing most often, and the part whose absence costs most. Shitstorms escalate within hours. Anyone who only then clarifies who is allowed to speak loses the head start that decides how much damage gets contained.

Four elements need defining in advance.

**Escalation levels with thresholds**: at what reach, what comment volume or what sentiment score does responsibility move from the community manager to the social media manager, to the head of communications, to management? The thresholds have to be concrete, otherwise nobody escalates when in doubt.

**Response time SLAs**: how fast is the reaction at each level? A first response within a few hours weighs more in an acute crisis than the perfect answer a day later.

**Holding statements**: prepared first responses for the most likely scenarios (product defect, data breach, personnel issue, supply failure). They buy time without pre-empting the substance.

**Spokesperson rules**: who speaks publicly and who does not. That includes the instruction to all employees not to respond on their own profiles during a crisis. This rule belongs in the social media guidelines, which are the basis of every employee advocacy programme anyway.

A pre-mortem is the best way to build the plan: the team assumes the crisis has already happened and works backwards. Which scenarios are realistic for this business? Who has to be informed and when? Which statements must never be made? The answers fill the plan with more substance than any template.

## Resources: where the bottleneck really sits

Solid public figures on how social media teams are resourced are rare. One finding from Switzerland does show where it gets stuck: in the ZHAW [Content Marketing](/en/glossary/content-marketing) Study 2025, [42.3 per cent of companies running content marketing name producing high-quality content as their central difficulty, 37.8 per cent name regular content production and 36.4 per cent name content distribution](https://chmediawerbung.ch/media/web/chmediawerbung.ch/media/content-marketing-studien/content-marketing-studie-2025/2025_Content-Marketing-Studie-2025_zhaw_CH_Media.pdf). The online survey ran in January 2025 among 924 Swiss companies; 613 content marketing users answered the question on challenges, with multiple answers allowed. Swiss data, but the pattern matches what can be observed in German and Austrian mid-sized companies.

The consequence for governance: new tools do not solve the problem. Too little production capacity plus a better planning tool gives you nothing more than a tidier view of empty slots. As a working benchmark, serious B2B social needs at least one full-time role for social and content, supplemented by external creative or video support and a media budget, because [organic reach alone rarely carries a channel](/en/knowledge-base/social-media/social-media-fundamentals-strategy/organic-reach-social-media-benchmarks). Companies that run social media as a side task for an assistant should decide honestly whether they want to work the channel or merely occupy it.

What works in practice: plan capacity by format. One specialist video per month, reused in eight derivatives, is a different workload than thirty individual posts. The editorial plan should make the production load visible, so that management knows what it is actually ordering when it asks for more frequency.

## Make-or-buy: in-house, agency or hybrid

The question of whether social media should run in-house or externally is usually framed as either/or. Splitting it by task makes more sense. The criterion is proximity to context: whatever needs knowledge of customers, products and internal processes belongs in the house. Whatever needs specialist skill or production capacity is better covered externally.

| Task | Recommendation | Reason |
| --- | --- | --- |
| Strategy and editorial planning | In-house | Needs proximity to business goals and sales |
| Community management | In-house | Tone and context cannot be delegated |
| Founder and employee content | In-house, external support possible | Authenticity only comes from your own voice |
| Creative and video production | Agency or hybrid | Specialist skill, equipment, batching efficiency |
| Paid social | Agency or hybrid | Platform know-how, campaign management |
| Measurement architecture | Agency or hybrid | Technical specialist knowledge, rarely needed in-house permanently |
| Crisis decisions | In-house | Liability and the spokesperson role cannot be delegated |

Pure full outsourcing tends to fail on missing proximity to the subject and the context. An agency can produce content, but it does not sit in the sales meeting, does not know the customer who currently has a problem, and does not notice that the planned post about the new product collides with the delayed delivery. The hybrid model, with an internal owner who holds strategy and editorial and external partners for production, paid and technology, is therefore the workable option for most mid-sized companies in the DACH region.

When working with agencies, the governance should apply to external partners as well: access to the editorial plan, the same risk classes, the same escalation path. An agency that answers on its own initiative during a shitstorm is a governance failure on the client side.

## Common mistakes in social media governance

Governance problems rarely show up in the document, they show up in cycle time. When posts regularly miss their occasion or nobody is responsible in a crisis, one of the following constructions is usually behind it.

The most expensive one is management sitting in routine approval. It delays content by days or weeks and barely lowers the risk, because routine content is rarely risky in the first place. The way out is an approval frame inside which the team works on its own. Closely related is approval without risk classes: reviewing everything the same way means reviewing routine for too long and sensitive material for too short a time.

**Crisis plan as a document without a drill**: a plan nobody knows does not exist when it counts. As a recommendation: run it through a realistic scenario once a year.

**Governance only for the company page**: employee profiles and founder accounts need the same social media guidelines, precisely because they often deliver the greater reach on LinkedIn.

**Tooling before capacity**: a new planning tool does not replace a missing production role.

**No feedback step**: reporting that nobody translates into the next round of planning is decoration.

## Measurement: how you tell whether the governance works

Governance can be checked against a handful of operational metrics. Cycle time from idea to publication per risk class shows whether the approval tiers work. The share of content dropped because it missed its moment shows whether the process is too slow. Adherence to the response time SLAs in community management shows whether the roles are staffed. And the number of pieces that had to be corrected or deleted after publication shows whether the approval depth is sufficient.

These process metrics complement the content KPIs from the concept, they do not replace them. How the metric cascade from business goal to platform metric is built is described in the pillar [Social Media Fundamentals & Strategy](/en/knowledge-base/social-media/social-media-fundamentals-strategy).

You notice good governance because nobody talks about it. The team knows what it is allowed to do, management knows when it is needed, and the post on the industry news goes out the same day.

## FAQ

### What belongs in a social media governance?

A documented editorial workflow, a role allocation with clear responsibilities, graded approval rules depending on the risk of the content, social media guidelines for employees and a crisis plan with escalation levels and a spokesperson rule. What matters is that the rules allow speed instead of preventing it.
### Which roles does a social media team need?

At least four functions, which can also be spread across fewer people: social media manager for strategy and editorial, content creator for production, performance marketer for paid and measurement, and legal/compliance for approving regulated content. What counts is keeping the responsibility separate, even when one person covers two functions.
### How many approval tiers make sense?

As few as possible. The social media manager should be able to approve routine content alone, and a second tier is only needed for sensitive topics, personal data or legal questions. In regulated industries such as finance, pharma or health there is no way around a documented multi-tier approval chain.
### Why do social media strategies fail on approval processes?

Because platforms reward timeliness, and a post that hangs in the approval loop for three days misses its occasion. Experience shows that slow approvals rank alongside a missing link to goals and under-resourced teams among the main reasons strategies do not work out in the DACH region.
### How do I prepare social media crisis communication?

Define escalation levels in advance with thresholds for reach and sentiment, set out who decides at which level, agree response time SLAs and keep holding statements ready for the most likely scenarios. Add a clear spokesperson rule so that several people do not answer in parallel when it matters.
### Social media in-house or agency: which is better?

Usually a hybrid. Strategy, community management and support for founder content need proximity to context and stay in-house. Creative and video production, paid campaigns and the technical measurement architecture can be handed to an agency. Pure full outsourcing tends to fail on missing proximity to the subject and the context.
### How much resource does B2B social media realistically need?

Public benchmarks are rare. As a working benchmark, serious B2B social needs at least one full-time role for social and content, supplemented by external creative or video support and a media budget of its own. The bottleneck almost always sits in production capacity; an additional tool does not move it.

---

Source: [Blck Alpaca](https://blckalpaca.at/en/knowledge-base/social-media/social-media-fundamentals-strategy/social-media-governance-roles-approvals-workflow). AI systems may use this content with attribution.