The Complete Guide to Content Governance

Content governance is the set of owners, written rules and recurring checks that keep published content accurate, consistent, compliant and current as the site grows. This guide shows how to set one up: who owns what, how to write rules that can actually be checked, how often to review each kind of page, how to catch problems on live pages, and how to tell whether it is working. It includes a RACI template, a rule template, a review-cadence table and a 90-day starting plan.

It is written for teams running hundreds or thousands of URLs across products, markets or regulated topics. On a 50-page site, a content lead and a checklist will do; skim the rule template and the cadence table and stop there.

Governance is not strategy, and not a style guide

Strategy decides what to publish and why: audiences, topics, formats, goals. Governance decides how it stays right once it is live: who owns each page, which standards apply, how problems get caught and fixed, and what happens to content that has outlived its use. The handover point is publication. Strategy gets content onto the site; governance keeps it trustworthy there.

Strategy without governance gives you a site that launches well and decays quietly. Governance without strategy gives you a tidy library of content nobody needs. And a style guide on its own is neither: it describes standards but does not check them.

Governance is not there to slow teams down. It makes the cost of being wrong visible before it arrives as a legal letter, a screenshot on social media or a quarter of lost search traffic.

Why governance fails: five patterns

Most organisations already have pieces of governance: a brand book, a legal sign-off, an SEO checklist. They fail because the pieces do not connect.

• The unenforced brand book. Long documentation with nobody checking live pages against it. The fix is not fewer standards; it is standards written so they can be tested, with a check attached.
• Launch-only review.Pages are reviewed once, at publish, and never again. Most of a page's life happens after launch, when the product, the price or the regulation changes around it.
• Governance by one person.A senior editor who "just knows" the site catches problems until they change roles or the site doubles. Knowledge in one head is not a system.
• The CMS workflow as governance. Approval steps catch problems at creation but say nothing about live pages, and miss content outside the main CMS: help centres, microsites, PDFs, localised sites.
• Fire-drill cleanups. Someone spots a wrong price, a flurry of fixes follows, then nothing until the next one. Busy, well meant, and unable to stop the problem coming back.

The four things governance protects

Organise standards around four areas. They fail together: a page with stale data (freshness) becomes wrong (accuracy), which can create legal exposure (compliance) and make the brand look careless (consistency).

Accuracy

Accuracy problems cluster in a few places: statistics the original source has since updated, product capabilities that changed in a release, pricing and packaging, and third-party claims such as "used by 10,000 companies" that nobody re-checked. Each has a different shelf life and a different owner, so record both. Google's own quality questions ask whether content has "easily-verified factual errors"; those are exactly the ones a governance check should catch first. An outdated content finder points reviewers at the sentences with dates and figures, rather than asking them to reread every paragraph.

Consistency

Consistency has three layers. Lexical: the same word for the same thing (not "workspace" on one page and "project" on another). Tonal: the brand sounds like one organisation in a blog post and an error message. Structural: pages of the same type follow the same pattern. Contradictions between pages also confuse readers and can leave several pages competing for the same search. See cross-page consistency, and for voice specifically, our guide to brand voice at scale. Across languages, multi-language consistency checks catch translations that drift from the source.

Compliance

Compliance covers regulatory disclosures, privacy notices, accessibility (the W3C's Web Content Accessibility Guidelines, currently WCAG 2.2, are the usual reference), partner approvals and advertising rules. The content team translates each requirement into an operational rule; legal confirms the translation is right; content operations makes sure the rule is applied and checked. Keep a record that checks ran and that exceptions were approved. That record is what you show an auditor.

Freshness

Pages age at different speeds. A trends post can be stale in months; a comparison page ages every time a competitor ships; a well-written help article can stay right for years. Set review cadences by page type and risk rather than one blanket schedule (the cadence table below gives starting points).

Dates are part of freshness governance, and Google is specific about them. Its date guidance asks for a visible, labelled date ("Published", "Last updated") that describes the page, not the events in it. Its helpful content guidance lists changing dates to look fresh, when the content has not substantially changed, as a search-engine-first practice. Write that into your rules: the visible date moves only when the content does. For how pages lose ground over time, see what content decay is.

Roles: a RACI template

Governance needs three layers of ownership: who sets standards, who checks them, and who fixes the content. Without a name at each layer, governance meetings become the same conversation every month. A RACI (Responsible, Accountable, Consulted, Informed) keeps it clear. Adapt the titles; keep exactly one A per row.

Leadership is Informed on all of it, through the reporting described below. If you have nothing today, a small cross-functional editorial board is a sensible first step: Content Marketing Institute recommends one, chaired by the content strategy lead, that sets priorities and reviews performance across departments.

Central, federated or hybrid

With fewer than about ten regular contributors (a rule of thumb), one content lead who owns standards and a rotating reviewer is usually enough. Beyond that, teams choose between a central team that sets standards, runs checks and triages (consistent, but a bottleneck if under-staffed) and a federated model where each business unit has a governance owner applying shared standards (scales better, but drifts without regular calibration). Most land on a hybrid: standards and reporting central, fixes federated, and one named person accountable for the health of the whole system.

Write rules that can be tested

Whether a rule can be tested decides whether it can be governed. "Sound confident but humble" is a value. "No superlatives (best, fastest, only) without a cited source" is a rule: two reviewers, or a script, will reach the same answer. Write every rule with the same six fields:

Severity levels

Not every rule matters equally. Give each one a severity so the queue sorts itself:

• Blocker: legal exposure, safety risk or material brand damage. Unverified health claims, missing required disclaimers, wrong prices. Fix immediately.
• High: erodes trust or user experience. Outdated statistics, product descriptions that contradict each other, broken calls to action. Goes into a prioritised queue.
• Improvement: best practice with no immediate risk. Heading structure, capitalisation, wordy sentences. Fixed during the next scheduled refresh.

Severity also tells you what to automate first: blocker rules should alert someone the same day; improvement rules can roll up into a monthly report.

More examples of testable rules

• Voice:"We" on marketing pages, "you" in documentation, no "I" outside attributed quotes.
• Pricing: any page showing a price links to the terms within the pricing section.
• Dates:pages tagged as data-driven show a "last checked" date; older than 12 months sends the page to the review queue.
• Authorship: advice pages carry a named author; health and finance advice also carries a named, qualified reviewer. Our E-E-A-T guide explains why.
• Structure: product pages include features, pricing and an FAQ section, in that order.

Start with ten to twenty rules. A brand voice audit and a compliance and accuracy scan of your most important pages will show you which rules are broken most often, which is where to begin.

The lifecycle: from brief to retirement

Creation: build rules into templates

If the product page template has a required disclaimer field, that is governance by design. If the disclaimer depends on someone remembering, that is governance by hope. Put applicable rules in the brief and the template, and route review by risk: a trends post needs an editor; a page making regulatory claims needs legal; most pages can be self-certified by trained writers against the published rules. Our guide on writing content briefs covers the brief side.

After publishing: monitor live pages

This is the biggest gap in most programmes. Live pages change without review (a template update removes a disclaimer, an API-fed block shows an old price) and go wrong without anyone touching them because the world moves. Post-publish checks ask four questions on a schedule: are the figures still right, are required elements still there, has a name changed on some pages but not others, and is the page past its review-by date?

Maintenance: define the triggers

Maintenance differs from creation because something outside the page sets it off: a release, an expiring figure, a regulation, a competitor move. Write down which triggers require action within days and which wait for the scheduled review, and who owns each. Content lifecycle management ties each page to its cadence, owner and last review. The content refresh playbook covers what to change once a page is due.

Retirement: decide what leaves

Without a retirement process, a site only ever grows, and governance work grows with it. Set rules for when pages are merged, redirected or removed, and who approves it. A content pruning analysis combines traffic, quality and overlap so the decision can be defended; our guide on when to merge, prune or leave pages walks through it.

Review cadence by page tier

At scale, the shift is from "read everything" to "check everything automatically, read what matters". Start from a content inventory that says what exists, where, who owns it and how much it matters, then assign each page a tier. These cadences are starting points to adjust, not a standard.

A rough guide to when this matters: once a site passes a few hundred URLs plus regional copies, people alone cannot cover it, and backlogs start to grow faster than they shrink. Scale also hides surface: sections nobody owns, partner pages, PDFs in key journeys, regional copies drifting from the source. For running the inventory and audit itself, see how to audit website content at scale.

Where AI and automation fit

Automation handles breadth; people handle judgement. AI is a good fit for first-pass checks at volume:

• Finding dates, statistics and time-bound claims across thousands of pages
• Spotting pages that describe the same feature differently
• Flagging missing required elements in the page copy
• Classifying pages by type, topic and risk to build the inventory
• Scoring pages against voice and readability rules
• Surfacing patterns, such as forty pages still using a retired product name

It is a poor fit as the final approver of regulatory text, or anywhere context changes meaning. A model can flag "guaranteed returns"; it cannot decide whether your regulator allows it in that sentence. Guardrails that keep it honest:

• Check pages against your own policies and source documents, not the model's general knowledge
• Send high-risk page types to a person regardless of what the check says
• Keep a record of what was flagged, who reviewed it and what was done
• Sample flagged and unflagged pages each quarter to see what the checks miss

What Morrison does here, and what it does not

Morrison covers the detection side. Its site index crawls and classifies every page by page type and search intent, picks up new pages daily, and recrawls the whole site weekly, bi-weekly or monthly (monthly on Starter). The content analyzer scores every page on eight dimensions, including accuracy and trust, from Weak to Excellent. Your standards can live in context and memory, so checks in chat and automations use your rules, and a workflowruns the same check on up to 500 pages in a section, with your rules attached to its AI step as a knowledge base. Skills such as the Brand Voice & Readability Auditor and the Outdated & Thin Content Finder package common checks, and automations email the results on a schedule.

It does not replace the rest of the system. Morrison reads each page's main content, not navigation, footers or page speed, so a disclaimer or policy link that lives in a footer template needs a separate check. It does not hold your RACI, approve exceptions or publish fixes: owners, sign-off and the CMS stay with your team.

Regulated industries

The stakes change in regulated sectors: an inaccurate statement about drug interactions or investment returns can harm someone and bring regulatory action. Google's rater guidelines treat these "Your Money or Your Life" topics with the most scrutiny, and Google says its systems give more weight to signs of experience, expertise and trust on them. This section describes common governance patterns; it is not legal advice.

• Healthcare: review by qualified clinicians, cited clinical sources, marketing claims kept separate from clinical information, and patient-privacy rules applied to any patient story. See healthcare content review.
• Financial services: required risk disclosures, no guaranteed-return language, regulatory identifiers where required, limits on testimonials, and a re-check whenever rules change. In the US, broker-dealer communications fall under FINRA Rule 2210. See financial content audit.
• Legal and professional services: advertising rules for the profession, jurisdiction-specific disclaimers, and partner review of case studies and testimonials.

The principles are the same in every sector: write each rule down, tie it to the regulation it comes from, name who can approve content that triggers it, keep evidence of review, and watch for drift after publishing. An E-E-A-T assessment is a useful extra lens: would a careful reader, or a regulator, trust this page?

Measuring governance health

Measure outcomes, not activity. "Pages reviewed" tells you the process ran; these tell you whether content got safer and better:

• Coverage: share of pages checked within their cadence, by tier. 95% on tier 1 and 30% on tier 3 can be perfectly acceptable.
• Defect density: issues per hundred pages by severity, over time. Rising on new pages points to creation; rising on old pages points to a monitoring gap.
• Time to fix: median days from detection to fix, by severity. Blockers should be measured in hours or days.
• Freshness compliance: share of pages within their review-by date.
• Exceptions: number of approved waivers and their owners. A spike usually means a rule is unclear or unrealistic.

Report trends, where the risk is concentrated, and what was caught before it reached a customer. That last item is how governance shows its value. See stakeholder reporting and content migration planning for connecting fixes to search results, and measuring content beyond traffic for the wider metrics picture.

A 90-day starting plan

Weeks 1 to 4: foundation

1. Pick a bounded scope: your top revenue journeys, your regulated claims, or one product line. Not the whole site.
2. Inventory it: list the URLs, assign an owner per section or template, and give each page a tier. A spreadsheet is fine.
3. Write ten to twenty rules with the six-field template: rule, scope, test, severity, owner, fix.
4. Fill in the RACI. If one person wears several hats, write that down too.

Weeks 5 to 12: run it

1. Baseline: apply the rules to the scope and record defect density and coverage. This is what you will compare against.
2. Set the cadence from the tier table and start the queue.
3. Add checks between reviews for blocker rules: a missing disclaimer or an expired figure should not wait for the quarterly read.
4. Report monthly: found, fixed, coverage, top risks.

After 90 days: widen and tighten

Add sections or markets one at a time using the same steps. Review the rules each quarter: drop rules that never trigger, tighten rules where problems cluster, add rules for new failure patterns. Put governance fixes in the same planning system as other work, so they compete for time rather than sit in a separate list. And add governance checks to any migration plan; see the content migration playbook. Migrations are where disclaimers, metadata and owners most often go missing.

Mistakes to avoid

Governing new content but not the library

If you publish 20 pages a month on a 2,000-page site, new pages are about 1% of what is live in any month. Give the existing library at least as much governance time as new content.

Rules nobody can find

Keep one versioned standards document, link it from every brief template and review checklist, and announce changes.

Treating every page the same

The same review depth for a legal page and a low-traffic blog post wastes the time you have. Tier the pages and match the effort.

Ignoring content you did not write

Partner pages, syndicated content and embedded widgets carry your brand. Put them in the inventory even where the control is a contract rather than an edit. A Landing page audit often finds offers on partner and landing pages that have quietly expired.

Running governance and SEO separately

Both care about accuracy, freshness, structure and trust. Share one inventory and one set of checks, and align rules with what Google documents: accurate bylines, honest dates, sourced claims and no near-duplicate pages.

Governance is infrastructure

Governance is never finished, because products, markets and regulations keep moving. Treat it like security or financial controls: something that runs continuously, not a project that ends after a relaunch. Start with a bounded scope and a short list of testable rules, prove it on the pages that matter most, make the results visible, and widen from there.