Guidelines Aren't Governance

Everything below is free and useful before you read a word about who wrote it.

The executive problem

Every organization of a certain size arrives at the same phrase: "send it to Brand." A regional marketing manager finishes a campaign asset and routes it to one person, or one small team, for a look. That person is good, often excellent, at what they do. They have internalized years of positioning decisions, legal sensitivities, and founder preferences that were never fully written down. They are also, structurally, a bottleneck.

As the organization scales content output (more regions, more channels, more campaigns, and now more AI-generated drafts arriving faster than any queue was built to absorb) the bottleneck does not get faster. It gets busier. Deadlines slip past the review, or teams route around it entirely, publishing first and asking forgiveness later because the queue takes three days and the campaign launches tomorrow. The result is two failure modes at once: work that should ship gets stuck behind a queue, and work that should never ship gets through because nobody had time to look at it carefully.

This is not a hypothetical. WFA (World Federation of Advertisers) benchmark research published in July 2024 found that most member organizations:

"have a clear strategy for maintaining consistency, communicated via guidelines and clear governance, which enables local market adaptation," but "fewer felt they have clear governance in place to support" their agency partners.

The guideline exists. The governance to enforce it at the edges (where volume and distance make informal, one-person review hardest to sustain) does not.

The self-reported data on how this plays out operationally is stark. Marq/Lucidpress survey research (200+ organizations, self-reported by marketers rather than independently audited) found that 77% of companies deal with off-brand content, and that while 85% of organizations report having brand guidelines, only 30% say those guidelines are actually enforced. Guidelines are nearly universal. Enforcement is the exception. Frontify's brand governance research cites a further consequence: 28% of senior professionals at mid-sized and large companies, per a figure Frontify reports, say brand dilution costs their business more than $10 million in lost revenue annually.

Now add generative AI to a system already straining. IAB research published in August 2025, a survey of 125 U.S. advertising industry executives conducted with Aymara via the IAB Insights Engine platform, powered by Attest, found:

"Over 70% of marketers have encountered an AI-related incident in their advertising efforts, including hallucinations, bias, or off-brand content."

Of those incidents, 40% required pausing or pulling ads, over a third caused brand damage or PR issues, and nearly 30% triggered internal audits. Only 6% called the impact minimal. This is what happens when a bottleneck built for a slower era of content production meets a content-generation tool with no throttle.

The deeper problem is not that the person doing brand review is bad at their job. It is that the organization has made brand judgment equivalent to the availability of one human being, with no system underneath them to catch what they cannot personally see.

The contrarian thesis

The instinctive response to inconsistency is to write better guidelines, or hire more reviewers. Both are reasonable-sounding and both miss the actual failure. A guideline document, however well written, is a description of intent with no mechanism for finding out whether it was followed. A bigger brand team scales the bottleneck linearly, at cost, while content volume scales faster than headcount ever will, especially now that a meaningful share of that content is machine-generated in seconds.

The alternative is not a better document or a bigger team. It is a control system: a defined set of rules that can actually be enforced rather than merely stated, checks that run automatically before publication and again after, an exception process for the judgment calls that legitimately need a human, with those exceptions expiring rather than accumulating forever, and measurement that tells leadership, in numbers, whether the system is catching problems or just generating paperwork. Guidelines describe the brand. Governance decides who acts, what gets checked, what happens when something goes wrong, and how you know the rules are being followed. Most organizations have the first thing and call it the second.

The operating model

The shift required is structural, not cosmetic. A guidelines document is static: written once, updated occasionally, read (if read at all) when someone starts a project, then forgotten by the time they finish it. A governance system is active: it runs continuously, has defined checkpoints, and produces a record.

Concretely, this means treating brand rules the way an engineering organization treats a deployment pipeline: rules checked automatically, gates content must pass before going live, and a log of what happened, what was checked, what passed, what was flagged, what was overridden and by whom. None of that exists in a PDF sitting in a shared drive. Frontify's own description of a brand governance framework captures the intended function well. It "guides your brand's standards, processes, and resources and keeps everyone informed and engaged," helping people understand how their role contributes to the brand, whom to go to for support, what the feedback process is, and what training and resources exist. That is a meaningfully different object than a style guide: a system with roles, checkpoints, and accountability built in, not just a description of the desired end state.

The practical marker of the shift: if you removed the one senior person from your current brand review process for a month, would anything still get checked? In a guidelines-only organization, the honest answer is no. In a governed one, the automated and role-based checks keep running regardless of who is on vacation.

The framework

Security-controls theory offers a mature, well-tested taxonomy for exactly this problem, because information security faced the same structural challenge decades ago: rules exist, but rules without enforcement mechanisms are aspirations. CISA's CRR Supplemental Resource Guide, Volume 2: Controls Management, defines the purpose of controls management this way:

"To identify, analyze, and manage controls in a critical service's operating environment."

The four-part taxonomy below (preventive, detective, corrective, and compensating controls) is standard control theory built on that foundation, adapted here to brand.

• Preventive controls stop an off-brand action before it happens. In brand terms: a design tool configured so only approved hex values are selectable, meaning a designer cannot choose an off-palette color even by accident. Preventive controls are the cheapest to operate once built, because they remove the possibility of the error rather than catching it afterward.
• Detective controls find problems that already made it through. A scheduled scan of all live marketing pages that flags any page still using a deprecated product name, a retired claim, or an old logo lockup is a detective control. It does not stop the mistake, but ensures nobody has to notice it by accident three months later.
• Corrective controls fix what detection finds. A defined rollback process (the ability to revert a page, an ad, or an email template to its last approved version within a set time window, with a clear owner responsible for executing it) turns "we found a problem" into "the problem is resolved."
• Compensating controls cover the gap where automation cannot yet reach. Not everything reduces to a machine-checkable rule: a metaphor's cultural connotations, a claim's legal risk in a specific market, a tone that is technically on-brand but wrong for the moment. A manual review step, staffed by someone with actual authority to approve or reject, is a compensating control: an acknowledgment that judgment is still required here, deployed deliberately rather than by default everywhere.

The point of the taxonomy is not that every organization needs all four immediately. It is that most organizations today operate entirely in the fourth category, manual review of everything, because they never built the first three.

The steps

1. Run the Brand Rule Inventory. Take every guideline statement your organization currently maintains and classify it as executable (a defined, checkable rule: a color value, a required disclaimer, a banned term, a logo clear-space minimum) or judgment (requires human interpretation of context, tone, or intent). Do this exhaustively. The value is in the count, not a spot check. Organizations that complete this exercise typically discover that 60-70% of what their brand team reviews by hand is actually executable, leaving the real judgment work as the remaining third.
2. Assign a control type to each executable rule. Decide whether it should be preventive (blocked before it can happen), detective (scanned for after the fact), or both. Color values and required legal disclaimers are strong preventive candidates; messaging consistency across live pages is a natural detective candidate, since it changes after launch as strategy evolves.
3. Build or configure the enforcement layer. This is where design-tool constraints, automated content scans, and publishing checks get implemented, not hypothetically, but as running checks with a defined owner for each.
4. Design the exception process, with an expiration. Judgment calls will always exist, and some executable rules will have legitimate one-off exceptions. Build a lightweight approval path, and require every exception to expire on a set date or campaign end, rather than becoming a silent, permanent carve-out nobody remembers granting.
5. Route the remaining third to actual reviewers. With the executable two-thirds handled by controls, the brand team's remaining capacity should go entirely to contextual, judgment-heavy work, a better use of their expertise and a faster process, since the queue is a third of its former size.
6. Instrument the system. Every check (preventive, detective, corrective, compensating) should produce a record: what was checked, when, what happened, who was involved. Without this, you cannot measure whether governance is working, only assert that it is.

Roles

• Brand team as rule-owners. Responsible for defining what the rules are, deciding which are executable versus judgment, and updating rules as strategy evolves. They own the content of governance, not the mechanics of checking every asset against it by hand.
• Brand team as reviewers. A distinct function from rule-ownership, even when held by the same people. This is the group doing the compensating-control work: the judgment calls that survive the inventory process because they genuinely require context and authority.
• Systems and tools as enforcers. Design tools, content management systems, publishing pipelines, and monitoring scans carry the preventive and detective load. They do not make judgment calls; they check defined rules, consistently, at a volume no human queue can match.
• A named owner for corrective action. Detection without a defined corrector produces a growing list of known problems that never get fixed. Someone specific needs rollback authority and the responsibility to use it within a defined window.

Metrics

• Share of brand reviews that are automated versus judgment-based. The inventory ratio should show up operationally as a shrinking share of total review volume requiring a human. A rising share of automated checks relative to manual ones is the clearest sign governance is maturing rather than merely existing.
• Time-to-review. How long content waits between submission and a governance decision. A queue measured in days signals a bottleneck; a queue measured in minutes for executable checks, with judgment cases clearly separated out, signals a working system.
• Off-brand incidents caught pre-publication versus post-publication. The single most direct measure of whether preventive and detective controls are doing their job. A system that catches most issues before launch is functioning as governance; one that mostly finds problems after the fact, via customer complaints or a founder's spot check, is not.
• AI-incident rate and investment gap. IAB's research is worth tracking against directly: over 70% of marketers report an AI-related incident, yet less than 35% plan to increase investment in AI governance or brand integrity oversight over the next 12 months, and nearly 90% say they feel prepared to catch AI issues before launch, a gap IAB itself frames as a possible false sense of security. An organization's own confidence-versus-incident gap is a leading indicator worth watching before it becomes a lagging one.

The checklist

• Pull the current brand guidelines document and list every discrete statement it contains, however small.
• Mark each statement executable or judgment. Resist the urge to mark things judgment by default, test whether a specific, checkable rule could actually replace the vague version.
• Identify which executable rules are already checkable inside tools you use today (design software constraints, CMS validation, publishing checks) versus which require new tooling.
• Pick one preventive control and implement it this month, a locked color palette or a required-field check is a realistic first move.
• Pick one detective control and schedule it, a recurring scan of live pages against a short list of deprecated terms or retired claims.
• Define who has rollback authority and what the corrective process looks like when a detective scan finds something.
• Write down the exception process in one page: who can approve an exception, what information is required, and, critically, when it expires.
• Start logging every governance decision, even manually in a spreadsheet, so a baseline exists before any tooling changes.

The 30/60/90

Days 1-30: Complete the Brand Rule Inventory across all existing guidelines. Classify every statement. Identify the highest-volume, highest-friction review categories, the ones eating the most brand-team time, and confirm which of those are executable. Establish a baseline for time-to-review and off-brand incident rate, even if measured crudely.

Days 31-60: Implement the first preventive controls in the tools your team already uses daily, locked brand assets, template constraints, required-field validation. Stand up the first detective scan against live content. Define the exception process and rollback ownership in writing, and socialize both with the teams who will use them.

Days 61-90: Review the metrics established in month one against current performance. Confirm the review-queue split is shifting toward automated checks and away from manual judgment calls. Expand detective scanning to additional channels. Formally reduce the brand team's default review scope to the judgment-only category, and communicate the change across the organization so teams stop routing executable-rule content to a human queue by habit.

The technology layer

Enforcing this model at any real scale requires software that sits between "content exists somewhere" and "content is live," because manual spreadsheets and shared drives cannot run continuous checks or hold a reliable record of what happened and when. The technology layer needs to discover what is actually live across an organization's connected systems, check it against defined brand rules both before and after publication, and keep a record of what changed, what was flagged, and what was done about it. Which is the same discovery-check-record loop the framework above describes, just running in software rather than in someone's head. Launch is one example of software built for exactly this kind of enforcement.

Frequently asked questions

Q: Isn't a strict system going to slow the team down even more than the current bottleneck? No, preventive and detective controls run continuously and automatically, which is faster than any human queue. The goal is to remove the roughly two-thirds of review volume that is executable from the manual queue entirely, leaving human reviewers with less work, not more.

Q: We don't have the budget for new brand tooling this year. Can we start anyway? Yes. The Brand Rule Inventory itself requires no tooling. It is a classification exercise using your existing guidelines document. Several preventive controls (locked color palettes in design tools, required fields in templates) can be configured in software your team already uses.

Q: How do we handle legitimate exceptions without the process becoming a loophole? Require every exception to carry an expiration date or end condition at the moment it is granted, and log who approved it and why. An exception without an expiration date is not an exception. It is a silent rule change.

Q: Does this replace the brand team, or reduce headcount? No. It redirects their time. The classification work typically shows that a large share of what a brand team currently reviews by hand is executable and can be automated, which frees the team to spend their expertise on the smaller set of decisions that genuinely require human judgment.

Q: How does this apply specifically to AI-generated content? The same controls apply, arguably with more urgency: preventive controls (approved prompt templates, locked brand assets feeding generation tools) and detective controls (scanning AI-generated content against brand rules before and after it goes live) matter more when content volume and speed increase, since a manual-only review process was already struggling before generative tools entered the workflow.

Related reading

Approvals are one part of a controlled release. What release management means for marketing shows how review, checks and a record work together.