As the number of employee communication channels grows, ensuring coherence, precision and precision in targeting can be challenging. Email, intranets, collaboration tools, mobile apps and internal social networks all have their roles but, without internal communications governance, employees risk being inundated with duplicative, stale or contradictory messages. Internal communications governance provides organisations with accountability while ensuring the right message gets to the right audience via the right channel.
Why Internal Communications Governance Matters
First lets breakdown and understand what is internal comms governance? Internal comms governance is about the policies, procedures, and responsibilities for creating, managing, and sharing information within an organisation. Governance guides what users should expect in answer to simple questions such as, “who is responsible for a particular channel?” or “who has publishing rights?”, and “who’s responsible for communicating crucial updates?”
This is an important issue for decentralised communication. HR might be communicating policies to employees, IT might be communicating technology updates, Finance might be communicating payroll information. HR, IT, Finance, all of these different functions might overshare or accidentally say the same thing.
How to Define Roles and Responsibilities
Ownership is key to good internal communications governance. The organisation can distribute ownership responsibilities between four broad roles:
- Platform administrators: Your control panel for technical configuration, integrations, security and user access.
- Content Owners: Own these channels, departments or areas of content.
- Authors & Publishers: prepare and publish authorised content under prescribed stipulations.
- Reviewers/Approvers: Review messages which could be more sensitive or high impact before they are posted.
For instance, company-wide teams such as corporate comms can endorse every update from the other teams so they can stay updated on region specific changes and news. Specific teams such as sales and HR are allowed to write up their own updates and share stories of success, without being able to publish across the wider organisation.
How to Set Permissions and Access Controls
Grant them access once the roles are created. If permissions are too permissive, you increase the risk that the sensitive data will be published publicly or accidentally.
One of the best ways to restrict access is a principle known as least privilege: Provide only the access needed for employees to perform their job. The CISA guidance recommends role-based access control policies and continuous monitoring and review of accounts and access levels.
Three practical permission levels can include:
- Draft-only access: Expertise on content creation are able to create a work without having permission to publish it.
- Channel-level: Policy defines who can read/write to the channel. The engineering manager might have write permission on the engineering channel but only consume permission on the companywide exec channel.
- Broadcast controls: Broadcast functions with high impact, for example, company-wide alerts, emergency notifications, or an all-channel message can be limited to only be sent by certain administrators.
Building an Internal Communications Content Control Process
The level of content governance should reflect the audience’s level of sensitivity. Regular operational updates might be simply signed off, whereas changes that impact structure and people, major business news or crisis communication might call for approval by HR, legal, corporate comms and senior leaders.
A simple model is:
- Low risk content: author and peer review
- High-impact content: Regulatory and communications approval
- Sensitive/ Crisis content: clearly defined escalation & executive approval
Coverage of information after publication should also be included. Pre- publication policies, organisational charts, even press releases sometimes stay in the ‘public’ domain and cause confusion. If they are covered by review dates, ownership and archiving programmes then they stay up-to-date.
Best Practices for Long-Term Governance
Internal communications governance should develop alongside your organisation, its people and its technology. Part of this process is that when staff are on-boarding they are guided on which channels are appropriate and the approval requirements for each.
Organisations should also consider routine access reviews. Quarterly reviews could be suitable for higher-risk environments, but other organisations might want to consider a different approach depending on their systems and risk profile. In general, we want to ensure access isn’t kept when it isn’t needed, for example, when a user moves to a new role or leaves the organisation. CISA recommends routine account reviews.
Finally, it can also allow channel analytics to detect inactive, duplicitous or overloaded spaces and lead decisions to consolidate them.
No comment