Who exactly is watching the company Instagram account at 9 p.m. on a Saturday? In a lot of small businesses, the honest answer is “whoever has the password,” and that single fact explains most social media disasters. A rushed reply, a deleted post nobody approved, a hacked page, a contest that quietly breaks data-protection rules. Managing business accounts well is less about going viral and more about building a small, boring system that keeps the right people in charge of the right posts.
This guide covers that system: ownership, roles, security, content planning, legal basics, measurement, and what to do when things go wrong. It is written for the person who inherited the accounts and now has to make them behave.
Start With Ownership, Not Content
The most common mistake is treating the account as a marketing project. It is actually an asset, and assets need an owner. Before anyone writes a caption, decide who legally and practically controls each account.
Practical steps that prevent years of headaches:
- Create every business account using a company email address on a company domain, never a personal Gmail belonging to an employee.
- Store credentials in a shared password manager with an audit log, not in a spreadsheet or a phone note.
- Register the business name and close variants on each platform early, even on networks you do not plan to use yet.
- Record account recovery details (backup email, phone number, recovery codes) in a document two senior people can access.
- Add a named backup administrator for every platform, so a departure never locks the company out.
That last point matters more than it sounds. When someone leaves and they were the only admin, recovery can take weeks and sometimes fails entirely. Platforms rarely negotiate with a business that cannot prove ownership.
Give People Roles Instead of Passwords
Handing out the master password is the fastest route to chaos. Every major platform now supports some form of role-based access through business managers, admin panels, or team features. Use them.
| Role | What they can do | Who should have it |
|---|---|---|
| Owner | Full control, billing, account deletion | One senior leader, plus one backup |
| Admin | Manage users, settings, and publishing | Marketing lead and a technical contact |
| Editor or publisher | Draft, schedule, and publish approved content | Content team, agency staff |
| Analyst | View insights only | Reporting and finance contacts |
| Community responder | Reply to comments and messages | Customer service staff |
Agencies should get editor access through the platform’s own collaboration tools, never a shared login. When the contract ends, you revoke access in one click instead of changing every password.
Access control is also a security control. Account takeovers usually start with phishing, not brute force. Training staff to spot fake login pages and enabling two-factor authentication on every account is the baseline. Government security guidance on protecting accounts and devices is worth reading once a year, and it applies to social accounts as much as to email. For a plain-language walkthrough of the tricks attackers use, see this guide on how to protect your devices and accounts from social engineering.
Build a Simple Content Engine
Consistency beats brilliance. A business that posts twice a week for a year will outperform one that posts daily for a month and then vanishes. The goal is a repeatable process that does not depend on inspiration.
A workable weekly rhythm looks like this:
- Monday: review last week’s numbers and note what worked.
- Tuesday: draft posts for the next two weeks in a shared document or tool.
- Wednesday: one person reviews for accuracy, tone, and legal risk.
- Thursday: schedule approved posts into the calendar.
- Daily: one named person monitors comments and messages for a set window.
Two rules make this survive contact with reality. First, the approval step is not optional, even for the owner. Second, there is always a backup poster who knows where the drafts live and how the scheduler works.
Match the Content to the Platform
Copy-pasting the same post everywhere is a common shortcut that quietly wastes effort. Each network rewards different behavior.
| Platform | Best for | Format that tends to work |
|---|---|---|
| B2B, hiring, expertise | Short text posts with one clear idea | |
| Visual brands, retail, local business | Reels and carousels with captions | |
| Local community, events, older audiences | Photos, events, group discussion | |
| TikTok | Reach and discovery | Short vertical video, native style |
| X | News, real-time commentary | Brief text posts and replies |
| YouTube | Search-driven how-to content | Longer tutorials and demos |
Pick two or three platforms you can genuinely maintain. An abandoned account looks worse than no account. If you want to speed up drafting, there are sensible ways to use AI tools without sounding like a robot; this overview of how to use AI for social media marketing covers the workflow. And if you sell visual products, the specifics of hashtags and ad rules differ enough to deserve their own playbook, such as these 2025 hashtag best practices for skincare social media ads.
Get the Legal Basics Right Early
Social media sits at the intersection of advertising law, consumer protection, and data protection, and most small businesses learn this the hard way. Three areas deserve attention before you publish anything promotional.
Paid partnerships must be disclosed. In the United States, the Federal Trade Commission’s Endorsement Guides set out when and how influencers and brands must make clear that a post is an ad. The FTC’s answers to common questions about the Endorsement Guides explain the disclosure rules in plain language, including why a buried hashtag is not enough.
Accessibility is not optional. Alt text on images and captions on video help people who use screen readers or watch with sound off, and they also improve reach. The Web Content Accessibility Guidelines published by the W3C define the standard most accessibility laws reference, and WCAG 2.2 became a formal recommendation in October 2023. Adding alt text takes seconds per post; retrofitting years of content does not.
Data protection applies to contests and lead forms. If you collect entries, emails, or photos through a social platform, you are processing personal data. In the EU and UK, the General Data Protection Regulation has applied since May 2018 and January 2021 respectively, and it requires a lawful basis, a privacy notice, and a way for people to withdraw. The UK regulator’s guidance on UK GDPR and marketing is a useful starting point for consent and direct marketing questions.
None of this requires a lawyer on retainer. It requires a checklist that someone actually uses before a campaign goes live.
Handle Comments, Complaints, and Crises
Most community management is unglamorous: answering the same question five times, thanking people, deleting spam. That is fine. The trouble comes when a complaint escalates and nobody has decided in advance who is allowed to respond.
Set three tiers and write them down:
- Tier 1, routine: questions, compliments, mild complaints. The community responder handles these with approved templates.
- Tier 2, sensitive: refund disputes, safety concerns, legal threats. Respond once publicly to acknowledge, then move the conversation to a private channel.
- Tier 3, crisis: a post going badly wrong, a security breach, a news story involving the brand. Pause scheduled posts, alert the owner, and use a pre-approved holding statement.
Two practical habits help. First, never argue in public, even when the brand is right; screenshots outlive context. Second, keep a log of recurring complaints, because patterns are free product feedback.
There is a persistent myth that brands must reply within an hour or the customer is lost. No authoritative standard sets such a rule, and the surveys behind those claims are usually vendor marketing. What matters more is publishing your actual response hours and then meeting them.
Secure the Accounts Like You Mean It
Social accounts are a front door to your business. A hijacked page can post scams to your customers, damage trust, and take days to recover. The defenses are simple and unglamorous.
- Turn on two-factor authentication everywhere, using an authenticator app or hardware key rather than SMS where possible.
- Remove access for anyone who has left, including agency staff and former freelancers.
- Audit connected third-party apps quarterly and revoke anything unrecognized.
- Never share passwords over chat or email.
- Review login locations after any suspicious activity.
If something does go wrong, speed matters. This guide on how to check whether your device or account was affected by a social platform breach walks through the first steps. It also helps to understand the wider attack surface: this piece on protecting devices and accounts from malware in 2026 covers the malware side, while this explanation of protecting devices and accounts from DNS poisoning shows how attackers redirect traffic without touching your password. Larger organizations should also think about how accounts sit on the network, and this guide to choosing network segmentation that fits your business explains why a compromised marketing laptop should not be able to reach finance systems.
Platform outages and policy shifts are outside your control, but they are worth planning for. When a government orders a platform blocked or a service goes dark, scheduled posts vanish and customer messages pile up. Reading about incidents like the France social media blackout during the yellow vest protests and the telecom questions it raised in 2026 is a reminder to keep an owned channel, such as an email list, that no platform can switch off. (Disclosures 101 for Social Media Influencers)
Measure What Actually Matters
Vanity metrics feel good and teach little. Follower counts rise and fall for reasons unrelated to your work. Better to track a small set of numbers tied to business outcomes.
| Metric | What it tells you |
|---|---|
| Reach and impressions | Whether content is being seen at all |
| Engagement rate | Whether it resonates with the people who saw it |
| Click-throughs to site | Whether it drives action |
| Messages and inquiries | Whether it generates demand |
| Response time | Whether service is keeping up |
| Follower growth | Directional health, not a goal in itself |
Review monthly, not daily. Daily checking breeds anxiety and reactive posting; monthly review reveals patterns. Compare like with like, too: a post boosted with paid budget should not be judged against organic content.
Conclusion
Managing business social accounts is mostly discipline. Put a named owner on every account, give people roles instead of passwords, run a simple weekly content rhythm, check the legal basics before campaigns launch, and treat security as a habit rather than an afterthought. None of it is exciting, and that is the point. A boring system keeps publishing when the person who built it moves on, survives a phishing attempt, and answers a customer without a committee meeting. Start with ownership and access this week, add the content calendar next, and the rest becomes routine.
Frequently Asked Questions
Who should manage a company’s social media accounts?
Someone with clear accountability, not necessarily a dedicated social media manager. In small businesses, that is often a marketing coordinator or the owner, supported by a customer service person who handles replies. What matters is that one named person owns the calendar, the approvals, and the security settings, with a documented backup.
How often should a business post on social media?
Fewer, better posts beat a burst of activity followed by silence. For most small businesses, two to three posts per week per platform is sustainable and enough to stay visible. The right number is the one the team can maintain for a year without dropping quality or approvals.
Should a business share its passwords with an agency?
No. Use each platform’s built-in collaboration or business manager tools to grant editor access, and revoke it when the contract ends. Shared passwords cannot be audited, are rarely changed, and become a serious risk the moment someone leaves or a laptop is stolen.
What should a business do if its social account gets hacked?
Act quickly and in order: try to regain access through the platform’s official recovery process, change the password and enable two-factor authentication, check connected apps for anything unfamiliar, warn customers if scam posts went out, and report the incident to the platform. Keep records of what happened for any follow-up.
Do businesses need permission to repost customer photos?
Usually yes. A customer tagging a brand does not automatically grant commercial use rights, and reposting without permission can create copyright and privacy problems. The safe habit is to ask in writing, keep a record of the reply, and credit the creator when you publish.
How do you handle a negative comment in public?
Respond once, calmly, and without arguing. Acknowledge the issue, avoid defensiveness, and move detailed resolution to a private message. Delete only comments that break the platform’s rules or contain abuse, spam, or personal data. Deleting fair criticism tends to amplify it.
