A 90-day plan to set up marketing operations in the right order

What to take away

Marketing operations turns a marketing strategy into dependable work. A new function cannot build everything at once, so the order matters. Six two-week phases each end with something a requester can use.

Products, employment practices, privacy duties, communications rules, and market conditions change. Verify current details and obtain qualified legal, privacy, security, accessibility, finance, procurement, employment, and industry review where the work requires it.

The six phases at a glance

Each phase has one build and one proof that it worked. The table gives both, so a team can see when a phase is finished and when it is only busy.

Weeks 1 and 2: write the charter and list the services

Define the function before the team. Definitions of marketing operations commonly combine people, process, technology, data, planning, and execution. Treat that as a starting boundary, then define the decisions and services the company actually needs. Do not build a department around a fashionable title.

State the purpose, customers, outcomes, decision rights, services, non-services, owners, interfaces, principles, measures, risks, and review date. Clarify the relationship with brand, demand, content, creative, product marketing, sales operations, revenue operations, data, finance, legal, security, procurement, and customer teams. A charter prevents operations from becoming the unplanned owner of every difficult task.

Then list the services: planning, intake, campaign design, audience and data support, automation, martech administration, reporting, experimentation, budget control, procurement, training, quality assurance, and incident response. For each, publish eligibility, required input, owner, typical lead time, priority, output, acceptance, escalation, and self-service option. Review demand and capacity before promising response times.

Interview internal customers while the catalog takes shape. Inventory recurring work, requests, tools, data, vendors, risks, and current measures, because a catalog written without them lists services nobody asked for.

Weeks 3 and 4: open the intake route and rank the work

Open one intake route, with triage and rejection rules. A single route prevents hidden operations labor, because every request is visible, owned and decided in the same place.

Score strategic alignment, customer value, commercial value, urgency, evidence, effort, risk, dependency, reversibility, and opportunity cost. Use the score to support judgment, not replace it. Publish who can override the queue and why. An executive request may be urgent, but its tradeoff with committed launches and legal obligations should remain visible.

Name the accountable decision owner, responsible operator, contributors, reviewers, informed groups, and backup. Limit approvals to real decisions, with scope and response times. Define approval by evidence rather than silence. Separate creative preference from brand, legal, privacy, security, accessibility, financial, and technical requirements so the correct owner can resolve each piece of feedback.

Weeks 3 and 4: size the capacity and pick a model

Plan from capacity, not aspiration. Estimate available hours or work units by skill, subtract recurring operations, maintenance, governance, leave, and a buffer for incidents, then compare the remainder with approved initiatives.

Account for review queues, vendors, regional adaptations, accessibility, data work, and technical dependencies. A full calendar is not full capacity when specialists become bottlenecks.

Choose the operating model once capacity is visible. A centralized team can standardize tools and governance. Embedded operators can understand a business unit deeply. A hub-and-spoke model can combine standards with local execution. Managed services can add specialist capacity.

Decide which work requires central control, local judgment, shared delivery, or outside help. Preserve one accountable owner across handoffs.

Weeks 5 and 6: standardize one campaign process

Standardize one high-volume process first. Create templates for briefs, naming, projects, campaigns, audiences, assets, tracking, tests, QA, retrospectives, and change logs. Include examples and counterexamples.

Allow an approved exception when the customer, market, experiment, or risk demands it. Track exceptions to discover whether the standard is wrong or a team needs training.

Build a workback plan from the required customer-ready date. Map research, brief, concept, production, localization, accessibility, data, legal, security, platform configuration, quality assurance, launch, monitoring, and retrospective. Distinguish effort from elapsed time. Protect review windows and define what happens when inputs arrive late.

Do not make the final operator absorb every upstream delay. Then define the lifecycle with states such as proposed, triaged, approved, planned, in production, ready, scheduled, live, paused, completed, reviewed, and retired. Write entry and exit evidence, owner, allowed transitions, and exception for each.

A campaign should not be marked ready when tracking, suppression, accessibility, inventory, response capacity, or approval remains unresolved.

Weeks 5 and 6: test, control change and prepare for incidents

Test audience counts and samples, exclusions, links, forms, devices, browsers, accessibility, content, claims, sender, preferences, tracking, events, automation, time zones, budgets, destinations, handoffs, and failure paths. Use an independent reviewer for material launches.

Save the evidence with the campaign record rather than relying on a checked box with no test result.

Control system changes with a request, impact analysis, owner, dependencies, test cases, approval, release plan, communication, monitoring, rollback or recovery, documentation, and post-change review. Use a sandbox where risk and platform capability justify it. An apparently small field or integration change can alter routing, reporting, consent, and customer messages.

Write the incident runbook now. Define what can be paused, who has authority, how to stop spend or communication, preserve evidence, assess affected customers, notify owners, correct records, communicate externally, approve restart, and complete a retrospective. Common incidents include wrong audiences, broken forms, invalid claims, overspend, data exposure, duplicate messages, and integration failure.

Weeks 7 and 8: pilot on a limited queue

Pilot the new routes on a limited work queue before widening them. Record cycle and queue time, rework, defects, stakeholder effort, capacity, and customer outcomes while the pilot runs.

Operational measures include intake volume, accepted work, cycle time, queue time, on-time delivery, rework, defects, incidents, uptime, automation reliability, budget variance, tool adoption, license use, and stakeholder effort.

Connect them with campaign and customer outcomes without claiming operations caused every result. Publish formulas, cohorts, capacity, and data quality, so a reader can see what each number does and does not prove.

Weeks 9 and 10: audit martech, data and access

Audit the systems the pilot depended on. Treat martech as a portfolio. Inventory each platform's business owner, technical owner, users, purpose, data, integrations, permissions, licenses, usage, cost, renewal, security review, artificial-intelligence features, support, dependencies, and exit.

Map overlapping capability and unsupported work. A tool is not valuable because it exists in the stack; it is valuable when a governed process uses it to improve an outcome.

Document every audience's purpose, source, inclusion, exclusion, identity, consent or other approved basis, region, retention, owner, refresh, suppression, destination, and deletion. Sample records before launch. Preserve a route to correct identity and preferences. Do not let an operator invent a legal or ethical interpretation under deadline pressure.

Weeks 9 and 10: audit budgets, vendors and AI

Track approved, committed, ordered, accrued, invoiced, paid, refunded, forecast, and remaining amounts. Reconcile purchase orders, cards, agencies, platforms, production, events, data, software, and internal labor as relevant.

Align currency, tax, capitalization, fiscal periods, and shared-cost allocation with finance. A media dashboard is not a complete budget ledger.

For each vendor, define outcome, scope, deliverables, acceptance, roles, access, customer data, security, subprocessors, artificial intelligence, intellectual property, staffing, service levels, change, fees, expenses, renewal, termination, export, and transition. Keep internal ownership of strategy, accounts, data, and critical platform access.

NIST says its current AI Risk Management Framework is voluntary and intended to help organizations incorporate trustworthiness into the design, development, use, and evaluation of AI systems. Use that NIST AI risk framework as a risk vocabulary, while obtaining qualified review for the actual data, people, decisions, contracts, jurisdictions, and industry duties involved.

Inventory uses in briefs, research, content, assets, audiences, workflows, analysis, prioritization, and support. Record purpose, data, model, access, vendor terms, reviewer, evaluation, override, correction, and monitoring.

Weeks 11 and 12: review, document and retire

Run a retrospective that compares the decision, assumption, plan, actual work, outcome, guardrails, incidents, delays, rework, cost, and customer feedback. Ask which constraint mattered and what should stop, start, continue, or be tested. Assign changes to owners and verify completion.

Publish service and metric definitions, retire unused work, and train owners. Maintain current process maps, service descriptions, owners, field and event definitions, system diagrams, permissions, runbooks, templates, vendor contacts, renewal dates, test cases, incident steps, and decision logs. Name backups and rehearse critical procedures.

Documentation should help a capable colleague operate safely, not preserve every historical detail. Approve the next constrained improvement, then repeat the cycle on the next process.

Control map to keep after the 90 days

Verify the method before release

For marketing operations, the GAO evaluation design guide explains how evaluation questions, evidence needs, and design choices fit together. The guide is written for federal program evaluation. Use its design discipline as a check on the method, not as proof that a marketing result is causal or transferable.

The W3C Privacy Principles statement gives system designers a shared vocabulary for privacy and warns against shifting privacy work onto individuals. Apply that principle to the data flow behind marketing operations. It does not replace the law, contract terms, consent analysis, or a review of the actual configuration.

The GOV.UK technology selection guidance recommends choices that can change over time, preserve data control, address security risk, and include ownership cost. Those public-service rules become useful buying questions for marketing operations, but they are not private-sector mandates or product endorsements.

Record the tested data, roles, product versions, exceptions, and approval date. Repeat the review after a material source, model, access, contract, or decision change.

Common questions

What is marketing operations?

Marketing operations is the managed system of people, process, technology, data, money, controls, and learning that turns approved marketing decisions into dependable work.

Where should a new operations team begin?

Begin with a short charter, service catalog, single intake route, capacity view, one high-volume workflow, and a small set of flow and quality measures.

Does mature marketing operations mean more process?

No. It means the few controls needed for clear decisions, safe delivery, visible exceptions, recovery, and useful learning, with unused work removed.