A gated paid social workflow for agencies in England: six stages from intake record to evidenced close

An England campaign stops at its first mismatch

An England agency prepares one paid social advert for a client, but the proposed release is not ready to run. A separate reviewer compares the identified platform candidate with the approved brief. A discrepancy appears, so activation waits while the team records authority, checks the correction and later proves handover.

Intake sets the limits of the decision

The client owner establishes the decision boundary before production continues: legal entity, product, England audience, objective, account, media payer, spend ceiling, intended dates and who may approve changes. A delivery lead assigns the release ID and records missing inputs so subsequent decisions attach to one case.

That allocation is checked against team roles, while the signed terms should state access, deliverables, billing, claims approval, data roles, changes, suspension and export. A written contract is legally enforceable and should explain termination and early exit. Seek legal advice on signed terms, with commercial contracts as a review prompt.

Three separate checks protect the proposed advert

The agency separates three questions before building the candidate: whether claims are supported, whether device access is acceptable, and who controls the accounts.

Each question has a named owner and its own recorded decision. Passing one check is not permission for the other two, even when all relate to the same release.

An evidence owner ties each objective claim and qualification to a dated source, approved wording and permitted format. The advertising rules guide that review, including advertisement recognition, and the reviewer records whether the creative retains any qualification. Support for advertising claims must exist before distribution; regulated products go to a competent sector specialist.

The privacy reviewer asks whether technology involves device storage or access. The ICO storage and access technologies guidance was finalised on 29 April 2026 after two consultations. A platform setting alone does not settle the legal question, so the reviewer records data protection and PECR decisions, with reasons, against the candidate version using data protection.

Separately, the security administrator lists client-owned assets, gives named people minimum access, records a recovery route and tests whether access can be removed. Account ownership and agency permission remain distinct safeguards; the agency must not become the sole account holder. These decisions are recorded alongside, rather than substituted for, the claims and privacy outcomes.

The paused build is compared with the approved brief

The build stays paused and unable to spend while the candidate is prepared. A versioned build sheet captures the creative, destination, audience, geography, placements, schedule, authorised ceiling and event mapping. Synthetic events check connections; live personal data is not introduced just to test technical plumbing.

A reviewer who did not configure the advert compares the platform interface against the authorised brief, item by item. In this scenario, that comparison exposes a discrepancy. The reviewer records the result against the exact candidate version, rather than making an informal correction that would leave the evidence attached to the wrong material.

Each owner records pass, fail or more evidence needed, with a reason. One reviewer cannot cancel another reviewer's fail, and one fail blocks release. Approval applies only to the identified version, delivery window and ceiling; a material change requires renewed approval. The mismatch therefore stops this candidate from moving to activation.

A replacement candidate keeps the first decision intact

The mismatch sends the work back for correction, not around the review gate. The operator creates a fresh version, while the earlier client authority stays attached to the original candidate.

The case record retains both versions so the history shows what was assessed and why the first one did not proceed.

The delivery lead records the cause and containment, then assigns the changed controls to the relevant reviewers. They repeat checks affected by the correction, while retaining unaffected decisions only where they still apply to the new version. This keeps the record tied to evidence rather than treating an earlier approval as continuing permission.

The client owner then decides whether the replacement may be released and records the decision against its version. Reasons, reviewer outcomes and client authority remain separate entries. Consent for the earlier candidate does not transfer to the corrected one, so activation waits until the required reviews and the client's renewed decision are complete.

Activation starts a second inspection

Only after the client authorises the identified replacement and all required checks pass does the agency record who approved activation and when it occurred. A preview cannot establish what is actually served or billed, so the live advert and account signals are checked after activation against the authorised release record.

The live check covers disclosure, destination, audience settings, event signals and billed account. Pause delivery for an unapproved combination, destination failure, unexplained audience or location, unauthorised spend, broken disclosure, tracking difference, access anomaly or serious complaint. Keep screenshots, logs and the previous version as evidence of the incident and release state.

One named person must be able to answer a regulator promptly and remove an advert. Rehearsing risk scenarios helps the response owner act on the specific release rather than an assumed state. The ASA ruling concerning Rivergame Ltd concerned two paid-for TikTok adverts challenged as misleading; the advertiser did not respond to ASA enquiries. Unreasonable delay in replying is normally treated as a CAP Code breach, and the adverts were removed at the advertiser's request.

Closure requires a completed handover record

The case is not closed merely because delivery has stopped. Charges must be reconciled, agreed exports delivered, agency access removed, recovery checked, and retention or deletion actions logged. Together, those items give the client a usable closure record and show that the operational handover has been completed.

Finance reconciles charges against the budget template, and the client receives the agreed exports. The agency then removes its access, checks the recovery route and logs retention or deletion actions. The record should show the outcome of each action, not just that someone was assigned to complete it.

The NCSC logging guidance identifies logging as foundational to security monitoring and situational awareness. It recommends a minimum of six months for logs that can answer incident questions. Set retention for this engagement against risk and contract, then record that decision with the closure evidence.

Rules to carry into the next release

The scenario establishes a practical test: review applies to a specific candidate, authority, window and ceiling. A preview is not proof of live delivery, and stopped spend does not establish completed handover.

When a material change creates a new candidate, the record must show which checks were repeated and who authorised the result.

Reassess when the platform, contract, product, audience, measurement or legal position changes. Before another release, use the quality checklist. Keep claims support, privacy decisions and access controls distinct, and do not let a pass in one area stand in for another reviewer's decision.

Close only when charges, exports, access removal, recovery and retention or deletion are evidenced together. If an incident occurs, preserve the release state and the related records so the response owner can explain what was authorised, what was observed and what action followed. That evidence completes the workflow without carrying unresolved operational work into the next campaign.