Operations
Paid social agencies quality checklist for the live window
A paid social agencies quality checklist for a release that is running: who may touch it, the recovery rehearsal, the first live check and closure.
A paid social agencies quality checklist for the live window starts after approval, not before it. Once a signed release is running, the questions change: who can still alter it, who can stop it, what was actually served, and what must be handed back at the end.
What to take away
- Check access roles person by person while the release runs, not only at onboarding.
- Rehearse pause, ad-account recovery and business-manager recovery before launch.
- Capture the served version, disclosure, landing path, audience state, measurement signals and billed account at the first live observation.
- Give every monitoring measure an owner, a local threshold and an action.
- Close the release only with reconciliation, export, access removal, recovery check and retention or deletion evidence.
Who may touch a live release
Only named people with minimum permissions should be able to change a live release, and each of them should be able to show it. Least privilege is checked platform by platform, because every platform names its roles differently.
The roles sit in Business Manager on Meta and in the ad manager of TikTok and LinkedIn. Pinterest, Snapchat and X Ads follow the same rule. Access runs through partner access to the client's business account, never a shared login, with two-factor authentication on for every user.
| Person | What to check | Evidence to file |
|---|---|---|
| Agency planner | Individual login, minimum role, two-factor authentication on | Dated role list |
| Agency buyer | Same as planner, named against the release | Dated role list |
| Agency account manager | Named as evidence owner in the commercial record | Commercial record entry |
| Client approver | Signs the same version that is live | Signed candidate |
| Reporting-only user | Viewer or analyst role, no edit rights | Dated role list |
The client's ownership and recovery route were proven before agency access began, and release day is the moment to prove they still hold. The client, not the agency, should be able to remove a user in an emergency. The NCSC's social-media security advice supports this kind of account and incident planning.
Authentication, recovery, logging and emergency removal each need their own evidence. A role list without a recovery route only shows who has access today, not who could take it away tomorrow. The team roles model names who holds each duty.
Rehearsing pause and recovery
Rehearse the pause and the recovery before launch, because an untested stop button is found out during an incident. The team should have practised pause, ad-account recovery, business-manager recovery and evidence retrieval, with a note in the release log.
- A named person can pause the release, and the rehearsal note records who did it and when.
- Ad-account recovery was tested with the administrator access the client holds.
- Business-account ownership and two-factor recovery codes were tested before launch.
- Evidence retrieval was rehearsedthe team found the signed candidate and its release log entry.
- Pause, correction, withdrawal, incident and restart routes each have a named authority.
A filed example reads: artefact, pause and recovery rehearsal note, version 3; owner, release manager; evidence link, the release log entry for the rehearsal. Anyone opening the log can then find the proof without asking the agency.
Scenarios worth rehearsing are collected in the risk scenarios for England briefs. Pick the one closest to the release and run it against the real accounts.
The first live observation
The first live observation proves what the audience actually saw, not what was approved. Capture six things: the served version, the disclosure, the landing path, the audience state, the measurement signals and the billed account.
- Open the live advert in the format people see and compare it with the signed candidate.
- Confirm that the marketing identification is clear in the rendered format.
- Follow the landing path from the advert and note where it ends.
- Check the audience state and geography against the release record.
- Confirm that the measurement signals are arriving and note which account is billed.
- File the capture against the release ID with the time it was taken.
If the served advert carries a price statement, check it against CAP's misleading-advertising section, where rules 3.17 to 3.19 govern price statements. Substantiation was assembled before launch, and the live check confirms that the served wording is the approved wording. Platform approval does not complete this review.
Monitoring after launch
A dashboard shows numbers, while a monitoring card says what to do about them. Each card defines the population, event, denominator or unit, period, evidence query, owner, local threshold and action, so a number crossing its line has a named response.
Writing the cards well is covered in the guide to service standards as metric cards. The reporting measures they draw on are set out in the key metrics article, which keeps the evidence query separate from the number itself.
For the mechanics, the GOV.UK Service Manual has monitoring guidance on GOV.UK that covers setting up monitoring, writing checks and alerts, and recording issues. It is an operational reference, not an agency certification, and it does not replace the cards above.
When a check fails
Record every failure with the release ID, the evidence gap, the owner and the next decision. A failure with no owner has no deadline, so the owner is named before anything else is written down.
Re-run the affected checks after any creative, audience, tracking, account, platform, contract or legal change. Reject rather than patch an already signed candidate when a material setting changes. Patching a signed version leaves the log describing something that is no longer running.
Closing the release
Closing is a checked event, not a status change. Closure requires reconciliation, export, access removal, recovery check and retention or deletion evidence, each filed against the release ID before the release is marked closed.
- Reconciliation is complete and filed.
- The export has been delivered to the client and its location recorded.
- Every agency user has been removed, and a dated role list shows it.
- The client still holds ownership and the recovery route, and has tested them.
- Each data type has a retention or deletion entry.
The exit stage of controlled paid social delivery sets the wider sequence, while this list covers the evidence that must be on file at the end. Where a tool holds exported data, the tools and supplier guide covers privacy, security and exit gates.
Common questions
Who should be able to stop a live release?
A named authority for pause, correction, withdrawal, incident and restart, with the route rehearsed before launch. The client keeps the recovery route, so an emergency removal does not depend on the agency.
What must the first live observation capture?
The served version, disclosure, landing path, audience state, measurement signals and billed account, filed against the release ID. It shows what people saw, which the signed candidate cannot show on its own.
What does a closed release leave behind?
Reconciliation, an export, proof of access removal, a recovery check and retention or deletion evidence. Without all five, the release stays open and its owner is chased.
