Operations
Part of Run social media agencies operations that clients renew against
Ten quality checks for a social media agency
Use this ten-point social media agency checklist to assign an owner, record pass or fail, and keep evidence for every campaign before it goes live.
What to take away
- The most common mistake is treating quality as a final proofread. The checks that stop complaints happen before a campaign is built, not the night before it goes live.
- A workable quality checklist for a social media agency has ten fixed points. Each one should have a named owner, a pass or fail mark, and a note of what was seen.
- UK GDPR and PECR govern data-protection and electronic-marketing obligations; the ASA/CAP Code and CMA guidance address advertising claims and disclosures. Split the checks.
- Sign-off should happen before scheduled posts publish, not after. Once a post is live, the remedy is public.
- Keep the completed checklist for each campaign. It is the evidence you rely on if a client or a regulator asks how a decision was made.
A quality checklist fails when it is written as a list of good intentions. Teams tick boxes without recording what they checked, so nobody can tell later whether the work was done or merely claimed. Make each line produce evidence: for example, keep a screenshot of a post showing its ad label, a dated record of a segment's source and approval, or a completed sign-off entry.
Set the scope before the work starts
Agree what the campaign covers and what it deliberately leaves out: the channels, markets, audience groups and claims the client wants to make.
If the client sells in Scotland, Wales or Northern Ireland, check whether a rule differs there before assuming the same wording works. The operations and delivery guide for social media agencies sets out how to hold that scope steady once delivery begins.
The ten-point checklist
Ten-point agency quality checklist
- Confirm lawful basis for every message
- Record audience segment source and approval
- Check demographics against ONS usage data
- Match factual claims to producible sources
- Review ad formats against platform guidance
- Label paid creator promotions clearly
- Verify account and ad account access rights
- Confirm the lawful basis and permissions for relevant data use. Owner: data handler. Pass: record the UK GDPR lawful basis for each use of personal data and check whether PECR applies to electronic-mail marketing; if relying on PECR's soft opt-in for email or text, record how its conditions are met, including the sale or negotiations, similar products or services, and opt-out arrangements. Check the ICO's guidance on choosing your lawful basis for direct marketing. Also use the ICO's data protection fee self-assessment to check whether the agency must pay the fee; check the public register of fee payers where applicable. Fail: the basis, permission or fee status is unverified. Evidence: the assessment, relevant consent or opt-out records, and fee assessment or payment confirmation.
- Record where each audience segment came from. Owner: strategist. Pass: the campaign record identifies the source, date, selection criteria, purpose and approver. If a segment cannot be traced, do not use it. Fail: any of those details is missing or the use is not approved. Evidence: a completed segment-provenance entry and approval in the campaign file.
- Check demographic assumptions against real usage data. Owner: strategist. Pass: compare relevant assumptions with ONS home internet and social media usage data, and record why the data is relevant; use it as context, not as proof about an individual segment. Fail: the assumption rests only on a hunch or the comparison is not documented. Evidence: a dated note of the ONS data consulted and the resulting rationale.
- Match every factual claim to evidence the client can produce on request. Owner: content strategist. Pass: objective claims are substantiated before publication in line with the CAP Code, administered by the ASA. Fail: a claim lacks supporting evidence; mark it blocked. Evidence: the claim, its supporting source and the client's approval in the campaign file.
- Review ad formats and targeting against the rules for each platform used. Owner: paid lead. Pass: check LinkedIn's advertising resources and, where relevant, Meta Advertising Standards, TikTok Ads Policies, X Ads Policies and Google Ads policies; record that the chosen format and targeting comply. Fail: a platform check is missing or a setting conflicts with its policy. Evidence: screenshots or an export of the ad settings and a note naming the policy checked.
- Check paid promotion labels. Owner: creator campaign lead. Pass: for paid or incentivised creator content, the disclosure is clear and prominent under ASA/CAP Code requirements and CMA guidance on social media endorsements, so viewers can recognise it as an ad without having to expand the post. Fail: the commercial nature is unclear or the label is missing. Evidence: a screenshot of the content as it appears to viewers, showing the label.
- Verify access rights. Owner: account lead. Pass: confirm who controls the account, ad account, pixel and analytics property, and test that the client can recover access. Fail: ownership or recovery is unconfirmed. Evidence: an access record and a note of the recovery test.
- Read the whole post as a stranger would. Owner: editor. Pass: the image, caption and landing page work as one unit and do not contradict each other. Fail: the offer, claims or destination are inconsistent or misleading. Evidence: a review capture showing the creative, caption and landing page together.
- Test the response route. Owner: community manager. Pass: agree the promised response time, send a test message through the same channel as a customer, and confirm a human replies within that time. Fail: the route does not work or the response misses the agreed time. Evidence: a dated response-test log recording the channel, message and response.
- Sign off with a name and date. Owner: campaign lead. Pass: the previous nine checks are complete and any issue has been resolved; do not launch while a check fails. Fail: a check is incomplete, unresolved or unsigned. Evidence: the completed checklist with named owners and final sign-off.
Who owns which check
Give each line one owner, as shown beside each check. Research checks usually sit with the strategist, platform checks with the paid lead, and the lawful basis question with whoever handles data. The staged launch review for social media campaigns in England shows how a staged review catches problems that a single end-of-project read misses.
Where two people share a check, neither feels responsible. Split the line or move it.
Common questions
How often should the checklist be run?
Run it for each campaign, not each client. A retainer that publishes weekly still needs a fresh pass whenever the audience, the offer or the claims change.
What if the client refuses to supply evidence?
Leave the line unfinished and say so in writing. An unsigned checklist protects nobody, and the gap is better known before launch than after.
Does a checklist replace legal advice?
No. It records that someone asked the right questions. Data protection and advertising questions with real risk still need a qualified adviser.
How long should the record be kept?
UK GDPR's storage limitation principle does not set one fixed retention period for every campaign checklist. Set and record a period and reason in the agency's retention schedule, then review the record for deletion when that period ends unless there is a valid reason to keep it. Store the checklist with the campaign file and follow the documented schedule.
