When to rehearse social media agencies risk scenarios before a client crisis

What to take away

Risk planning for social media agencies shifted in 2025 and 2026: paid reach, ad tools and consent rules moved at once, so scenarios written 18 months ago no longer match the work.
The main exposures are regulatory (PECR and ICO direct marketing rules), commercial (platform policy and pricing) and operational (talent, tooling, single-client dependence).
Set fixed review datesquarterly for compliance, annual for commercial scenarios, and straight after any platform or client change. Rehearse when a trigger fires, not only on the diary date: a platform change with under two weeks notice, a request to message a purchased list, or three months of rising cost per lead.
Write each scenario as a trigger, an owner and a first action so the plan is usable on the day, not a document nobody opens.

What changed: paid reach, ad tools and consent rules

Paid social costs and ad product changes have outpaced most agency planning cycles. A retainer priced on 2024 reach assumptions can lose margin for two quarters before anyone notices.

The Information Commissioner's Office keeps direct marketing guidance under active review. Agencies handling client consent, lists and tracking pixels sit inside that scope, whether or not they call themselves a data business.

Scenarios written once and filed away give comfort without protection.

Our overview of social media agencies trends and outlook sets out the demand and pricing shifts that feed these scenarios.

Regulatory scenarios worth rehearsing

Start with consent. If a client asks you to message a purchased list, or to re-engage lapsed customers by text, check the rules first.

Comparison table of consent standards for text, calls and email (When to rehearse social media agencies risk scenarios before a client crisis) — Text, automated calls and email each carry their own consent standard under PECR. Image: Social Partner

The ICO's guidance on direct marketing and privacy and electronic communications is the reference point for what is permitted and what needs prior consent.

Email and text sit under regulation 22 of PECR. Both need consent unless the soft opt-in applies: details collected during a sale or negotiations, similar products, and an opt-out in every message.

Automated calls with recorded messages need prior specific consent under regulation 19, including to business numbers.

Live calls need TPS and CTPS screening, plus consent where a number is registered.

Worked written scenario. Trigger: a client asks for a lapsed-customer text campaign built on a list it bought two years ago. Owner: the data protection lead. First action: pause the send, check the consent trail, and offer a re-permission email if there is none.

Advertising claims come next. Influencer disclosure, health and finance claims, and pricing statements fall within the CAP Code, and an agency writing the copy carries part of the exposure.

CAP Code rule 2.1 requires paid promotion to be obviously identifiable, and rule 2.3 requires commercial intent to be clear. Rule 3.1 covers misleading claims. Two common breaches: a paid post where the ad label is buried, and a health claim that promises a cure.

Then AI-assisted production. If the team uses generated copy, images or audience predictions, someone must explain the basis of the output. Training aimed at AI literacy and strategy builds that capability before a client asks.

Scenario: a client asks who approved an AI-generated claim. Owner: the creative lead. First action: pull the prompt record and the sign-off note before replying.

Reporting duties sit with the UK regulator. A personal data breach likely to risk people's rights goes to the ICO within 72 hours of the agency becoming aware. The ICO helpline is 0303 123 1113. Ad complaints go to the ASA. 5 million or 4 per cent of global annual turnover, whichever is higher.

Commercial and platform scenarios

Platform risk is the one agencies underestimate. An account restriction, a change to ad review, or a shift in lead form behaviour can stall a campaign within a day.

Statistic showing one client at 40 per cent of billings (When to rehearse social media agencies risk scenarios before a client crisis) — A single client at 40 per cent of billings is a concentration scenario worth writing down. Image: Social Partner

Performance-led clients are most exposed. If delivery depends on LinkedIn lead generation ads, a change to form fields, targeting or cost per lead changes the commercial story you tell the client.

Worked commercial scenario, illustrative figures. A client pays a £6,000 monthly retainer and a £30,000 monthly media budget. At £30 cost per lead, that buys 1,000 leads.

If cost per lead rises 30 per cent, to £39, the same £30,000 buys about 769 leads. Holding 1,000 leads costs £39,000, a gap of £9,000, or 1.5 times the retainer.

Owner: the account lead. First action: model the gap within 48 hours and offer the client same spend or same volume.

Concentration risk sits alongside it. For example, a team where one client is 40 per cent of billings has a scenario worth writing down.

Review platform terms before you renew a retainer. The remedies open to an agency are usually narrower than clients assume.

Triggers to watch

A platform changes ad formats, review times or targeting with less than two weeks notice.
A client asks for a list-based campaign, or for consent to be assumed rather than evidenced.
Monthly cost per lead rises for three months without a matching change in creative or offer.

First actions to agree

Name one person who pauses spend and one who tells the client, so the message does not arrive twice.
Keep a written fallback channel per client, with a rough cost attached.
Log the decision and the date, because a documented response is easier to defend.

Before and after a scenario review

Weak plan

Ownership: The team
Review date: None set
Consent evidence: Assumed
Platform fallback: None
Client comms: Reactive

Plan that holds

Ownership: Named person per scenario
Review date: Quarterly, with a diary entry
Consent evidence: Documented per campaign
Platform fallback: One tested alternative per client
Client comms: Draft holding statement ready

Internal scenarios: people, access and tooling

The quiet risks are internal. A specialist leaving, a tool price rise, or a reporting error found late can damage a relationship more than a platform outage.

Document who holds each client relationship, each reporting login and each platform billing account. Where one name appears three times, that is a scenario.

Spreading capability across more than one person is the practical answer. Our piece on social media agencies AI applications in England covers how teams share tool knowledge rather than concentrating it.

Common questions

How often should an agency review its risk scenarios?

Quarterly for anything touching consent, claims or platform policy, and annually for commercial scenarios such as client concentration. Add a review after any platform change or lost account.

Does PECR apply to agency work if the client owns the data?

Yes, in most cases. The agency usually processes data on the client's behalf and can still be accountable for how campaigns are run. Consent evidence and suppression lists need documenting.

What is the first scenario a small agency should write?

Start with client concentration. It is quick to calculate and usually reveals which two or three accounts need a retention plan.