vaayaa Inclusive Education
Marketing risk assessment

Advertising Strategy and Media Planning Risk Assessment: Platform, Account, Consent and Campaign Controls

A worked example of how a marketing team finds, scores and controls the risks in advertising strategy and media planning, from platform dependence and account compromise to misleading claims, consent gaps and invalid traffic.

Updated November 2026 8 hazards assessed Review every 3 months Highest risk: High to Medium
See the Advertising Strategy and Media Planning course

Executive summary

This assessment shows how a marketing team can find, rate and control the risks that threaten advertising results, customer trust and legal standing. Eight risks were chosen because they are plausible in everyday media planning and campaign work. Platform dependence, account compromise and misleading claims carry the highest inherent scores, because a single failure can stop campaigns or draw complaints quickly. Fraudulent traffic and budget drift are more routine but still waste money. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once controls are in place, but privacy and claims risks remain Medium because regulator attention is hard to predict. The first actions are multi-factor sign in, a claim checklist for every variant, a consent gate on tags and a documented alternative media plan. The brand in this example is a teaching case, so every score illustrates method, not a real organization.

Focus area
Advertising strategy and media planning
Setting
Marketing team planning and running paid media across search, social, video and display for a consumer brand, with an external agency
Method
Likelihood and impact scoring with inherent and residual ratings

Scope

This assessment covers planning and running paid advertising campaigns, from audience and channel strategy and media buying to creative approval, launch checks, budget tracking and reporting. It looks at risks to campaign results, customer data, legal duties, budgets and brand trust. It does not cover advice on any real campaign, platform contract or legal position. Jurisdiction, product category and budget size are assumptions made for teaching.

Context

The team has a marketing director, a media planning lead, two paid media specialists, a creative director and a marketing operations manager. An external agency buys some inventory and manages influencer partners. Campaigns run on several large advertising platforms, use tracking tags and customer lists, and are reported through dashboards and a shared spreadsheet. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls proposed here.

Objectives, assets and stakeholders

The objective is to deliver advertising that reaches the right audiences, produces measurable results within budget, follows advertising and privacy rules, and protects the trust of customers and partners. The assets in scope are the media budget, ad accounts and login credentials, audience lists and tracking data, creative assets, influencer relationships and the brand reputation. Stakeholders include the marketing team, finance, the brand and legal functions, the agency, creators and influencers, customers whose data is used, platform account managers and regulators where advertising or privacy rules apply. Clear ownership matters: every risk has one owner role, and the marketing director reviews the register each quarter and reports material changes to the leadership team.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H06 Likelihood 4, impact 4, score 16, high: H01 H02
3 Possible Likelihood 3, impact 3, score 9, medium: H07 Likelihood 3, impact 4, score 12, high: H04 H05 Likelihood 3, impact 5, score 15, high: H03
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H06
2 Unlikely Likelihood 2, impact 2, score 4, low: H07 Likelihood 2, impact 3, score 6, medium: H01 H02 H04 H05 Likelihood 2, impact 4, score 8, medium: H03
1 Rare Likelihood 1, impact 3, score 3, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Platform and vendor dependency 16 High 6 Medium Media planning lead
H02 Ad account compromise 16 High 6 Medium IT security lead
H03 Misleading claims and advertising law breach 15 High 8 Medium Brand compliance lead
H04 Privacy, consent and targeting failures 12 High 6 Medium Privacy officer
H05 Influencer disclosure and creator conduct 12 High 6 Medium Influencer partnerships manager
H06 Budget overspend and attribution errors 12 High 6 Medium Finance business partner
H07 Fraudulent traffic and invalid leads 9 Medium 4 Low Paid media specialist
H08 Unsafe placements and brand adjacency 8 Medium 3 Low Brand manager
H01

Platform and vendor dependency

Supplier Before 16 After 6

A single advertising platform changes its rules, auction pricing or account policy, or an agency partner fails, leaving campaigns paused or more costly with little warning.

Who or what is affected: Marketing team, finance and brand owners

Causes

Heavy reliance on one platform, opaque auction changes and agency staff turnover.

Consequences

Lost reach, sudden cost increases, stalled launches and strained agency relationships.

Existing controls

  • Spend is spread across at least two platforms.
  • The agency contract includes a termination and handover clause.

Control gaps

Channel mix is reviewed only quarterly, so a policy change can cut results before anyone reacts.

Additional controls

  • Prevent: Keep a documented media plan that can move budget to an alternative channel within a week.
  • Recover: Hold a tested handover file with account access, creative assets and audience lists stored outside the agency.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Media planning lead Target: Within 60 days Early warning: Cost per result rising for three consecutive weeks on one platform without a media change.
H02

Ad account compromise

Technology and data Before 16 After 6

Shared logins, reused passwords or phishing let an outsider take control of ad accounts, change budgets, pause campaigns or copy customer audiences.

Who or what is affected: Marketing team, customers whose data is held and finance

Causes

Shared credentials, phishing emails that imitate platform notices and staff who keep access after leaving.

Consequences

Unauthorized spend, deleted audiences, leaked customer data and public embarrassment.

Existing controls

  • Named user accounts are used for each team member.
  • Admin rights are limited to two senior staff.

Control gaps

Access is not reviewed after a team change, and billing alerts are not sent to finance.

Additional controls

  • Prevent: Require multi-factor sign in and remove shared passwords from every ad account.
  • Detect: Alert on new users, billing changes and sign in attempts from unknown locations.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: IT security lead Target: Within 30 days Early warning: Unexpected change to billing details, budgets or user roles on any ad account.
H03

Misleading claims and advertising law breach

Legal and compliance Before 15 After 8

Ads make unsupported performance, price or health related claims, omit material terms or fail to mark paid content, breaching advertising rules and inviting complaints.

Who or what is affected: Consumers, the brand, the legal team and regulators

Causes

Fast creative turnaround, pressure to use strong claims and copy reused from other markets.

Consequences

Complaints, forced withdrawal, fines where applicable and damage to consumer trust.

Existing controls

  • Creative is checked by the brand compliance lead before launch.
  • Claims must cite a source held on file.

Control gaps

The checklist is applied to hero ads only, so smaller variants and resized banners go live unchecked.

Additional controls

  • Prevent: Run a claim substantiation checklist and a pre-launch review of every ad before it goes live.
  • Respond: Pull any disputed ad within one working day and record the decision made.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Brand compliance lead Target: Within 30 days Early warning: Consumer complaints or platform rejections about claims in any ad set within a week.
H04

Privacy, consent and targeting failures

Legal and compliance Before 12 After 6

Tracking tags fire before consent is given, customer lists are uploaded without a clear lawful basis, or sensitive traits are used for targeting, exposing personal data and breaching privacy duties.

Who or what is affected: Customers, the privacy officer and marketing staff

Causes

Tag manager rules set too loosely, audiences built by copying lists and unclear consent records.

Consequences

Regulator action, customer complaints, platform account restrictions and loss of trust.

Existing controls

  • A consent banner is shown on the website.
  • Customer lists are uploaded only by the data team.

Control gaps

Tag rules are changed by agencies without a second check, and audience sources are not logged.

Additional controls

  • Prevent: Block tags until consent is recorded and exclude sensitive traits from all audience builds.
  • Respond: Suspend affected audiences and seek specialist privacy review before any reuse.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Privacy officer Target: Within 45 days Early warning: Tags firing on pages before a consent choice is recorded in the consent log.
H05

Influencer disclosure and creator conduct

Reputational Before 12 After 6

Creators publish content without clear disclosure of paid partnerships, make claims the brand has not approved, or become linked to controversy, damaging trust and drawing regulator attention.

Who or what is affected: Audiences, creators, the brand and the agency

Causes

Creators working to tight deadlines, loose briefs and reliance on agency relay.

Consequences

Public backlash, forced takedowns, partner exits and regulator complaints.

Existing controls

  • Creators sign a brief that covers disclosure and approved claims.
  • Posts are reviewed before they go live.

Control gaps

Approval covers the first post only, so later edits and comments are not reviewed.

Additional controls

  • Detect: Monitor creator posts for missing disclosure and unapproved claims each week.
  • Respond: Require removal of non-compliant posts within a set time and pause the partnership if problems repeat.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Influencer partnerships manager Target: Within 30 days Early warning: A creator post with no disclosure label or a claim missing from the approved brief.
H06

Budget overspend and attribution errors

Financial Before 12 After 6

Spend runs past agreed limits because bids and pacing are not watched, and attribution settings credit the wrong channels, so budget moves toward campaigns that look strong but do not earn their cost.

Who or what is affected: Finance, the marketing director and shareholders

Causes

Automated bidding, mixed tracking methods and pressure to spend the full budget before the period closes.

Consequences

Wasted spend, poor budget decisions and strained relations with finance.

Existing controls

  • Platform budget caps are set on each campaign.
  • Monthly spend is reviewed against plan by finance.

Control gaps

Attribution settings are changed without a record, so results cannot be compared over time.

Additional controls

  • Prevent: Set daily spend caps and require approval for any budget change above an agreed amount.
  • Detect: Compare platform reporting with an independent analytics source and log the gap each month.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Finance business partner Target: Within 45 days Early warning: Spend above planned pacing for two days in a row without a logged reason.
H07

Fraudulent traffic and invalid leads

Financial Before 9 After 4

Bots, click farms or fake sign ups inflate clicks and leads, so paid budget buys traffic that never converts and sales teams chase lead records that are not real.

Who or what is affected: Finance, sales teams and the marketing team

Causes

Open placements, affiliate sources paid per lead and weak form validation.

Consequences

Budget loss, distorted reporting and wasted sales effort.

Existing controls

  • Platforms filter some invalid clicks automatically.
  • Lead forms use basic spam checks.

Control gaps

Placement reports are checked only at month end, so invalid activity can run for weeks.

Additional controls

  • Prevent: Use a verified list of traffic sources and block placements that show abnormal click patterns.
  • Recover: Request credits from platforms for invalid activity and record each claim.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Paid media specialist Target: Within 30 days Early warning: Click to lead conversion falling sharply while clicks rise on one placement.
H08

Unsafe placements and brand adjacency

Reputational Before 8 After 3

Ads appear beside content that is offensive, unsafe or against the brand's values, or inside apps and sites the brand has not approved, so the brand is linked to harm it did not intend.

Who or what is affected: Brand team, customers and creative partners

Causes

Automated buying across open inventory and exclusion lists that are out of date.

Consequences

Public criticism, customer distrust and internal pressure to halt campaigns.

Existing controls

  • Brand safety exclusion lists are applied on major platforms.
  • Sensitive topics are excluded from keyword targeting.

Control gaps

Placement reports arrive after the campaign ends, so harm is spotted too late.

Additional controls

  • Prevent: Build an approved placement list for each campaign and exclude unknown inventory.
  • Respond: Pull placements that appear beside harmful content and log each incident for review.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Brand manager Target: Within 60 days Early warning: Placement report showing ads in content flagged by the brand safety list.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Minor to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls are working. Impact is judged on lost budget, legal exposure, customer harm, time to recover and damage to trust, and a risk is never rated down only because it has not happened yet. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Ratings should be challenged by the people who run campaigns, by finance and by the privacy and brand compliance leads. Any rating is reviewed early when a warning indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 3 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Unexpected changes to billing details, budgets or user roles on any ad account.Escalate to the IT security lead at once, and to the marketing director if access is confirmed as unauthorized.
Consumer complaints or platform rejections about claims in any ad set.Escalate to the brand compliance lead within one working day, and pull the ad until a decision is recorded.
Tags firing before a consent choice is recorded in the consent log.Escalate to the privacy officer at once, and suspend affected audiences until specialist review is complete.
Spend above planned pacing for two days in a row without a logged reason.Escalate to the finance business partner the same day, and to the marketing director if the overspend continues for a week.
Click to lead conversion falling sharply while clicks rise on one placement.Escalate to the paid media specialist to block the placement, and to finance if invalid activity is confirmed.

Contingency arrangements

If a serious event occurs, such as a confirmed account takeover, a complaint about a misleading ad or a tracking failure that exposes personal data, the marketing director pauses the affected campaigns and informs the finance business partner. The IT security lead removes unknown users, resets credentials and preserves the activity logs. The privacy officer and brand compliance lead decide what must be withdrawn or reported, and specialist advice is sought where the jurisdiction is unclear. Budget is protected by moving spend to approved channels, and customers and partners are told what they need to know early and plainly.

Prioritized action plan

  1. Enforce multi-factor sign in and remove shared passwords from all ad accounts, owner IT security lead, within 30 days.
  2. Introduce a claim substantiation checklist and pre-launch review for every ad variant, owner brand compliance lead, within 30 days.
  3. Block tracking tags until consent is recorded and review audience sources, owner privacy officer, within 45 days.
  4. Document an alternative media plan and a handover file for each agency, owner media planning lead, within 60 days.
  5. Set daily spend caps and approval thresholds for budget changes, owner finance business partner, within 45 days.

Conclusion

Effective advertising depends on a few steady habits: multi-factor sign in, a checked claim for every variant, consent before tracking, approved placements, daily budget caps and a tested alternative plan for each platform. The highest scores sit with platform dependence, account compromise and misleading claims, and each has actions that lower the residual score. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real legal, privacy or contract question.

Assumptions and limitations

Assumptions

  • The brand sells to consumers in one main market, and the jurisdiction is not specified, so legal duties are described in general terms only.
  • Campaigns run on third party advertising platforms under standard terms, and the team holds admin access to its ad accounts.
  • Tracking uses first party data and a consent tool set up by the team, and the budget is moderate for the product category.

Limitations

  • The scores are examples for learning and do not describe any real brand, agency or advertising platform.
  • Advertising, privacy and consumer law differ by country and change often, so specialist review is needed.
  • This is educational content and is not legal, privacy, financial or media buying advice.

Related frameworks to study

  • Consumer protection and advertising standards principles
  • Hierarchy of controls
  • Three lines model of risk ownership
  • Data minimization and consent principles

Marketing Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Advertising Strategy and Media Planning course Read the best practices for this course

More Marketing risk assessments

Hourly Active: 39,047 Learners