vaayaa Inclusive Education
Marketing risk assessment

Marketing Strategy and Brand Positioning Risk Assessment: Claims, Campaigns, Data and Brand Controls

A worked example of how a marketing team finds, scores and controls the risks that threaten campaign results, brand trust, legal compliance and customer data during strategy and positioning work.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Marketing Strategy and Brand Positioning course

Executive summary

This assessment shows how a marketing team can find, rate and control the risks that come with strategy, positioning and campaign delivery. Eight hazards were chosen because they are plausible in everyday marketing work. Misleading claims and brand harm carry the highest inherent scores because a single unsupported statement or poorly judged campaign can breach rules and damage trust quickly. Brand harm from a poorly judged campaign scores Critical before controls, and it is brought down by pre-launch testing, a clear pause point and staged rollouts. Fraudulent traffic, attribution errors and budget overspend are common and cost money steadily, while account compromise and consent failures can cause sudden harm to data and reputation. Most risks fall to Low or Medium once the added controls are in place. The first actions are a claims sign off, a second check on invoices and attribution reports, multi factor sign in for every account and a consent audit of the mailing list. Every score illustrates method, not a real organization.

Focus area
Marketing strategy, brand positioning and campaign management
Setting
Marketing function of a mid-sized consumer brand running paid, owned and partner campaigns across several digital channels
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the strategy, positioning, campaign planning, creative approval, media buying, influencer partnerships and measurement work of a marketing team, from brief to post-campaign review. It looks at risks to legal compliance, budget, brand reputation, customer data and supplier relationships. Jurisdiction, product type, audience size and platforms are assumptions made for teaching only and are not specified in the brief.

Context

The team has a marketing director, a brand manager, two campaign managers, a performance analyst and a content lead. Paid media is bought through agencies and self-serve platforms. Influencers and creators are engaged under short agreements. Customer data is held in a marketing platform and an analytics tool, and consent is recorded at sign up. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls proposed here.

Objectives, assets and stakeholders

The objective is to build a clear positioning, run campaigns that are lawful and honest, spend budget as approved, measure results accurately, and protect the trust customers place in the brand. The assets in scope are the brand identity and messages, media budgets and agency contracts, customer data and consent records, marketing platforms and accounts, creative assets and intellectual property, and the reputation of the team. Stakeholders include the marketing director, senior leaders and the board, customers and prospects, agencies, influencers and creators, platform providers, data protection and advertising regulators where applicable, and the finance team. Every risk has one owner role, and the marketing director reviews the register each quarter with the finance and legal leads.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H03 H04 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H05
3 Possible Likelihood 3, impact 4, score 12, high: H02 H06 Likelihood 3, impact 5, score 15, high: H07 H08
2 Unlikely
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H04
2 Unlikely Likelihood 2, impact 2, score 4, low: H03 Likelihood 2, impact 3, score 6, medium: H01 H02 H06 H07 Likelihood 2, impact 4, score 8, medium: H05 H08
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Misleading claims and advertising breaches 16 High 6 Medium Marketing director
H02 Intellectual property infringement 12 High 6 Medium Brand manager
H03 Ad fraud and fraudulent traffic or leads 12 High 4 Low Performance analyst
H04 Budget overspend and attribution errors 12 High 6 Medium Finance business partner
H05 Brand and reputational harm from poor positioning 20 Critical 8 Medium Brand manager
H06 Platform, influencer and vendor dependency 12 High 6 Medium Marketing director
H07 Account compromise and credential misuse 15 High 6 Medium IT lead
H08 Privacy, consent and targeting breaches 15 High 8 Medium Data protection lead
H01

Misleading claims and advertising breaches

Legal and compliance Before 16 After 6

Headlines, testimonials, comparisons or influencer posts make claims that cannot be proven or that imply results the product does not deliver, which can breach advertising rules and mislead buyers.

Who or what is affected: Customers, regulators, agencies and the brand team

Causes

Pressure for bold headlines, unclear evidence and creative briefs written without legal input.

Consequences

Takedown orders, complaints, fines where applicable, refunds and loss of customer trust.

Existing controls

  • Brand guidelines list words and phrases that need checking.
  • Agencies confirm that copy is accurate before launch.

Control gaps

Influencer posts are often approved after publication, and older claims are not reviewed.

Additional controls

  • Prevent: Require a written evidence file and legal sign off for every product claim before publication.
  • Detect: Scan live ads and influencer posts weekly against the approved claims list.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Marketing director Target: Within 30 days Early warning: Published claims that lack a signed evidence file or legal sign off.
H02

Intellectual property infringement

Legal and compliance Before 12 After 6

Images, music, fonts, trademarks or creator content are used without a licence or beyond its terms, or a competitor's brand name is copied in a campaign, exposing the business to claims and forced withdrawal.

Who or what is affected: Brand owners, creators, designers and the marketing team

Causes

Assets sourced from search results, reused past work and unclear creator contracts.

Consequences

Claims for damages, forced withdrawal, costly reshoots and strained creator relationships.

Existing controls

  • Stock images are bought from licensed libraries.
  • Creative briefs ask for the source of any third party asset.

Control gaps

No central register exists, so licence end dates and usage limits are not tracked.

Additional controls

  • Prevent: Keep a licence register with usage limits, territory and expiry dates for every asset.
  • Respond: Withdraw the asset within 24 hours of a credible claim and record the decision.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Brand manager Target: Within 60 days Early warning: An asset in live use with no licence record or with a licence that has expired.
H03

Ad fraud and fraudulent traffic or leads

Financial Before 12 After 4

Bots, click farms, fake accounts or lead form spam inflate traffic and conversions, so spend pays for audiences and leads that do not exist and reported results mislead decisions.

Who or what is affected: Finance team, performance analysts and sales colleagues

Causes

Pay per click buying, weak placement controls and rewards tied to lead volume.

Consequences

Wasted budget, distorted campaign decisions, sales time lost and inflated reports to senior leaders.

Existing controls

  • Platforms report invalid click rates in the account dashboard.
  • Lead forms use a basic captcha before submission.

Control gaps

Lead quality is checked only after the sales team complains, and placement reports are reviewed quarterly.

Additional controls

  • Prevent: Apply exclusion lists, minimum time on page rules and verified placements for paid traffic.
  • Detect: Review lead quality each week by checking a sample against sales outcomes and bounce rates.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Performance analyst Target: Within 45 days Early warning: Leads rising faster than sales conversations, or high traffic with very short visit times.
H04

Budget overspend and attribution errors

Financial Before 12 After 6

Campaign spend runs past approved limits through automated bids or unapproved orders, and attribution models credit the wrong channels, so budget moves toward channels that appear to perform but do not.

Who or what is affected: Finance team, marketing director and agencies

Causes

Automated bidding left unchecked, last click attribution used by default and agency reports that are not reconciled.

Consequences

Overspend against plan, poor investment decisions, misreported returns and difficult board conversations.

Existing controls

  • Monthly budgets are set by channel and signed off.
  • Agencies report spend against the approved plan each week.

Control gaps

Spend caps are set only for large campaigns, and attribution models are not documented.

Additional controls

  • Prevent: Set hard caps on daily and campaign spend in every platform and agency account.
  • Detect: Reconcile platform spend to invoices monthly and test attribution against a holdout group.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Finance business partner Target: Within 45 days Early warning: Spend running above 110 percent of the daily plan for two consecutive days.
H05

Brand and reputational harm from poor positioning

Reputational Before 20 After 8

A positioning or campaign that is tone deaf, culturally insensitive or inconsistent with the brand promise provokes public backlash, weakens the brand and wastes the launch, damaging long term value.

Who or what is affected: Brand team, customers, employees and senior leaders

Causes

Narrow testing, fast approvals and positioning that copies competitors rather than reflecting the product.

Consequences

Public criticism, lower brand preference, staff distraction and lost launch investment.

Existing controls

  • Brand platform and tone of voice are documented and approved.
  • Major campaigns are reviewed by a senior leader before launch.

Control gaps

Testing is informal and no pause criteria are agreed before launch.

Additional controls

  • Prevent: Run a pre-launch test with a small panel of target customers and record the changes made.
  • Respond: Use a staged rollout with a pause point and prepared holding statements for each campaign.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Brand manager Target: Within 60 days Early warning: Complaints or negative comments about a campaign above the agreed weekly level.
H06

Platform, influencer and vendor dependency

Supplier Before 12 After 6

The business relies on a small number of ad platforms, creators or agencies whose rules, prices or availability change without notice, so campaigns stop, costs rise or key relationships end suddenly.

Who or what is affected: Marketing team, finance and partner businesses

Causes

Heavy reliance on one platform, creators with exclusive deals and contracts without exit terms.

Consequences

Lost reach, sudden cost increases, rushed replacements and reputational harm from broken commitments.

Existing controls

  • Contracts with main agencies include notice periods.
  • Influencer agreements set deliverables and payment dates.

Control gaps

Vendor concentration is not reported and backup options are not kept current.

Additional controls

  • Prevent: Spread spend across at least two platforms and approve any single vendor above a set share of budget.
  • Recover: Keep a tested alternative channel plan and a list of backup creators or agencies.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Marketing director Target: Within 90 days Early warning: A platform policy change notice or an agency that misses two reporting deadlines.
H07

Account compromise and credential misuse

Technology and data Before 15 After 6

Shared logins, phishing or reused passwords let outsiders take control of social, ad or email accounts, allowing them to post false messages, redirect spend or steal customer lists.

Who or what is affected: Customers, followers, the brand team and partners

Causes

Shared passwords for agencies, phishing emails and accounts with no owner after staff leave.

Consequences

False posts, redirected budgets, data theft, fines where applicable and fast loss of trust.

Existing controls

  • Accounts use individual logins where the platform allows.
  • Staff complete a short phishing awareness module each year.

Control gaps

Access lists are not reviewed when staff or agencies change, and recovery details are not checked.

Additional controls

  • Prevent: Require multi factor sign in and a password manager for every marketing account, with shared logins removed.
  • Respond: Lock compromised accounts, rotate credentials and post a verified correction within one hour.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: IT lead Target: Within 30 days Early warning: New device logins, changed recovery email addresses or failed sign in alerts on brand accounts.
H08

Privacy, consent and targeting breaches

Legal and compliance Before 15 After 8

Customer data is used for targeting or email without valid consent, sensitive traits are inferred for ad audiences, or tracking tags collect more personal data than disclosed, breaching privacy rules.

Who or what is affected: Customers, prospects, data protection regulators and the marketing team

Causes

Lists bought or merged without checks, tags added without review and targeting built on sensitive attributes.

Consequences

Complaints, enforcement action where applicable, deleted audiences and lost customer confidence.

Existing controls

  • Consent is recorded at sign up with a timestamp.
  • Unsubscribe links appear in every marketing email.

Control gaps

Consent is not linked to each source of data, and tag changes are not logged.

Additional controls

  • Prevent: Audit consent records and suppression lists before each send and exclude contacts without a clear basis.
  • Detect: Review tracking tags and audience settings quarterly against the published privacy notice.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Data protection lead Target: Within 60 days Early warning: Email sends to contacts with no recorded consent or with an open objection.

Rating method and evaluation

Each risk is rated on two five point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe, covering money, legal exposure, customer harm, brand trust and time to recover. Multiplying the two gives a score from 1 to 25 in one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score orders work and does not measure anything precisely. Inherent risk is the score before any controls. Residual risk is the score after the existing and additional controls, and it must never be higher than the inherent score. Where inherent is 10 or more, the residual must be lower. A legal or reputational risk is never rated down only because it has not yet happened. Critical and High risks need senior attention and a dated plan, Medium risks need routine controls with a named owner, and Low risks are accepted and watched. Ratings are challenged in a short review where the owner explains the evidence, a second person from another role tests the scores, and the team records any change. Ratings are also reviewed whenever a monitoring indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Published claims that lack a signed evidence file or legal sign off.Escalate to the marketing director at once, and withdraw the claim until the evidence file is complete.
Invoices or traffic reports where clicks, leads or spend do not reconcile to the agreed baseline.Escalate to the finance business partner when variance exceeds 10 percent in a month, and to the marketing director if it persists for two cycles.
Failed sign in attempts, new device logins or changed account recovery details on marketing platforms.Escalate to the IT lead within one hour, and lock the account if the activity cannot be confirmed.
Negative sentiment or complaints about a campaign above the agreed weekly level.Escalate to the brand manager when complaints double the baseline, and to the marketing director and legal lead if they reach the crisis threshold.
Email sends to contacts without recorded consent or with an open objection.Escalate to the data protection lead before the next send, and stop the send until the list is cleaned.

Contingency arrangements

If a serious event occurs, such as a misleading claim that is widely shared, a compromised account or a consent breach, the marketing director pauses the affected campaign, preserves records and informs the legal lead within the hour. The IT lead locks the account, rotates credentials and reviews recent activity. Complaints and regulator contacts are handled through legal counsel as required in the relevant jurisdiction. Holding statements are prepared in advance, and customers and partners are told what they need to know early and plainly. Budget is reallocated from paused work to the agreed recovery plan.

Prioritized action plan

  1. Introduce a claims approval step with legal sign off before any public claim, owner marketing director, within 30 days.
  2. Require a second check on media invoices and attribution reports before payment, owner finance business partner, within 45 days.
  3. Enable multi factor sign in and remove shared logins from all marketing platforms, owner IT lead, within 30 days.
  4. Audit consent records and suppression lists before the next send, owner data protection lead, within 60 days.
  5. Run a pre-launch brand test with a small audience and a staged rollout for influencer work, owner brand manager, within 60 days.

Conclusion

Dependable marketing rests on a few steady habits: claims checked before publication, budgets approved and reconciled, traffic and leads verified, accounts protected with strong sign in, and consent recorded and honored. The highest scores sit with misleading claims and brand harm, and each has actions that lower the residual score. Treat the register as a living record, review it on the stated cycle, and seek qualified legal and data protection advice for any real claim, contract or campaign decision.

Assumptions and limitations

Assumptions

  • The business sells a consumer product in one main market, and legal duties are described in general terms only because the jurisdiction is not specified.
  • Paid media, influencer work and analytics are run through third parties whose terms and tools change over time.
  • Customer data includes contact details and online identifiers, and marketing use depends on consent recorded at the point of collection.
  • Staff are trained marketers who use shared approval tools and company managed devices.

Limitations

  • The scores are examples for learning and do not describe any real brand, campaign or platform.
  • Advertising, privacy and intellectual property rules differ by country and change often, so specialist legal review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed legal, regulatory or professional advice.

Related frameworks to study

  • Risk register with likelihood and impact scoring
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Privacy by design principles
  • Brand governance and approval workflow

Marketing Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Marketing Strategy and Brand Positioning course Read the best practices for this course

More Marketing risk assessments

Hourly Active: 45,552 Learners