vaayaa Inclusive Education
Marketing risk assessment

Public Relations Strategy Risk Assessment: Reputation, Consent and Campaign Controls

A worked example of how a public relations team identifies, scores and controls risks to campaign reputation, privacy, advertising compliance, budgets and vendor dependency, from planning through ongoing monitoring.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to High
See the Public Relations Strategy course

Executive summary

This assessment shows how a public relations team can find, rate and control the risks that threaten its campaigns, its reputation and the trust of the audiences it reaches. Eight risks were chosen because they are plausible in everyday campaign work, from consent and targeting to misleading claims, account compromise and reliance on influencers and vendors. The most serious inherent risk is compromise of brand accounts, which could publish false messages in the organization's name. Each risk is scored before controls and again after existing and added controls, and most fall to Medium or Low once controls are in place. Account compromise stays High because the impact remains serious. The first actions are multi-factor sign in, a claims review step, a consent check before audience upload and a monthly attribution review. The example is for teaching, so every score shows method rather than a real organization.

Focus area
Public relations strategy and campaign management
Setting
Communications and marketing team of a mid-sized organization running multi-channel campaigns with agencies and influencers
Method
Five by five likelihood and impact risk register

Scope

This assessment covers planning, execution and monitoring of a public relations campaign run by a mid-sized organization, including media relations, owned channels, paid social, email, influencer partnerships and agency work. It looks at risks to reputation, privacy, legal compliance, budgets, data and supplier relationships. Jurisdiction, channels, budget size and organization type are not specified, so they are treated as assumptions for teaching.

Context

The team has a communications lead, two campaign managers, a data analyst and a designer, with an external agency for media buying and a small group of influencers under contract. Campaigns run across press outreach, social platforms and email lists, with analytics drawn from several tools and reports shared with leadership each month. Each risk is scored before controls to show its natural level, then again after existing controls and the controls that should be added. Scores are teaching examples, not measurements of a real organization.

Objectives, assets and stakeholders

The objective is to run campaigns that build trust, meet advertising and privacy duties, stay within budget and produce measurable results. Assets in scope include the brand and its public reputation, owned social and email accounts, audience data and consent records, the content library and creative assets, campaign budgets and the analytics that report results. Stakeholders include the communications team, leadership, the board, customers and audiences, journalists, influencers, agencies, platform providers and regulators. Every risk has one owner role, and the communications lead keeps the register current and reports to leadership each month.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H04 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H06
3 Possible Likelihood 3, impact 2, score 6, medium: H05 Likelihood 3, impact 3, score 9, medium: H03 Likelihood 3, impact 4, score 12, high: H07 Likelihood 3, impact 5, score 15, high: H02
2 Unlikely Likelihood 2, impact 5, score 10, high: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 4, score 12, high: H06
2 Unlikely Likelihood 2, impact 2, score 4, low: H03 H05 Likelihood 2, impact 3, score 6, medium: H01 H02 H04 H07 Likelihood 2, impact 4, score 8, medium: H08
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Privacy and consent breach in audience targeting 16 High 6 Medium Data protection lead
H02 Misleading claims and advertising non-compliance 15 High 6 Medium Communications lead
H03 Intellectual property infringement in creative and partner content 9 Medium 4 Low Content lead
H04 Budget overspend and attribution errors 12 High 6 Medium Finance partner
H05 Fraudulent traffic and fake leads 6 Medium 4 Low Data analyst
H06 Account compromise of brand channels 20 Critical 12 High IT manager
H07 Influencer and vendor dependency 12 High 6 Medium Campaign manager
H08 Campaign failure from weak pre-launch testing 10 High 8 Medium Communications lead
H01

Privacy and consent breach in audience targeting

Technology and data Before 16 After 6

Audience lists are built from sources without valid consent, or consent records are not matched to the people they cover, so messages reach people who never agreed to receive them.

Who or what is affected: Audience members, data subjects and the data analyst

Causes

Lists bought or copied from older campaigns, and pressure to reach wider audiences quickly.

Consequences

Complaints, regulator inquiry, possible fines and loss of audience trust.

Existing controls

  • Audience lists are stored in a restricted folder.
  • Opt out links appear in all bulk email.

Control gaps

Consent records are not linked to the individual audience files they relate to.

Additional controls

  • Prevent: Require a documented consent check before any audience upload or retargeting list is built.
  • Detect: Review audience sources each month and remove records without a valid consent basis.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Data protection lead Target: Within 45 days Early warning: Complaints about unsolicited messages or targeting rising in a single month.
H02

Misleading claims and advertising non-compliance

Legal and compliance Before 15 After 6

Public messages state results, benefits or endorsements that cannot be supported by evidence, or omit conditions that a reasonable audience would need to know to judge them.

Who or what is affected: Customers, regulators and the organization

Causes

Pressure for strong results, vague wording and unchecked statistics supplied by partners.

Consequences

Forced correction, complaints, possible penalties and reputational damage.

Existing controls

  • Creative is approved by the communications lead before launch.
  • Testimonials are kept on file with the source.

Control gaps

Evidence is not stored with each claim, and reviewers do not check influencer copy.

Additional controls

  • Prevent: Build a claims substantiation review that matches each claim to evidence before publication.
  • Respond: Withdraw and correct any claim found to be unsupported within one working day.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: Communications lead Target: Within 30 days Early warning: Drafts containing claims that have no linked evidence file.
H03

Intellectual property infringement in creative and partner content

Legal and compliance Before 9 After 4

Images, music, fonts or video used in campaigns are reused without a licence, or partners post content whose rights have not been cleared for the organization to use.

Who or what is affected: Creators, rights holders and the designer

Causes

Images found online, music added without a licence and unclear rights in partner content.

Consequences

Takedown demands, licence fees, legal claims and public embarrassment.

Existing controls

  • Stock images are bought from licensed libraries.
  • Designers keep a record of source files.

Control gaps

Influencer content is posted by partners without a rights check.

Additional controls

  • Prevent: Require written content rights and licence terms from every influencer, agency and freelancer before use.
  • Detect: Run a reverse image check on new creative before it goes live.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Content lead Target: Within 60 days Early warning: Partner content that arrives without a licence or source record.
H04

Budget overspend and attribution errors

Financial Before 12 After 6

Paid spend runs ahead of approved budgets, or results are credited to the wrong channel because tracking tags are wrong, so decisions about future budgets rest on false evidence.

Who or what is affected: Finance partner, leadership and campaign managers

Causes

Automated bidding, unclear tracking tags and results credited to the last click only.

Consequences

Money wasted, decisions based on false results and weaker future budgets.

Existing controls

  • Campaign budgets are set in a shared spreadsheet.
  • Platform spend reports are checked at the end of each campaign.

Control gaps

Attribution settings are not checked after a platform change.

Additional controls

  • Prevent: Set daily spend caps and approval limits for every paid channel.
  • Detect: Reconcile platform reports with the finance ledger each month and explain any gaps.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Finance partner Target: Within 45 days Early warning: Spend running above the daily cap, or unexplained gaps between platform reports and the ledger.
H05

Fraudulent traffic and fake leads

Financial Before 6 After 4

Bots, click farms and incentivized sign ups inflate traffic and lead counts, so paid spend buys contacts who have no real interest and results look better than they are.

Who or what is affected: Campaign managers and the finance partner

Causes

Click farms, bots and incentivized sign ups on open forms.

Consequences

Wasted spend, inflated results and poor sales follow up.

Existing controls

  • Lead forms require a verified email address.
  • Campaign reports exclude visits lasting only a few seconds.

Control gaps

Traffic quality is not measured separately from total traffic.

Additional controls

  • Detect: Compare lead sources against known bot patterns and remove duplicate or suspicious entries.
  • Respond: Pause the source and request a credit from the provider when fake traffic is confirmed.
Likelihood 3 x impact 2 before; 2 x 2 after Owner: Data analyst Target: Within 90 days Early warning: A sudden rise in leads from one source with very low engagement.
H06

Account compromise of brand channels

Technology and data Before 20 After 12

An attacker gains control of a brand social or email account through phishing, reused passwords or a former employee's access, and publishes false or harmful messages in the organization's name.

Who or what is affected: Followers, customers, staff and partners

Causes

Phishing messages, reused passwords and former staff keeping access.

Consequences

False messages published in the brand name, lost accounts and an urgent crisis response.

Existing controls

  • Shared passwords are stored in a managed vault.
  • Posting rights are limited to named campaign staff.

Control gaps

Access is not reviewed when staff change roles or leave.

Additional controls

  • Prevent: Enforce multi-factor sign in and remove shared logins from every brand channel.
  • Detect: Alert on new device logins, password resets and posts made outside working hours.
  • Recover: Keep a tested account recovery plan with platform contacts and backup administrators.
Likelihood 4 x impact 5 before; 3 x 4 after Owner: IT manager Target: Within 30 days Early warning: Failed sign in attempts or unexpected posts from a new device.
H07

Influencer and vendor dependency

Supplier Before 12 After 6

The campaign relies on one agency or a small group of influencers, so a partner that fails, leaves or breaks the agreed terms can stop activity and leave the organization without assets.

Who or what is affected: Brand team, agencies, influencers and campaign staff

Causes

Reliance on one agency or a few influencers, and platforms that change rules without notice.

Consequences

Campaign delays, lost assets, cost overruns and public disputes.

Existing controls

  • Contracts set out deliverables and payment terms.
  • Key partners are named in the campaign plan.

Control gaps

Partner performance is not measured against the contract until the campaign ends.

Additional controls

  • Prevent: Use contracts with exit terms, content ownership clauses and a backup partner for each channel.
  • Respond: Move work to the backup partner and retrieve assets when a partner fails or leaves.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Campaign manager Target: Within 60 days Early warning: A partner that misses two deadlines in a row.
H08

Campaign failure from weak pre-launch testing

Reputational Before 10 After 8

A campaign launches with a message, timing or audience that has not been tested, so it lands badly with the public, draws criticism and wastes the investment made in it.

Who or what is affected: Audiences, leadership and the communications team

Causes

Rushed timelines, unclear audiences and messages that ignore current events.

Consequences

Public backlash, lost trust and wasted investment.

Existing controls

  • Major campaigns have a leadership sign off.
  • Key messages are tested with a small group before launch.

Control gaps

Tests use friendly groups and do not include critics or the people most affected by the message.

Additional controls

  • Prevent: Run a pre-launch checklist covering message, timing, audience and sensitive topics.
  • Detect: Track sentiment and reaction during the first 48 hours and report any sharp shift.
Likelihood 2 x impact 5 before; 2 x 4 after Owner: Communications lead Target: Within 60 days Early warning: Negative reaction rising sharply in the first two days after launch.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe, covering reputation, money, legal exposure, audience harm and time to recover. Multiplying the two gives a score from 1 to 25, placed in one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides priority and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls, and it must never be higher than the inherent score. Reputational and legal impacts are not rated down simply because they have not happened yet. Critical and High residual risks need senior attention and a dated plan, Medium risks need routine controls with a named owner, and Low risks are accepted and monitored. Campaign staff challenge every rating in a short review before launch, and an independent colleague who did not build the campaign checks any High or Critical score. Ratings are reopened when an indicator reaches its threshold or when a campaign changes channel, audience or budget.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Failed sign in attempts or new device logins on brand social accounts.Escalate to the IT manager at once when repeated failures occur, and to the communications lead if any post is made without approval.
Campaign spend that exceeds the approved budget by more than 10 percent.Escalate to the finance partner the same day, and pause the spend until the campaign manager and finance partner agree on a revised plan.
Share of leads or traffic from sources that fail verification checks.Escalate to the data analyst when the share rises above the agreed limit, and to the campaign manager if it stays high for a week.
Complaints about targeting, consent or unsolicited messages received in a month.Escalate to the data protection lead within two working days of any complaint, and to leadership if complaints rise in a single month.
Influencer or agency posts published without the agreed disclosure or rights check.Escalate to the campaign manager at once, take the post down if it breaches terms, and review the partner within a week.

Contingency arrangements

If a serious event occurs, such as a hijacked account, a misleading claim made public or a privacy complaint, the communications lead pauses related paid activity and scheduled posts within the hour. The IT manager locks affected accounts, resets credentials and preserves logs. The legal adviser is consulted on any correction or complaint, and the statement is approved by leadership before release. Audience data is isolated, and any influencers or agencies involved are told in writing what to stop. Updates are shared plainly with staff and the public, and the campaign is reviewed before it restarts.

Prioritized action plan

  1. Enforce multi-factor sign in and shared account ownership on all brand channels, owner IT manager, within 30 days.
  2. Add a claims and substantiation review before any public message is published, owner communications lead, within 30 days.
  3. Require a consent check before any audience upload or retargeting list is built, owner data protection lead, within 45 days.
  4. Reconcile campaign spend and attribution each month with a second reviewer, owner finance partner, within 60 days.
  5. Verify influencer and agency contracts, disclosure terms and content rights, owner campaign manager, within 60 days.

Conclusion

Effective public relations rests on a few steady habits: checking claims and consent before launch, controlling who can post, reviewing budgets and attribution monthly, and knowing who is responsible for each channel. The highest inherent scores sit with account compromise, targeting and consent, misleading claims and budget attribution, and each has controls that lower the residual score. Treat the register as a living record, review it on the stated cycle, and seek qualified legal and privacy advice for any real advertising, data or intellectual property question.

Assumptions and limitations

Assumptions

  • The organization operates in one jurisdiction, so advertising and privacy duties are described only in general terms.
  • Campaigns use paid social, owned email lists and influencers who work under written contracts.
  • The team uses a shared content calendar, managed devices and a central analytics tool.
  • Agency and influencer partners handle some audience data under agreed terms.

Limitations

  • The scores are examples for learning and do not describe any real campaign or organization.
  • Advertising, privacy and intellectual property rules vary by country and change over time, so specialist legal review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed legal advice.

Related frameworks to study

  • Plan, do, check, act improvement cycle
  • Risk register with likelihood and impact scoring
  • Hierarchy of controls

Marketing Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Public Relations Strategy course Read the best practices for this course

More Marketing risk assessments

Hourly Active: 45,552 Learners