vaayaa Inclusive Education
Marketing risk assessment

Digital Marketing and Online Advertising Risk Assessment: Claims, Privacy, Fraud and Platform Controls

A worked example of how a marketing team finds, scores and controls the risks in digital and online advertising, from misleading claims and privacy breaches to fake traffic, account takeover and platform dependency.

Updated November 2026 8 hazards assessed Review every 3 months Highest risk: High to Medium
See the Digital Marketing and Online Advertising course

Executive summary

This assessment shows how a marketing team can find, rate and control the risks in digital and online advertising before they damage customers, budgets or the brand. Eight risks were chosen because they are plausible in everyday campaign work. Misleading claims and privacy or targeting errors carry the highest inherent scores because they can lead to complaints, enforcement attention and lost trust. Account compromise also scores high because it can change live ads within minutes. Fraudulent traffic, overspend and attribution mistakes are more common and drain money steadily. Each risk is scored before controls and again after existing and added controls. Most risks fall to Low or Medium once checks are in place, while privacy and claims risks stay at Medium because the impact remains serious. The first actions are a claims check before launch, a consent check for every audience, multi-factor sign in for all ad accounts and a daily spend cap. The business is a teaching example, so the scores illustrate method rather than describe any real organization.

Focus area
Digital marketing and online advertising
Setting
In-house marketing team of a mid-sized consumer brand running paid search, social, display and influencer campaigns through agencies and ad platforms
Method
Five by five likelihood and impact campaign risk register

Scope

This assessment covers paid search, social, display, email and influencer campaigns, from brief and creative through targeting, launch, spend, measurement and reporting. It looks at risks to customers, budgets, personal data, brand trust and legal duties. It does not cover legal advice on any real advertisement. Jurisdiction, ad platforms, data sources and team size are assumptions made for teaching.

Context

The brand has a marketing team of six, a finance business partner, a small privacy and legal support function and an external creative agency. Campaigns run on several major ad platforms, use tracking tags and customer lists, and sometimes pay creators to promote products. Performance is reported monthly to the leadership team. Each risk is scored before controls to show its natural level, then again after the existing controls and the additional controls that should be added. The scores help the team decide where to act first.

Objectives, assets and stakeholders

The objective is to run campaigns that are truthful, lawful, respectful of personal data and efficient with budget, while protecting the brand and the trust of customers, partners and the platforms used. Assets in scope include ad accounts and login credentials, audience and customer data, creative and copy, media budgets, tracking tags and conversion data, brand reputation, and the contracts with agencies, creators and vendors. Stakeholders include the marketing team, the finance business partner, the legal and privacy leads, agencies and creators, customers who see or respond to advertising, and the platforms that host the campaigns. Each risk has one owner role, and the head of marketing keeps the register current and reports to the leadership team each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H03 Likelihood 4, impact 4, score 16, high: H01 H02
3 Possible Likelihood 3, impact 3, score 9, medium: H08 Likelihood 3, impact 4, score 12, high: H04 H07 Likelihood 3, impact 5, score 15, high: H05
2 Unlikely Likelihood 2, impact 4, score 8, medium: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H03
2 Unlikely Likelihood 2, impact 2, score 4, low: H04 H06 H08 Likelihood 2, impact 3, score 6, medium: H01 H05 H07 Likelihood 2, impact 4, score 8, medium: H02
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Misleading or unsubstantiated advertising claims 16 High 6 Medium Brand manager
H02 Privacy, consent and targeting breaches 16 High 8 Medium Privacy lead
H03 Budget overspend and attribution errors 12 High 6 Medium Finance business partner
H04 Fraudulent traffic and fake leads 12 High 4 Low Head of paid media
H05 Account compromise and unauthorized changes 15 High 6 Medium Security lead
H06 Intellectual property infringement in creative and influencer content 8 Medium 4 Low Legal counsel
H07 Platform, influencer and vendor dependency 12 High 6 Medium Procurement lead
H08 Brand and reputational harm from influencer conduct or public response 9 Medium 4 Low Brand manager
H01

Misleading or unsubstantiated advertising claims

Legal and compliance Before 16 After 6

Ad copy, landing pages or influencer posts make price, performance, health, environmental or comparative claims that cannot be backed by evidence, or that leave out material terms, so customers are misled about what they will get.

Who or what is affected: Customers, competitors and the brand's legal team

Causes

Pressure for strong results, fast creative turnaround and claims copied from old briefs.

Consequences

Complaints, takedowns, withdrawn ads, enforcement attention and loss of customer trust.

Existing controls

  • Copy is approved by the brand manager before launch.
  • Product claims are listed in a shared approved claims sheet.

Control gaps

Influencer posts and agency edits are not always checked against the approved claims sheet.

Additional controls

  • Prevent: Require a substantiation file for every performance, price and comparative claim before launch.
  • Detect: Run a monthly sample of live ads and landing pages against the approved claims sheet.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Brand manager Target: Within 30 days Early warning: Ads submitted without a completed claims check or with an open substantiation query.
H02

Privacy, consent and targeting breaches

Technology and data Before 16 After 8

Audiences are built from personal data without a clear consent basis, sensitive traits are inferred or targeted, or tracking pixels collect more data than disclosed, breaching privacy expectations and the rules that apply.

Who or what is affected: Customers, prospects and the privacy team

Causes

Broad audience tools, weak consent records and agencies that set up tags without review.

Consequences

Regulatory inquiry, complaints, deleted audiences, platform restrictions and loss of customer trust.

Existing controls

  • The privacy notice describes online tracking in general terms.
  • Customer lists are uploaded only by the CRM team.

Control gaps

Consent status is not stored alongside audience files, so checks are manual and easy to skip.

Additional controls

  • Prevent: Restrict targeting to approved audience categories and block sensitive attributes in every campaign.
  • Detect: Audit tag firing and audience sources each quarter against the consent record.
Likelihood 4 x impact 4 before; 2 x 4 after Owner: Privacy lead Target: Within 30 days Early warning: Audiences built from sources without a recorded consent basis.
H03

Budget overspend and attribution errors

Financial Before 12 After 6

Spend runs beyond the planned budget through automated bidding, missing caps or duplicate campaigns, while conversion tracking double counts results, so the team keeps investing in channels that do not really perform.

Who or what is affected: Finance team, campaign managers and the leadership team

Causes

Automated bidding left unchecked, unclear attribution windows and overlapping campaigns.

Consequences

Wasted spend, misleading return figures and poor budget decisions.

Existing controls

  • Monthly budgets are set for each channel.
  • Platform billing alerts are sent to the campaign manager.

Control gaps

Attribution settings differ across platforms and are not documented in one place.

Additional controls

  • Prevent: Set daily caps and a hard monthly limit on every account and bidding strategy.
  • Detect: Reconcile platform spend to finance records weekly and review conversion sources for double counting.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Finance business partner Target: Within 45 days Early warning: Daily spend above the agreed cap, or conversions rising sharply with no matching sales.
H04

Fraudulent traffic and fake leads

Financial Before 12 After 4

Bots, click farms or fake form submissions inflate clicks and leads, so budget is paid for visits and enquiries that never convert, and sales staff chase contacts that do not exist.

Who or what is affected: Campaign managers, sales team and finance

Causes

Open placements, incentivized traffic and lead forms without strong verification.

Consequences

Wasted spend, distorted results and sales time lost on false leads.

Existing controls

  • Platform invalid traffic filters are switched on.
  • Lead forms use a basic verification step.

Control gaps

Placement reports are reviewed only when results look poor, so slow fraud goes unnoticed.

Additional controls

  • Prevent: Block known poor quality sources and add a verified contact step to every lead form.
  • Detect: Compare click quality, time on site and lead acceptance rates by placement each week.
Likelihood 3 x impact 4 before; 2 x 2 after Owner: Head of paid media Target: Within 30 days Early warning: Clicks from one placement with very short visits and almost no completed forms.
H05

Account compromise and unauthorized changes

Technology and data Before 15 After 6

Ad accounts, tag managers or agency logins are taken over or shared, so attackers or former staff change budgets, bids, audiences or landing pages, and push false or malicious ads to the public.

Who or what is affected: Customers, finance team and the brand's reputation

Causes

Phishing, reused passwords, shared logins and agency staff with broad access.

Consequences

Stolen budget, malicious ads, leaked customer data and public embarrassment.

Existing controls

  • Accounts are protected with individual logins.
  • Former staff access is removed when they leave the team.

Control gaps

Agency accounts are not included in the regular access review.

Additional controls

  • Prevent: Enforce multi-factor sign in and least privilege roles on all ad, tag and billing accounts.
  • Respond: Keep a runbook to freeze accounts, rotate credentials and pause all live ads within one hour.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: Security lead Target: Within 14 days Early warning: Logins from new locations or devices, or unexpected changes to billing or user roles.
H06

Intellectual property infringement in creative and influencer content

Legal and compliance Before 8 After 4

Images, music, fonts, logos or trademarks are used without a licence, or creators reuse competitor material, so the brand faces takedown demands, payment claims and disputes over who owns campaign assets.

Who or what is affected: Creators, agencies and the brand's legal team

Causes

Unlicensed assets found online and loose contract terms with creators.

Consequences

Takedown demands, settlement costs and forced rebranding of campaigns.

Existing controls

  • Agencies confirm in writing that creative work is original.
  • Stock assets are bought through the marketing team's central account.

Control gaps

Usage rights expire without notice, so assets stay live after the licence has ended.

Additional controls

  • Prevent: Require licence records and usage rights in every creator and agency contract before work starts.
  • Detect: Run a reverse image and music check on final creative before it is published.
Likelihood 2 x impact 4 before; 2 x 2 after Owner: Legal counsel Target: Within 60 days Early warning: Creative assets without a licence record or with a usage term that has already passed.
H07

Platform, influencer and vendor dependency

Supplier Before 12 After 6

The business relies on a few ad platforms, creators or agencies that change policies, raise prices, close accounts or fail, so campaigns stop without warning and audience data may not move with the business.

Who or what is affected: Marketing team, sales team and leadership

Causes

Heavy reliance on one platform or one agency, and policy changes announced at short notice.

Consequences

A sudden drop in leads, lost audience data and high costs of switching suppliers.

Existing controls

  • Two agencies share the day to day campaign workload.
  • Core customer data is held in the business's own system.

Control gaps

Contract exit terms and data return rights have not been reviewed since signing.

Additional controls

  • Prevent: Spread spend across at least two platforms and write exit and data return terms into every vendor contract.
  • Respond: Keep a backup channel plan with budget ready to move within one week.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Procurement lead Target: Within 60 days Early warning: Platform policy notices or account warnings received without a named owner reviewing them.
H08

Brand and reputational harm from influencer conduct or public response

Reputational Before 9 After 4

A creator or partner behaves badly, a campaign causes offence, or public comments on a post are mishandled, so the brand is linked to the problem and public sentiment turns against it quickly.

Who or what is affected: Brand, customers and the marketing team

Causes

Creators with hidden controversies, edgy creative and slow responses outside office hours.

Consequences

Negative press, boycott calls, lost customers and stress for staff.

Existing controls

  • Creators sign a conduct clause before any campaign starts.
  • Comments on brand posts are monitored during business hours.

Control gaps

Monitoring does not cover weekends or private messages sent to the brand account.

Additional controls

  • Prevent: Screen creators for past conduct and check every campaign message against the brand values guide.
  • Respond: Use an approved response plan with a holding statement and a single named spokesperson.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Brand manager Target: Within 45 days Early warning: A spike in negative comments or mentions of the brand within a short period.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe, covering money spent, legal exposure, customer harm and brand damage. Multiplying the two gives a score from 1 to 25. Low is 1 to 4, Medium is 5 to 9, High is 10 to 16 and Critical is 17 to 25. Inherent risk is the score before any controls, judged as if nothing were in place. Residual risk is the score after the existing and added controls are working. A residual score can never be higher than the inherent score, and where inherent is 10 or more the residual must be lower. Scores are a guide for ordering work, not a measurement. Critical items pause activity until a senior owner signs off. High items need a dated plan and monthly review. Medium items need routine controls and a named owner. Low items are accepted and watched. Ratings are challenged by the people running campaigns, by a second reviewer who did not set the score, and whenever an early warning indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 3 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Ads submitted without a completed claims check or with an open substantiation query.Escalate to the head of marketing before launch. Hold any ad that fails the check until the owner signs it off.
Audiences built from sources without a recorded consent basis.Escalate to the privacy lead within one working day, and pause the audience until the consent basis is confirmed.
Logins from new locations or devices on ad accounts, or unexpected changes to billing or user roles.Escalate to the security lead at once, and to the head of marketing if the account is not secured within two hours.
Daily spend above the agreed cap, or conversions rising sharply with no matching sales.Escalate to the finance business partner the same day, and pause the campaign if the cap is breached on two days in one week.
Customer complaints or platform reports about an ad, an influencer post or a public comment about the brand.Escalate to the brand manager within one working day, and to legal counsel for any complaint about claims or privacy.

Contingency arrangements

If a serious event occurs, such as a platform or regulator complaint, a confirmed account takeover, a privacy incident or a large unexplained spend, the head of marketing pauses the affected campaigns and preserves the records. The security lead locks the account, rotates credentials and reviews recent changes. The privacy lead assesses whether personal data was exposed and decides whether notification is needed under the rules that apply. Legal counsel reviews any public statement, and customer service receives a short approved script. Spend is reclaimed through platform support where possible, and the finance business partner records the loss.

Prioritized action plan

  1. Introduce a claims and substantiation check before any ad goes live, owner head of marketing, within 30 days.
  2. Confirm the consent basis and source of every targeting segment, owner privacy lead, within 30 days.
  3. Enforce multi-factor sign in and access reviews on all ad and tag accounts, owner security lead, within 14 days.
  4. Set daily spend caps and a weekly reconciliation of platform spend to finance records, owner finance business partner, within 45 days.
  5. Review agency, creator and vendor contracts for exit terms and data handling, owner procurement lead, within 60 days.

Conclusion

Dependable advertising rests on a few steady habits: checking claims before launch, confirming consent for every audience, protecting accounts with strong sign in, setting spend guardrails and treating attribution figures with care. The highest scores sit with misleading claims, privacy and targeting errors and account compromise, and each has actions that bring its residual score down. Keep the register alive, review it on the stated cycle and seek qualified legal or privacy advice for any real advertising, data or intellectual property question.

Assumptions and limitations

Assumptions

  • The business advertises to consumers in one jurisdiction that is not specified, so legal duties are described in general terms only.
  • Campaigns run on several major ad platforms, use tracking tags and work with at least one agency and some paid creators.
  • The marketing team can reach a privacy or legal adviser within one working day when a question arises.

Limitations

  • The scores are examples for learning and do not describe any real campaign, brand or platform.
  • Advertising, data protection and intellectual property rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not legal, privacy or financial advice.

Related frameworks to study

  • Three lines model of risk ownership
  • Hierarchy of controls
  • Consent and preference management principles

Marketing Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Digital Marketing and Online Advertising course Read the best practices for this course

More Marketing risk assessments

Hourly Active: 39,499 Learners