vaayaa Inclusive Education
Professional risk assessment

Marketing, Advertising and Public Relations Risk Assessment: Claims, Data and Campaign Controls

A worked example of how a marketing and public relations team finds, scores and controls the risks behind campaign claims, customer data, ad spend, accounts and public reputation, with owners and early warning signs for each.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Marketing, Advertising and Public Relations course

Executive summary

This assessment shows how a marketing and public relations team can find, score and control the risks that matter most to its campaigns, customers and reputation. Eight risks were chosen because they are plausible in everyday campaign work. Public response failure carries the highest inherent score, followed by misleading claims and privacy breaches, because each can reach many people quickly. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once the added controls are in place, but the reputational risk stays at Medium because public attention can change quickly. The first actions are a substantiation file for every claim, consent checks before audience uploads, multi-factor sign in for all accounts and a fast response rota. The business is a teaching example, so every score illustrates method, not a real organization.

Focus area
Marketing, advertising and public relations
Setting
In-house marketing team of a mid-sized consumer products business running paid, owned and earned campaigns
Method
Five by five likelihood and impact risk register

Scope

This assessment covers planning, creating, launching and measuring campaigns, including paid advertising, influencer work, email and social content, media relations and crisis messages. It looks at risks to accuracy, customer trust, legal duties, budget and brand. It does not give advice on any particular law or any real campaign. Jurisdiction, audience, platforms and budget size are assumptions made for teaching.

Context

The team includes a brand manager, a performance marketing lead, a content team, a public relations manager and a data analyst. Agencies and influencers are engaged under written briefs. Paid campaigns run through business accounts on several advertising platforms, customer data is held in a customer relationship system, and results are reported through analytics dashboards. Each risk is scored before controls to show its natural level, then again after the existing controls and the controls that should be added.

Objectives, assets and stakeholders

The objective is to run campaigns that are accurate, lawful, cost effective and trusted, while protecting customer data, creative assets and the brand. The assets in scope are advertising and social accounts, customer data, creative files and licences, campaign budgets, and the brand reputation. Stakeholders include the marketing and public relations teams, finance staff, senior leaders, customers, influencers, agencies, platforms and regulators. Each risk has one owner role, and the brand manager keeps the register current and reports to senior leaders each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H04 Likelihood 4, impact 4, score 16, high: H01 H02 Likelihood 4, impact 5, score 20, critical: H06
3 Possible Likelihood 3, impact 3, score 9, medium: H03 H07 Likelihood 3, impact 4, score 12, high: H05 H08
2 Unlikely
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H04
2 Unlikely Likelihood 2, impact 2, score 4, low: H03 H08 Likelihood 2, impact 3, score 6, medium: H01 H02 H05 H07 Likelihood 2, impact 4, score 8, medium: H06
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Misleading claims and campaign failure 16 High 6 Medium Brand manager with specialist legal review
H02 Privacy, consent and targeting breaches 16 High 6 Medium Data analyst with privacy officer
H03 Intellectual property and licensing infringement 9 Medium 4 Low Content lead
H04 Budget overspend and attribution errors 12 High 6 Medium Performance marketing lead
H05 Fraudulent traffic and fake leads 12 High 6 Medium Digital analyst
H06 Brand and reputational harm from a public response failure 20 Critical 8 Medium Public relations manager
H07 Platform, influencer and vendor dependency 9 Medium 6 Medium Brand manager
H08 Account compromise of advertising and social accounts 12 High 4 Low IT manager
H01

Misleading claims and campaign failure

Legal and compliance Before 16 After 6

Product benefits, prices, test results or endorsements are stated in a way that overstates what is true or can be substantiated, so the advertising misleads the audience and may be withdrawn after launch.

Who or what is affected: Consumers, brand team, legal reviewers and regulators

Causes

Pressure to hit launch dates, vague briefs, unsupported comparisons and copy edited after approval.

Consequences

Complaints, forced withdrawal of the campaign, fines where applicable, lost trust and wasted spend.

Existing controls

  • Creative briefs list the product claims that are approved for use.
  • A senior marketer reviews headlines and calls to action before publication.

Control gaps

Substantiation files are kept for major campaigns only, and small edits are not re-checked.

Additional controls

  • Prevent: Hold a written substantiation file for every factual claim and have it checked before any launch.
  • Detect: Run a post launch review of ads and landing pages against the approved claims list.
  • Respond: Pause any ad that cannot be supported and issue a correction through the same channel.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Brand manager with specialist legal review Target: Within 30 days Early warning: Consumer complaints or platform rejections that mention a product claim.
H02

Privacy, consent and targeting breaches

Technology and data Before 16 After 6

Personal data is used for targeting or messages without valid consent, data is shared with a vendor without a written agreement, or sensitive traits are inferred and used to select audiences.

Who or what is affected: Customers, data analysts, agencies and the privacy officer

Causes

Lists built from old forms, ad platform tools that match data, and weak checks on vendor handling.

Consequences

Regulatory action, customer complaints, deleted audiences and public criticism.

Existing controls

  • Marketing emails are sent only to contacts with a recorded opt in.
  • Vendors receive customer lists through a shared folder with restricted access.

Control gaps

The consent register is not linked to ad platform audiences, so withdrawn consent may still be used.

Additional controls

  • Prevent: Record consent purpose and date for every contact and block sends to records without consent.
  • Detect: Compare audience uploads against the consent register before each campaign goes live.
  • Recover: Stop use of any data found to be unlawfully held and notify the privacy officer at once.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Data analyst with privacy officer Target: Within 30 days Early warning: Opt out requests not processed within the agreed service time.
H03

Intellectual property and licensing infringement

Legal and compliance Before 9 After 4

Images, music, fonts, models or user generated content are used without a licence, or a trademark is used in a way that copies a competitor or breaches a name rights agreement.

Who or what is affected: Creative team, rights holders and the business

Causes

Assets reused from old campaigns, licences that expire, and social content shared without permission.

Consequences

Takedown demands, settlement costs and changes to a launched campaign.

Existing controls

  • Stock assets are bought from licensed libraries with a usage record.
  • Agencies confirm in contracts that they own the work they deliver.

Control gaps

The licence register is not updated when assets are reused in new channels.

Additional controls

  • Prevent: Keep a licence register listing each asset, its licence terms and its expiry.
  • Detect: Check new creative against a trademark search before it is published.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Content lead Target: Within 60 days Early warning: An asset in use past its licence expiry date listed in the register.
H04

Budget overspend and attribution errors

Financial Before 12 After 6

Campaign spend runs beyond the agreed cap because bids and budgets are not watched, and sales are credited to the wrong channel, so the team funds activity that does not work.

Who or what is affected: Finance team, performance marketing lead and senior leadership

Causes

Automated bidding, multiple tracking tags, and results judged only by platform reports.

Consequences

Wasted budget, poor decisions, overstated returns and friction with finance.

Existing controls

  • Each platform has a monthly budget set in the planning sheet.
  • Performance is reviewed in a weekly marketing meeting.

Control gaps

Attribution settings are changed without notice and no one compares them with sales.

Additional controls

  • Prevent: Set daily spend caps and alerts on every paid account before launch.
  • Detect: Reconcile platform reported results with the sales ledger each month and log differences.
  • Respond: Reallocate spend from channels whose results cannot be verified.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Performance marketing lead Target: Within 30 days Early warning: Spend that exceeds the planned figure by more than ten percent in a week.
H05

Fraudulent traffic and fake leads

Financial Before 12 After 6

Bots, click farms or fake form fills inflate clicks and leads, so paid budget is spent on traffic that never buys and the reported results look better than they are.

Who or what is affected: Finance team, sales team and performance marketing lead

Causes

Open forms, weak source filters and incentives paid per lead to third parties.

Consequences

Lost budget, misleading performance reports and sales time wasted on invalid leads.

Existing controls

  • Platform invalid click filters are switched on for paid search.
  • Lead forms ask for a phone number before submission.

Control gaps

Lead quality is judged by volume, and invalid traffic is not reported to the platform.

Additional controls

  • Prevent: Add a verification step to lead forms and block known bad sources at the site level.
  • Detect: Track the share of leads that become qualified sales each week and flag sudden drops.
  • Recover: Request credits from the platform for traffic that is shown to be invalid.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Digital analyst Target: Within 45 days Early warning: A sudden rise in form submissions from one source with no matching sales follow up.
H06

Brand and reputational harm from a public response failure

Reputational Before 20 After 8

A poorly judged post, a misread trend, an offensive creative or a slow reply to a complaint spreads quickly, and the brand is seen as careless, insincere or unkind.

Who or what is affected: Brand team, public relations manager, customers and staff

Causes

Trend jacking, pressure for fast posts, unclear approval for replies and a lack of testing with real audiences.

Consequences

Lost customers, media criticism, boycott calls and staff morale loss.

Existing controls

  • A brand voice guide sets tone and words to avoid.
  • Social posts are approved by the brand manager before publishing.

Control gaps

Replies to comments are written by junior staff without a review path for sensitive topics.

Additional controls

  • Prevent: Run a cultural and accessibility check on every creative brief before production.
  • Detect: Monitor mentions and sentiment across channels with an agreed daily review.
  • Respond: Hold a holding statement and a spokesperson rota ready for fast use.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Public relations manager Target: Within 30 days Early warning: Negative mentions rising sharply within one day or a complaint shared by a large account.
H07

Platform, influencer and vendor dependency

Supplier Before 9 After 6

The business relies on one ad platform, one agency or a few influencers, so a policy change, contract failure, sudden account ban or a poor creator choice can stop the whole plan at once.

Who or what is affected: Marketing team, agencies, influencers and business revenue

Causes

Concentrated spend, weak exit terms and reliance on a single creator for reach.

Consequences

Sudden loss of reach, breach of disclosure duties, costly exit fees and missed launches.

Existing controls

  • Agency contracts include notice periods and delivery standards.
  • Influencer briefs require disclosure of paid partnerships.

Control gaps

No one tracks platform policy updates or the terms that allow an agency to leave.

Additional controls

  • Prevent: Spread budget across at least two platforms and keep a tested alternative agency shortlist.
  • Detect: Check influencer audiences and disclosures before each contract and during the campaign.
  • Recover: Keep creative files in company storage so campaigns can move to another channel quickly.
Likelihood 3 x impact 3 before; 2 x 3 after Owner: Brand manager Target: Within 60 days Early warning: A platform policy notice or a vendor delay that puts a launch date at risk.
H08

Account compromise of advertising and social accounts

Technology and data Before 12 After 4

Shared passwords, phishing or a stolen session let an outsider post false messages, change ad settings, spend budget or lock the business out of its own accounts.

Who or what is affected: Customers, marketing staff, finance team and the public

Causes

Phishing messages, staff leaving with access and logins shared in chat tools.

Consequences

False posts, spend loss, data exposure and public embarrassment.

Existing controls

  • Each platform account has a named administrator.
  • Passwords are stored in a company password manager.

Control gaps

Access is not removed promptly when staff change roles or leave.

Additional controls

  • Prevent: Require multi-factor sign in and remove shared logins for all advertising and social accounts.
  • Detect: Review login history and new admin users each week.
  • Respond: Disable access at once, change credentials and post a verified notice to the audience.
Likelihood 3 x impact 4 before; 2 x 2 after Owner: IT manager Target: Within 30 days Early warning: A new admin user, a password reset or a login from an unfamiliar location.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls. Impact is judged on customer harm, legal exposure, money lost, time to correct and damage to trust. A reputational or legal risk is never rated down only because it has not yet happened. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Team members who do the work should challenge the ratings, and each risk is reviewed whenever its indicator reaches the threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Product claims flagged by consumers or rejected by platforms in a month.Escalate to the brand manager when any claim is flagged, and to senior leaders if two or more are flagged in one campaign.
Audience uploads that include records without a recorded consent.Escalate to the privacy officer at once, and hold the audience until the records are cleared.
Spend more than ten percent above plan in a week on any paid account.Escalate to the performance marketing lead the same day, and to the finance team if the overspend continues for three days.
Negative mentions rising sharply within one day or a complaint shared by a large account.Escalate to the public relations manager at once, and to senior leaders if the response is not agreed within four hours.
New admin users or password resets on any advertising or social account.Escalate to the IT manager at once, and disable the access until the change is confirmed by the account owner.

Contingency arrangements

If a serious event occurs, such as a false claim in market, a data breach or a hijacked account, the brand manager pauses related campaigns and preserves records. The IT manager locks affected accounts and restores settings from the approved record. The public relations manager issues a verified holding statement and passes legal questions to specialist advisers. Spend is frozen until the cause is confirmed, and staff and customers are told what they need to know early and plainly.

Prioritized action plan

  1. Introduce a substantiation file and legal sign off for every product claim, owner brand manager, within 30 days.
  2. Enable multi-factor sign in and remove shared logins for all advertising and social accounts, owner IT manager, within 30 days.
  3. Link the consent register to audience uploads and block sends without consent, owner data analyst, within 30 days.
  4. Set spend caps and reconcile platform results with sales each month, owner performance marketing lead, within 45 days.
  5. Prepare a holding statement and a spokesperson rota for fast public response, owner public relations manager, within 30 days.

Conclusion

Trusted marketing depends on a few steady habits: substantiated claims, consent checks before every audience, verified spend and leads, secure accounts and a practised response plan. The highest scores sit with public response, claims and privacy, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified legal and privacy advice for any real advertising or data question.

Assumptions and limitations

Assumptions

  • The business sells consumer products to adults in one main market, and jurisdiction is not specified, so legal duties are described in general terms.
  • Paid campaigns run on several large advertising platforms through business accounts managed by the marketing team.
  • Agencies and influencers work under written briefs and contracts that the business reviews before launch.
  • Customer data is collected through website forms and loyalty sign ups, with consent recorded in the customer relationship system.

Limitations

  • The scores are examples for learning and do not describe any real campaign, brand or market.
  • Advertising, privacy and intellectual property rules differ by country and change over time, so specialist legal review is needed.
  • This is educational content and is not legal, regulatory or professional marketing advice.

Related frameworks to study

  • Advertising self-regulatory codes that apply in the relevant jurisdiction
  • Privacy by design principles
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Five by five risk matrix

Professional Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Marketing, Advertising and Public Relations course Read the best practices for this course

More Professional risk assessments

Hourly Active: 39,499 Learners