vaayaa Inclusive Education
Marketing risk assessment

Programmatic and Data-Driven Advertising Risk Assessment: Targeting, Fraud and Control Risks

A worked example of how a marketing team finds, scores and controls the risks of buying and targeting advertising through automated auction systems, from consent and misleading claims to fraud, budget errors and account compromise.

Updated November 2026 8 hazards assessed Review every 3 months Highest risk: Critical to Medium
See the Programmatic and Data-Driven Advertising course

Executive summary

This assessment shows how a marketing team can find, rate and control the risks of programmatic and data-driven advertising. Eight risks were chosen because they are plausible in everyday campaign work, from targeting people without valid consent to fraudulent traffic, misleading claims and weak account security. Each risk is scored before controls and again after existing and added controls. Consent-based targeting is the highest inherent risk and stays at Medium after controls because the legal and trust impact is serious. Most other risks fall to Low or Medium once pre-launch checks, budget caps, verification tools and access rules are in place. The first actions are a pre-launch review of every creative and audience, a tightened consent check on data feeds and a single approval route for budget changes. The retailer described is a teaching example, so every score illustrates method, not a real organization.

Focus area
Programmatic and data-driven advertising
Setting
Digital marketing team of a mid-sized retailer running automated display, video and social campaigns through third-party platforms and an agency
Method
Five by five likelihood and impact risk register with inherent and residual scoring

Scope

This assessment covers the planning, buying, targeting, measurement and reporting of paid digital advertising that uses automated auction systems and audience data. It looks at risks to customer data, brand safety, budget, measurement accuracy, advertising content and account security. It does not cover any real campaign, platform contract or legal opinion. Jurisdiction, data volumes, the vendor stack and the size of budget are assumptions made for teaching and are not specified.

Context

The retailer has a marketing director, two campaign leads, an analytics lead, a web developer who manages tracking tags, a brand manager and a part-time privacy lead. Campaigns buy inventory through demand platforms and an agency, and use a customer data platform that holds first-party data from website sign ups and purchases. A consent banner appears on the website, and tracking tags send events to several advertising tools. Spend is set monthly and reviewed weekly by finance. Each risk is scored before controls to show its natural level, then again after the existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to run effective advertising that reaches the right people, stays within budget, makes accurate claims, respects personal data and protects the brand. The assets in scope are the advertising budget, first-party customer data, audience segments, tracking tags on the website, ad accounts and login credentials, creative assets and the brand reputation. Stakeholders include customers whose data is used, the marketing team, finance, the privacy lead, the legal adviser, the agency, platform partners and regulators who oversee advertising and data use. Each risk has one owner role, and the marketing director reviews the register with finance each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H03 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H02
3 Possible Likelihood 3, impact 3, score 9, medium: H05 Likelihood 3, impact 4, score 12, high: H04 H06 Likelihood 3, impact 5, score 15, high: H07
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H03 H05 Likelihood 2, impact 3, score 6, medium: H01 H04 H06 H07 Likelihood 2, impact 4, score 8, medium: H02
1 Rare Likelihood 1, impact 3, score 3, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Misleading claims and unapproved creative 16 High 6 Medium Campaign lead
H02 Targeting with personal data lacking valid consent 20 Critical 8 Medium Privacy lead
H03 Fraudulent traffic and invalid clicks 12 High 4 Low Analytics lead
H04 Budget overspend and pacing errors 12 High 6 Medium Marketing director
H05 Attribution and measurement errors misdirect spend 9 Medium 4 Low Analytics lead
H06 Ads placed beside unsuitable content 12 High 6 Medium Brand manager
H07 Account compromise and unauthorized campaign changes 15 High 6 Medium IT lead
H08 Vendor, agency and influencer dependency 8 Medium 3 Low Procurement lead
H01

Misleading claims and unapproved creative

Legal and compliance Before 16 After 6

Ads make product claims, price offers or testimonials that cannot be substantiated, or run without the approval needed, misleading customers and inviting complaints.

Who or what is affected: Customers, the marketing team and the brand

Causes

Fast production, copied creative from earlier campaigns and unclear claim approval rules.

Consequences

Complaints, withdrawn ads, penalties under advertising rules and loss of customer trust.

Existing controls

  • Brand guidelines are shared with all agency staff.
  • Product claims are checked by the campaign lead before launch.

Control gaps

Approval is informal for social posts and for agency-made variants of approved creative.

Additional controls

  • Prevent: Hold a written substantiation file for every claim, approved by legal before launch.
  • Detect: Run a weekly sample of live creative against the approved claim list.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Campaign lead Target: Within 30 days Early warning: Creative flagged by a reviewer or complained about by a customer.
H02

Targeting with personal data lacking valid consent

Technology and data Before 20 After 8

Audience lists are built from customer or third-party data without a valid record of consent, so people are targeted in ways they did not agree to and the business breaks privacy duties.

Who or what is affected: Customers on the lists and the privacy lead

Causes

Purchased lists, unclear consent wording and data copied between tools without checks.

Consequences

Regulatory action, customer harm, forced deletion of data and loss of trust.

Existing controls

  • A consent banner appears on the website.
  • Customer data is stored in a restricted customer data platform.

Control gaps

Third-party data feeds are accepted on the supplier's word alone, without consent evidence.

Additional controls

  • Prevent: Import only audience data with a recorded and current consent status and block records without one.
  • Respond: Remove affected segments from all campaigns and document the decision within one working day.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Privacy lead Target: Within 30 days Early warning: Audience segments containing records with missing or expired consent status.
H03

Fraudulent traffic and invalid clicks

Financial Before 12 After 4

Bots, click farms and spoofed placements generate impressions and clicks that no person sees, so budget is spent on audiences that do not exist.

Who or what is affected: Marketing team and finance

Causes

Open exchange inventory, low-quality placements and pressure to show reach figures.

Consequences

Wasted spend, distorted results and poor decisions about where to invest.

Existing controls

  • Placements are restricted to an approved list.
  • Campaign reports are checked by the analytics lead each week.

Control gaps

Verification is switched off on some campaigns, and placement lists are not reviewed.

Additional controls

  • Prevent: Use a verification service to block known invalid traffic before it is bought.
  • Detect: Compare click rates with conversions and flag placements with very high clicks and few sales.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Analytics lead Target: Within 45 days Early warning: Invalid traffic or click rates above the agreed ceiling on any placement.
H04

Budget overspend and pacing errors

Financial Before 12 After 6

Automated bidding or a mistyped budget spends faster than planned, or keeps spending on a campaign that was meant to stop, using money that finance has not approved.

Who or what is affected: Finance, the marketing director and suppliers

Causes

Bidding rules set too loosely, copied campaigns and budgets entered for the wrong period.

Consequences

Overspend, cash strain and difficult conversations with finance.

Existing controls

  • Monthly budgets are approved by the marketing director.
  • Campaign spend is shown on a shared dashboard.

Control gaps

Dashboards are checked weekly, not daily, so spending spikes can run for several days.

Additional controls

  • Prevent: Set daily caps and an approval route for any budget increase.
  • Recover: Agree credit or refund terms with the platform and recover unused funds where possible.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Marketing director Target: Within 30 days Early warning: Daily spend more than 10 percent above the planned pacing for the same campaign.
H05

Attribution and measurement errors misdirect spend

Operational Before 9 After 4

Tracking tags fire twice, miss conversions or credit the wrong channel, so the team moves budget toward campaigns that look strong but are not.

Who or what is affected: Marketing team and finance

Causes

Changes to the website, duplicate tags and different attribution windows in each platform.

Consequences

Poor budget choices, inflated return claims and weak trust in marketing reports.

Existing controls

  • Tags are tested before each launch.
  • Conversions are reported in the analytics tool each month.

Control gaps

Attribution settings differ by platform and no one compares them side by side.

Additional controls

  • Detect: Reconcile platform conversions with order records each month and record any gap.
  • Respond: Pause budget increases on a channel until its tracking gap is explained.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Analytics lead Target: Within 60 days Early warning: A channel reporting far more conversions than the order records show.
H06

Ads placed beside unsuitable content

Reputational Before 12 After 6

Automated placement shows ads next to content that is offensive, unsafe or against the brand values, so customers associate the brand with harm.

Who or what is affected: Brand team, customers and the agency

Causes

Open inventory, broad keyword targeting and fast-moving news content.

Consequences

Public complaints, boycott calls and damage to brand value.

Existing controls

  • Brand safety exclusion lists are applied to all campaigns.
  • Placement reports are reviewed by the agency each month.

Control gaps

Exclusion lists are not updated when new types of unsafe content appear.

Additional controls

  • Prevent: Use an allow list of trusted sites and apps for high-profile campaigns.
  • Respond: Pull ads from a placement within one working day of a complaint and log the decision.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Brand manager Target: Within 45 days Early warning: Ads served on placements flagged by complaints or by monitoring tools.
H07

Account compromise and unauthorized campaign changes

Technology and data Before 15 After 6

Stolen or shared logins let an outsider or a former staff member change targeting, raise budgets, redirect payments or export customer data from ad accounts.

Who or what is affected: Marketing team, finance and customers

Causes

Phishing, password reuse and access left in place after staff move on.

Consequences

Theft of spend, data leaks, false ads and interest from regulators.

Existing controls

  • Each user has an individual login.
  • Former staff are removed from ad accounts when they leave.

Control gaps

Access reviews happen only once a year, and agency accounts are not covered by the review.

Additional controls

  • Prevent: Enable multi-factor sign in for all users and remove shared logins.
  • Detect: Alert on new devices, admin changes and large budget edits, and review the log each week.
  • Recover: Keep a tested process to lock accounts and restore settings from a saved snapshot.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: IT lead Target: Within 14 days Early warning: Logins from new devices or unusual locations, or new admin users added to an account.
H08

Vendor, agency and influencer dependency

Supplier Before 8 After 3

The business relies on a few agencies, platforms or influencers, and a contract failure, data mishandling or undisclosed paid promotion harms campaigns and reputation.

Who or what is affected: Marketing team, customers and partners

Causes

Single suppliers, weak contract terms and influencers paid through informal arrangements.

Consequences

Service outages, undisclosed ads, breached data terms and loss of trust.

Existing controls

  • Contracts set out data handling and reporting duties.
  • Influencers are asked to follow the platform disclosure rules.

Control gaps

Influencer posts are not checked after publication, and partner reporting dates are not tracked.

Additional controls

  • Prevent: Require written disclosure and content approval for every paid influencer post.
  • Detect: Audit partner reports and data handling against the contract each quarter.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Procurement lead Target: Within 60 days Early warning: A partner that misses a reporting date, or a paid post published without a disclosure label.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe, covering money, legal duty, customer harm, brand trust and time to correct. Multiplying the two gives a score from 1 to 25 in one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The band guides the order of work and is not a precise measurement. Inherent risk is the score before controls, showing the natural level of the activity. Residual risk is the score after the existing and added controls are working. Residual scores must never be higher than inherent scores, and any inherent score of 10 or more must fall to a lower residual score. A Critical item needs immediate senior attention and a dated plan. A High item needs a named owner and a plan within the stated timeframe. A Medium item needs routine controls and checks. A Low item is accepted and watched. Ratings are challenged by the campaign leads, the privacy lead and an independent reviewer, and any indicator that reaches its threshold triggers a fresh rating.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 3 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Share of audience data with no recorded consent or with expired consent status.Escalate to the privacy lead at once when any feed fails the check, and pause its use until consent is confirmed.
Creative or claims flagged by a reviewer or complained about by customers.Escalate to the legal adviser when any claim is disputed, and pull the creative within one working day.
Daily spend more than 10 percent above the planned pacing for the same campaign.Escalate to the marketing director the same day, and to finance if overspend continues for two days.
Invalid traffic or click rates above the agreed ceiling on any placement.Escalate to the analytics lead when the ceiling is passed, and block the placement pending review.
Logins to ad accounts from new devices or unusual locations, or new admin users added.Escalate to the IT lead at once, lock the account and inform the marketing director within the hour.

Contingency arrangements

If a serious event occurs, such as a confirmed data leak, a compromised ad account or a campaign making claims that are untrue, the marketing director pauses the affected campaigns and stops all spend on the account. The IT lead removes access for suspected accounts, changes passwords and keeps logs. The privacy lead and legal adviser decide what must be reported and to whom, in line with the rules that apply. Affected customers and the agency are told what they need to know early and plainly. Spend is restored only after the cause is confirmed and a reviewer signs off.

Prioritized action plan

  1. Run a pre-launch review of every creative, claim and audience segment, owner campaign lead, within 30 days.
  2. Verify consent records for every data feed before it is used for targeting, owner privacy lead, within 30 days.
  3. Enable multi-factor sign in and remove shared logins from all ad accounts, owner IT lead, within 14 days.
  4. Set daily spend caps and a single approval route for budget changes, owner marketing director, within 30 days.
  5. Add invalid traffic verification and a monthly attribution check, owner analytics lead, within 60 days.

Conclusion

Responsible programmatic advertising depends on a few steady habits: valid consent before data is used, checked creative and claims, verified traffic, capped budgets, measured results and strong account security. The highest inherent scores sit with consent and misleading claims, and each has controls that bring the residual score down. Treat the register as a living record, review it every three months and after any incident, and seek qualified legal, privacy and media advice for any real campaign decision.

Assumptions and limitations

Assumptions

  • The retailer sells to consumers in one jurisdiction that is not named here, so advertising and privacy duties are described in general terms only.
  • Campaigns buy inventory through third-party platforms and an agency, and the retailer holds first-party customer data.
  • Monthly spend is set by the marketing director, and finance receives a weekly report on actual spend.

Limitations

  • The scores are examples for learning and describe no real business, platform or campaign.
  • Advertising, consent and data protection rules differ by place and change over time, so specialist legal and privacy review is needed.
  • This is educational content and is not legal, privacy or media buying advice.

Related frameworks to study

  • Risk register with likelihood and impact scoring
  • Hierarchy of controls
  • Three lines model of risk ownership
  • Privacy by design principles
  • Brand safety and suitability review cycle

Marketing Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Programmatic and Data-Driven Advertising course Read the best practices for this course

More Marketing risk assessments

Hourly Active: 39,499 Learners