vaayaa Inclusive Education
Marketing risk assessment

Public Relations and Corporate Communications Risk Assessment: Claims, Privacy, Budget and Account Controls

A worked example of how a corporate communications team identifies, scores and controls the risks in its campaigns, from misleading claims and privacy breaches to fraudulent traffic, backlash and compromised accounts.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Public Relations and Corporate Communications course

Executive summary

This assessment shows how a corporate communications team can identify, score and control the risks that threaten campaign accuracy, audience privacy, brand trust and budget. Eight hazards were chosen because they are plausible in everyday public relations work, from misleading claims and privacy breaches to fraudulent traffic and compromised accounts. Misleading claims carry the highest inherent score, so they are treated first, followed by privacy and backlash. Each risk is scored before controls and again after existing and added controls. Most risks fall to Low or Medium once controls are in place, and backlash stays Medium because public reaction is hard to predict. The first actions are a claims substantiation file, consent checks on audiences, a licence register for assets and multi-factor sign in for every official account. The organization is a teaching example, so the scores illustrate method rather than describe a real business.

Focus area
Public relations and corporate communications
Setting
In-house corporate communications team for a mid-sized organization running campaigns across owned, earned and paid channels
Method
Five by five likelihood and impact risk register with inherent and residual scoring

Scope

This assessment covers the planning, approval, launch and monitoring of public relations and corporate communications campaigns, including press activity, social content, influencer work, paid promotion and reporting. It does not cover crisis legal strategy or any real organization. Jurisdiction, channels, budget size and tools are assumptions made for teaching and must be confirmed locally.

Context

The communications team has a head of communications, two campaign managers, a content editor and an analyst. Campaigns use press releases, social channels, influencer partners, a paid media agency and a customer data platform for audience targeting. Approvals run through legal and a brand committee. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to run campaigns that are accurate, lawful, respectful of audiences and measured honestly, while protecting the organization's reputation and budget. The assets in scope are campaign content, audience and consent data, licensed media, advertising accounts, official social channels, the reporting dashboard and the team's credibility with journalists. Stakeholders include the communications team, senior leaders, legal and data protection advisers, finance, agencies, influencers, platforms, journalists, customers and the public. Every risk has one owner role, and the head of communications keeps the register current and reports to leaders each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H04 Likelihood 4, impact 4, score 16, high: H02 Likelihood 4, impact 5, score 20, critical: H01
3 Possible Likelihood 3, impact 3, score 9, medium: H05 H07 Likelihood 3, impact 4, score 12, high: H03 Likelihood 3, impact 5, score 15, high: H06
2 Unlikely Likelihood 2, impact 5, score 10, high: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H04 H05 H07 Likelihood 2, impact 3, score 6, medium: H02 H03 Likelihood 2, impact 4, score 8, medium: H01 H06
1 Rare Likelihood 1, impact 4, score 4, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Misleading claims and failed campaign messaging 20 Critical 8 Medium Head of communications
H02 Privacy, consent and audience targeting breaches 16 High 6 Medium Data protection lead
H03 Advertising disclosure and intellectual property infringement 12 High 6 Medium Campaign manager
H04 Budget overspend and attribution errors 12 High 4 Low Communications finance partner
H05 Fraudulent traffic, bots and fake leads 9 Medium 4 Low Digital analytics lead
H06 Brand and reputational harm from public backlash 15 High 8 Medium Head of communications
H07 Platform, influencer and vendor dependency 9 Medium 4 Low Partnerships manager
H08 Account compromise and unauthorized posting 10 High 4 Low IT security lead
H01

Misleading claims and failed campaign messaging

Legal and compliance Before 20 After 8

Campaign copy overstates product benefits, uses unverified figures or endorsements, or omits material terms, so audiences are misled and the content must be pulled or corrected.

Who or what is affected: Consumers, partners, regulators and the communications team

Causes

Tight deadlines, pressure to show bold results and claims copied from earlier campaigns without checking.

Consequences

Forced withdrawal of content, complaints, regulator scrutiny and lasting loss of credibility with journalists.

Existing controls

  • Legal reviews final copy before publication.
  • Campaign briefs list the approved key messages for each launch.

Control gaps

Claims in social replies and influencer posts are rarely reviewed before they go live.

Additional controls

  • Prevent: Keep a claims substantiation file with evidence for every factual statement before launch.
  • Detect: Run a pre-launch checklist and a second reviewer read of every asset and reply template.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Head of communications Target: Within 30 days Early warning: A claim in draft copy with no matching evidence reference in the substantiation file.
H02

Privacy, consent and audience targeting breaches

Technology and data Before 16 After 6

Personal data is used for targeting without valid consent, or audience lists are shared with partners beyond what subscribers agreed, exposing individuals and the organization to harm.

Who or what is affected: Subscribers, customers, data protection staff and partner agencies

Causes

Large lists copied between tools, unclear consent wording and custom audiences built from uploaded files.

Consequences

Complaints, enforcement action, forced deletion of data and loss of subscriber trust.

Existing controls

  • Opt in is recorded for every mailing list subscriber.
  • Agencies sign a data processing agreement before receiving audience lists.

Control gaps

Consent status is not checked when a segment is rebuilt for a new campaign.

Additional controls

  • Prevent: Minimize audience data and remove any field not needed for the campaign objective.
  • Detect: Audit targeting segments each month against consent records and flag any mismatch.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Data protection lead Target: Within 45 days Early warning: A targeting segment containing records that lack a recorded consent date.
H03

Advertising disclosure and intellectual property infringement

Legal and compliance Before 12 After 6

Content uses unlicensed images, music, fonts or third party logos, or fails to label sponsored posts and paid influencer content clearly, creating infringement and disclosure exposure.

Who or what is affected: Creators, rights holders, influencers and the public

Causes

Assets taken from search results, reused archive material and quick edits by freelancers.

Consequences

Takedown demands, fees, damages claims and public criticism of the brand.

Existing controls

  • Stock assets are bought under a licence that is kept on file.
  • Influencer contracts require clear disclosure of paid partnerships.

Control gaps

Influencer posts are published without a check of the disclosure label.

Additional controls

  • Prevent: Keep a licence register linking each asset to its source and permitted usage terms.
  • Respond: Remove disputed assets within one working day and record the reason for the decision.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Campaign manager Target: Within 30 days Early warning: An asset in a campaign folder with no licence reference attached.
H04

Budget overspend and attribution errors

Financial Before 12 After 4

Spend runs ahead of the approved budget through unmanaged media orders, and results are credited to the wrong channel, so the team funds activity that does not produce the outcome it claims.

Who or what is affected: Finance team, the communications budget holder and senior leaders

Causes

Open ended agency retainers, late booking changes and inconsistent tracking tags across channels.

Consequences

Overspend, wasted budget, poor decisions and damaged confidence in reported results.

Existing controls

  • Monthly budget reports go to the head of communications.
  • A purchase order is needed before any paid media booking.

Control gaps

Spend forecasts are updated only at the end of each month, so overruns appear late.

Additional controls

  • Detect: Reconcile agency invoices to media orders each week and flag variances above a set amount.
  • Prevent: Agree a single attribution model and tracking standard before any campaign starts.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Communications finance partner Target: Within 45 days Early warning: Spend above 90 percent of a campaign budget before its schedule reaches the midpoint.
H05

Fraudulent traffic, bots and fake leads

Financial Before 9 After 4

Paid campaigns are charged for bot clicks, fake sign ups or inflated impressions, and lead forms fill with false contacts, so spend and reported results become inaccurate.

Who or what is affected: Finance team, sales partners and campaign analysts

Causes

Low cost placements, incentive based sign up offers and automated scripts aimed at form pages.

Consequences

Wasted spend, distorted reports and poor handover of leads to sales teams.

Existing controls

  • Platform fraud filters are switched on for all paid placements.
  • Lead forms include a basic verification step before submission.

Control gaps

Traffic quality is reviewed only when cost per lead looks unusually low.

Additional controls

  • Detect: Review traffic quality by source and remove suspect placements from the schedule each week.
  • Respond: Pause the affected placement at once and request a credit from the platform.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Digital analytics lead Target: Within 30 days Early warning: A lead source with high form submissions but no follow up contact or response.
H06

Brand and reputational harm from public backlash

Reputational Before 15 After 8

A campaign or spokesperson's comment is seen as tone deaf, insensitive or hypocritical, and public criticism spreads faster than the team can respond, damaging trust in the organization.

Who or what is affected: Staff, leaders, customers, partners and shareholders

Causes

Rushed approvals, topical timing and content that assumes a shared context with audiences.

Consequences

Negative coverage, boycott calls, staff distress and diversion of executive time.

Existing controls

  • A crisis contact list is kept and tested each year.
  • Spokespeople complete media training before external interviews.

Control gaps

Social listening stops at launch and is not reviewed during the first week.

Additional controls

  • Prevent: Test major campaign concepts with a diverse review panel before final approval.
  • Detect: Set alerts for mentions and sentiment shifts across key channels every day.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Head of communications Target: Within 60 days Early warning: Negative mentions rising sharply within the first 24 hours of a campaign launch.
H07

Platform, influencer and vendor dependency

Supplier Before 9 After 4

A platform changes its rules, an influencer leaves or an agency fails, and campaigns, audience data or reporting stop without warning, leaving the team with no fallback route to its audience.

Who or what is affected: Campaign managers, partners, audiences and finance

Causes

Reliance on one platform, exclusive influencer deals and vendors without tested continuity plans.

Consequences

Lost reach, abrupt campaign stops, contract disputes and missing performance data.

Existing controls

  • Key agency contracts include defined notice periods.
  • Core content is also stored on owned channels and the website.

Control gaps

Vendor continuity plans are not requested or reviewed during onboarding or renewal.

Additional controls

  • Prevent: Spread spend and audiences across at least two platforms and two creative partners.
  • Recover: Keep a documented fallback plan and a list of approved alternate creators and vendors.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Partnerships manager Target: Within 90 days Early warning: A platform policy notice or a vendor whose performance reports are delayed or incomplete.
H08

Account compromise and unauthorized posting

Technology and data Before 10 After 4

Shared logins, reused passwords or phishing let outsiders publish false posts, change advertising settings or take over official accounts, damaging trust within minutes.

Who or what is affected: Followers, staff, partners and investors

Causes

Phishing emails, shared passwords and former staff or agencies keeping access after they leave.

Consequences

False posts, data exposure, platform suspension and a public apology that damages credibility.

Existing controls

  • Official accounts use individual logins stored in a password manager.
  • Publishing rights are limited to a short list of approved staff.

Control gaps

Access rights for former staff and agencies are not checked each quarter.

Additional controls

  • Prevent: Require multi-factor sign in and remove shared logins from all official accounts.
  • Recover: Keep a tested account recovery process and a pre-approved holding statement.
Likelihood 2 x impact 5 before; 1 x 4 after Owner: IT security lead Target: Within 30 days Early warning: A login alert or a post published outside working hours with no approval record.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a measurement. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls. Impact is judged on legal exposure, money, time to correct, reach of harm and damage to trust, and a reputational or privacy risk is never rated down only because it has not yet happened. Critical risks need senior attention and a dated plan, High risks need a named owner and a timeframe, Medium risks need routine controls and regular checks, and Low risks are accepted and watched. Owners and a second reviewer challenge every rating, and any score is reopened when its indicator reaches the threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Claims in draft copy without a matching evidence reference in the substantiation file.Escalate to the head of communications before approval, and to legal if the claim is already published.
Audience segments built without a recorded consent date.Escalate to the data protection lead within one working day and suspend the segment until it is checked.
Negative mentions rising sharply within the first 24 hours of a campaign launch.Escalate to the head of communications at once, and to the senior leadership team if the trend continues for six hours.
Spend above 90 percent of a campaign budget before its schedule reaches the midpoint.Escalate to the communications finance partner at once, and freeze new bookings until a revised forecast is agreed.
Failed login attempts or posts published outside approved hours on official accounts.Escalate to the IT security lead immediately, lock the account and inform the head of communications.

Contingency arrangements

If a serious event occurs, such as a false post from a compromised account, a privacy complaint or a campaign that must be withdrawn, the head of communications pauses all scheduled content and informs the leadership team. The IT security lead locks the affected accounts, resets credentials and preserves activity logs. Legal and data protection advisers are engaged to assess duties in the relevant jurisdiction. Holding statements are approved in advance, and staff, partners and audiences are told what they need to know plainly and early.

Prioritized action plan

  1. Build a claims substantiation file and require sign off before any launch, owner head of communications, within 30 days.
  2. Audit audience segments against consent records and minimize data shared with agencies, owner data protection lead, within 45 days.
  3. Enforce multi-factor sign in and remove shared logins from official accounts, owner IT security lead, within 30 days.
  4. Reconcile agency invoices to media orders and agree one attribution standard, owner communications finance partner, within 45 days.
  5. Run a diverse review panel on major campaign concepts and extend social listening into launch week, owner head of communications, within 60 days.

Conclusion

Credible communications rest on a few steady habits: substantiated claims, consent checked before targeting, licensed assets, verified traffic, secure accounts and honest measurement. The highest scores sit with misleading claims and privacy, and each has controls that bring the residual score down. Treat the register as a living record, review it on the stated cycle and seek qualified legal and data protection advice for any real advertising, privacy or intellectual property question.

Assumptions and limitations

Assumptions

  • The organization operates in one jurisdiction whose advertising, privacy and intellectual property rules are not specified here, so legal duties are described in general terms only.
  • Campaigns use third party platforms, agencies and influencers under written contracts.
  • Most staff use managed devices, although some shared logins still exist for older official accounts.

Limitations

  • The scores are examples for learning and do not describe any real organization.
  • Advertising, privacy and intellectual property rules vary and change, so specialist legal review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed legal advice.

Related frameworks to study

  • Claims substantiation checklist with an evidence file
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Privacy by design principles

Marketing Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Public Relations and Corporate Communications course Read the best practices for this course

More Marketing risk assessments

Hourly Active: 39,499 Learners