How to run a marketing agency quality checklist that holds up

What to take away

A marketing agency quality checklist is a written set of tests you apply to an agency's process, evidence and ownership before and during a contract.

Anything you cannot verify in writing goes on the risk list, not the approved list.

Start with ownership, not creative

Quality usually fails because nobody owns the final check. Ask for a named person per workstream, plus a deputy who can sign off in their absence. A plan that lists tasks without owners is a wish list.

Ask to see the sign-off log from the last two months. If every approval comes from the same inbox, the deputy arrangement is theoretical rather than real.

For the wider operating model behind this, read the pillar guide to agency operations and delivery, which sets out how workflow, quality and ownership fit together.

Test the evidence behind the numbers

Every performance claim should trace to a source you can inspect: a platform export, an analytics property, or a reconciliation file. Ask the agency to show one recent report with the underlying data attached. If the numbers cannot be reproduced, treat the report as commentary.

Fix the definitions first: a lead, a qualified lead and an opportunity should mean the same thing in every report. Ask for the report's build date and the platform property it draws from.

Compare agency profiles on the same evidence

For a directory shortlist, record the service or workstream being assessed, the named lead and deputy, what results are claimed and whether a platform export or reconciliation file supports them, the data roles and sub-processors, and how the agency handles sign-off and incidents.

Read reviews against the work delivered: check whether they describe the service, evidence for results, communication and approvals. Apply the same questions to each agency; do not treat a review alone as proof of quality.

Check data protection and breach response

Confirm who is controller and who is processor for each data set, in writing. UK GDPR and the Data Protection Act 2018 set the relevant data-protection framework, so document the role split for each activity rather than assuming the agency always has one role. Ask where client data is stored, who can access it, and what retention period applies. Then ask what happens on a breach.

Ask for the list of sub-processors and the date of the last data protection impact assessment. Sub-processors change quietly, and an outdated list is a common gap in otherwise tidy paperwork.

UK GDPR and the Data Protection Act 2018 set the relevant data-protection framework. For a personal data breach likely to result in a risk to people's rights and freedoms, the controller must notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware. If the risk is unlikely, ICO notification is not required. If the agency is a processor, it must notify the controller without undue delay. Ask for these roles, escalation contacts and steps to be written into the incident plan. For cyber incidents, the National Cyber Security Centre (NCSC) provides a Report a cyber incident service; distinguish that route from the ICO's personal-data breach notification.

Review staff development and inclusion

Quality depends on people who are trained, supported and retained. Ask how the agency funds continuing development, and whether junior staff get structured mentoring rather than informal shadowing. The IPA mentoring scheme is one recognised route to that kind of structured support for agency talent.

Inclusion policy matters too, because teams that recruit narrowly tend to test ideas narrowly. The CIPD equality, diversity and inclusion resources give a practical starting point for checking whether a policy has real substance behind it.

Before and after the checklist

The table below shows what a weak submission looks like against the same item once the checklist has been applied.

Set a quarterly review rhythm

A checklist run once becomes stale within a quarter. Diarise a short review each quarter covering owners, evidence, data roles and any open actions. Keep the previous version so you can show what changed.

Score each item as met, partially met, or not met. Only "met" counts toward the approved list. Anything else needs an owner and a date.

Log every action in one place with an owner and a due date. A checklist that lives in a shared inbox loses its value the moment the account gets busy.

There is no single England-wide statutory service standard or public register that certifies marketing agencies. Set the standard in your contract and evidence schedule. For example: For each agreed reporting cycle, the agency will provide the platform export and reconciliation file supporting reported results, keep named lead and deputy details current, and record client sign-off. If acting as processor, it will notify the controller without undue delay of a personal data breach. Adapt the wording to the work and the contract.

Common questions

How often should the checklist be repeated?

Quarterly is workable for most retained accounts. Run it again immediately after any change of account lead, platform or data processor.

Who should complete it?

The client-side owner of the contract should complete it, not the agency. The agency supplies evidence; you record the score.

What if an agency refuses to share underlying data?

Treat that as a failed item. You cannot verify quality without evidence, so escalate it in writing before the next payment milestone.

Does the checklist replace a contract?

No. It supports the contract by giving you a repeatable way to test whether the agreed standards are being met in practice.