How to Audit Your Digital Marketing Agency: Reporting, Ownership, and Red Flags

A digital marketing agency audit should answer three simple questions: can you see what is happening, can you connect activity to business results, and can your company continue operating if the relationship ends? A polished monthly deck cannot answer these questions by itself.

Start with an audit pack, not a presentation

Ask for evidence in the original platforms. The pack should include the current scope, fee schedule, media plans, invoices, platform exports, creative register, landing-page list, tracking map, access list, change log, open experiments and work planned for the next period.

Agree on the review window and business outcome in advance. An ecommerce account may focus on contribution after refunds and fulfilment. A clinic may focus on qualified appointments, not form submissions. A B2B company may need to connect campaigns to accepted opportunities in its CRM. The agency should state which results it controls, influences or only observes.

Audit the reporting layer

Reconcile spend before judging performance

Match reported media spend to each platform and invoice. Separate ad spend, agency fees, production, creators, software and tax. Google’s official Billing guidance explains where transactions, credits, adjustments, invoices and payments information appear. A client should be able to inspect these records directly rather than rely on a manually typed figure.

Demand definitions and comparisons

Every key metric needs a written definition, source and owner. Ask what counts as a lead, qualified lead, sale, new customer and revenue. Confirm whether revenue includes GST, cancellations or repeat purchases. Reports should compare target, actual and the appropriate prior period, then explain material movement.

Channel metrics such as impressions and clicks are diagnostic. The executive summary should connect investment to outcomes the business values, state what changed, explain why, and record the next decision. When attribution is uncertain, the report should say so instead of presenting an estimate as fact.

Inspect platform history

Review whether reported optimisation work appears in the account. Google Ads Change history identifies what changed, when, by whom and through which tool, with history available for the previous two years. Sample budget, bidding, conversion, targeting and creative changes. Look for a sensible link between diagnosis, action and outcome.

Audit ownership and access platform by platform

Google Ads

The company should have direct administrative access through an email it controls. An agency can work through a linked manager account. Google explains that a manager account is a separate umbrella account and that client administrators can unlink the relationship.

Check whether the agency’s manager is marked as owner and whether that is necessary. Google says manager ownership provides wider administrative and data privileges, but the client account retains its data and can unlink the owner. Google recommends granting ownership only when those privileges are required in its client-account ownership guidance. Keep at least two current company administrators where practical, and remove departed people.

Meta assets

List the business portfolio, ad accounts, Facebook Pages, Instagram accounts, pixels, datasets, catalogues, domains and payment methods. Confirm that authorised company personnel retain the highest appropriate control and that the agency receives only the access needed for its work.

Meta warns that a person with full control of a Page can manage access, remove other people or delete the Page. Task access is narrower. Review individual users, partner access, inactive staff and unknown accounts. Do not use shared personal logins.

Google Analytics and Search Console

In GA4, inspect both account-level and property-level permissions. Google states that Analytics Administrators can assign roles and data restrictions through access management. The business should have its own Administrator and understand linked products, key events, filters and data retention settings.

In Search Console, verify that the company controls a durable ownership method. Google’s permissions guidance distinguishes verified owners, delegated owners, full users and restricted users. Removing an old verified owner may also require removing that person’s verification token from the site or DNS.

Tag Manager, domain and website

Tag Manager can affect measurement and code loaded on the website. Google recommends at least two active administrators and says the account should be managed by someone inside the organisation, not solely by an outside agency, in its user-management guidance.

Check the domain registrar, registrant details, renewal contact, DNS provider, hosting, content management system, source-code repository, plugins, email platform, CRM and landing-page tools. ICANN defines the registrant as the individual or entity that registers a domain and manages it through the registrar. The company, not an employee or supplier acting privately, should be identifiable in its records and able to renew, transfer and secure the domain.

Review commercial and operational controls

• Match the statement of work to work actually delivered.
• Separate media money from service fees and third-party costs.
• Check approval rules for budgets, campaigns, discounts and production.
• Confirm ownership and permitted reuse of copy, design, video, code, audiences and research.
• Read termination, notice, confidentiality, subcontracting and handover clauses.
• Record service contacts, escalation routes and expected response times.
• Check whether personal data is shared, why it is needed and who can access it.

Red flags that deserve investigation

• The agency refuses direct platform access or offers screenshots only.
• Accounts, domains or tags exist only under an agency or former employee login.
• Reported spend does not reconcile with billing records.
• Lead totals rise while sales teams report worsening quality, with no investigation.
• Definitions change between months without a note.
• Conversion actions count page views or duplicate events as business outcomes.
• There is heavy activity but no hypothesis, experiment record or learning.
• Budgets or targeting change without approval.
• Unknown users, partners, payment methods or integrations remain active.
• The agency resists a documented handover or claims the client cannot keep campaign history.

One red flag is not automatic proof of misconduct. It may be a process gap. Ask for evidence, set a correction deadline and judge the response. Evasion, inconsistent records or repeated access failures are more serious than a clearly acknowledged mistake.

Detailed agency audit checklist

Reporting and performance

• Targets, actuals and prior-period comparisons are visible.
• Spend, fees, tax and production costs reconcile.
• Lead, sale and revenue definitions are documented.
• Online results reconcile with CRM or finance outcomes.
• Attribution limits and tracking gaps are stated.
• Actions, owners and due dates follow each review.

Ownership and security

• Company-controlled administrators exist on every critical platform.
• Agency access uses named users or formal partner links.
• Inactive users and unused integrations are removed.
• Two-factor authentication and recovery routes are checked.
• Domain, DNS, website, code and creative files are retrievable.
• Billing profiles and verification details identify the correct business.

Delivery and governance

• Delivered work matches scope and invoices.
• Campaign changes have a reason and approval trail.
• Testing has hypotheses, success criteria and conclusions.
• Brand, legal and platform-policy reviews are assigned.
• Subcontractors and software are disclosed.
• A current exit and handover document exists.

Turn findings into a corrective plan

Classify each finding as critical, important or routine based on business impact and recoverability. Fix access and ownership risks first, then measurement integrity, financial reconciliation and delivery quality. Give every action an owner, evidence requirement and deadline. Repeat the affected checks after correction.

FAQ

How often should a business audit its agency?

Run a light access and reporting check quarterly and a deeper review before renewal or a major budget increase. Also audit after unexplained performance changes or team departures.

Should the client own every advertising account?

The client should retain durable administrative control and its business data. Agencies can receive partner or manager access appropriate to the work. Platform structures differ, so document the exact arrangement.

Is poor performance enough reason to replace an agency?

Not by itself. Results can be affected by the offer, website, sales process, market and measurement. Judge whether the agency identifies causes, runs disciplined tests, communicates clearly and acts within the agreed scope.

What should happen before terminating an agency?

Confirm company access, export essential records, inventory assets, review notice and payment obligations, rotate credentials where appropriate, remove access in a controlled sequence and document the handover.