Operations
Part of How to audit your creator discovery platforms: a UK brand's workflow
How to audit your creator discovery platforms: a UK brand's workflow
A step by step audit for UK brands reviewing creator discovery platforms, covering ASA disclosure checks, ICO data handling and exit evidence.
What to take away
- An audit tests live platform usage against a written scope, not the features a supplier showed you.
- Disclosure, data handling and contract terms carry the most risk for UK brands.
- Score each platform on evidence you can reproduce, such as exported records and dated screenshots.
- Set the decision before you start, so the output is renew, renegotiate, replace or retire.
- Name an owner for every check, because an unowned finding never closes.
Start with the decision, not the tool
An audit that begins by opening the dashboard tends to produce a feature list. Begin instead with the decision the review must support. A renewal in March, a supplier swap in the summer and a budget cut after a weak quarter are three different audits with three different evidence sets. Write the decision on one page before anyone logs in.
Give the audit a fixed window. Ninety days of campaign data is usually enough to show whether creators were found, contacted and paid through the platform. Anything older tests a process the team no longer runs.
Findings usually settle on the creator discovery costs that rarely appear on the platform invoice, because a renewal quote hides seat upgrades and list cleaning.
Ad disclosure is the check most likely to fail. The ASA advertising codes place responsibility on the brand as well as the creator, so a vague label on a gifted post is your problem, not only the creator's.
The audit in six steps
- Write the decision, the decision maker and the date it must be made.
- List every place creator data is held, including shared drives and team inboxes.
- Pull one exported creator record and trace it from first import to deletion.
- Take three paid posts and check the label, the brief and the signed terms.
- Read the contract for retention, sub-processors and export rights.
- Score each finding as pass, fix or fail, with a named owner and a review date.
Before the renewal clock starts, put the contract questions about data and exit to the supplier in writing, because exit terms are far harder to renegotiate once a notice period is running.
Six-step creator platform audit
- Write decision, decision maker and date
- List every place creator data is held
- Trace one exported creator record to deletion
- Check three paid postslabel, brief, terms
- Read contract for retention and export rights
- Score each finding pass, fix or fail
UK compliance checks during the audit
Work from the ICO UK GDPR guidance hub, not a supplier summary, when you test lawful basis, retention and subject requests.
The Data Protection Act 2018 sets the framework your processing records sit inside, including the rules on special category data that creator forms sometimes collect by accident.
Check disclosure first, data second, money third. Disclosure failures are public and dated. Data failures are slow and expensive. Fee disputes usually follow the other two.
Keep a dated screenshot of each check. A screenshot showing a date and a page address is evidence. A note saying the platform looked fine is not.
Scoring what you find
| Check | Evidence to keep | Common fail signal |
|---|---|---|
| Lawful basis for contacting creators | Processing record plus consent or legitimate interests note | Contacts imported with no recorded basis |
| Ad disclosure | Dated post screenshot, brief and terms | Gifted post labelled as a collab only |
| Record accuracy | One full creator record, field by field | Fees and audience figures from unknown sources |
| Exit | Export file opened outside the platform | Export unavailable without notice |
| Access | User list reviewed this quarter | Former staff still holding seats |
Score against the live workspace, not a sandbox. A supplier can rebuild a clean demo in an afternoon, so the only record worth scoring is the one your team exported.
Audit checks and fail signals
- Lawful basisprocessing record plus consent note
- Ad disclosuredated post screenshot, brief, terms
- Record accuracyone full creator record
- Exitexport file opened outside platform
- Accessuser list reviewed this quarter
Weight the checks by consequence. A missing processing record is a legal risk. An inconvenient filter is a training issue.
Where audits quietly fail
Two failures repeat. Auditing the demo rather than the live workspace flatters poor data, because the supplier selects the sample. Ask for a full export and audit that instead.
Treating a compliance page as evidence is the second. A page describing processing is a claim. Your signed contract, processing record and retention schedule are the evidence.
Keep the whole review to six or eight weeks. A short audit with dated findings gets acted on. A rolling programme that never closes just absorbs the team's time.
Common questions
How long should a creator discovery platform audit take?
Six to eight weeks for one platform in live use. Allow longer where creator data sits in more than two systems or where seats were never removed.
Do we need a lawyer for the compliance parts?
Not for the whole review. Use the ICO guidance for the data checks, and take legal advice only where a contract term blocks export or deletion.
What if the platform fails the audit?
A fail on disclosure or data handling is usually a fix with a date, not an immediate termination. Review the fix before renewal.
Should we audit platforms we are not renewing?
Yes, briefly. The findings tell the incoming supplier what to correct, and they show whether the fault sat in the tool or in the process.
