How to audit your media buying agency: a UK finance director's checklist

What to take away

An audit right in the contract decides what you can see. Without it, you get only what the agency chooses to send.
Four evidence sets do most of the workcost reconciliation, volume income records, platform access logs and data handling notes.
The finance director signs off the controls, not the quality of the media plan.
Fix the scope, the dates and who pays before fieldwork starts.

Separate compliance from performance

Two exercises get confused. A contract compliance audit tests whether the agency kept to the agreement: rates, commission, rebates, approval limits and reporting dates. A performance audit tests whether the buying worked: delivery, cost against benchmark and waste.

Compliance vs Performance Audit

Compliance audit

What it tests: Kept to agreement
Evidence: Rates, rebates, approvals
Reviewer: Compliance reviewer
Order: Run first

Performance audit

What it tests: Buying worked
Evidence: Delivery, cost, waste
Reviewer: Performance reviewer
Order: Run second

They need different evidence and different reviewers. Run compliance first, because a broken control undermines any performance number you are shown.

What the audit right should say

Read the clause before you draft the request. It should name the records you may inspect, the notice period, how often you may audit and who pays.

An example clause is: “On [notice period], and no more than [frequency], the advertiser or its independent auditor may inspect [records] for [period], including records held by [named trading entities].” Specify the scope, confidentiality, cost allocation and how discrepancies will be corrected; fill in the bracketed terms before signing.

Agree the notice period, audit frequency, scope, costs and materiality threshold in the contract. Do not assume a standard notice period, frequency or discrepancy tolerance applies to your agreement.

Confidentiality cuts both ways, so agree what you can share with your board. Directors have their own record-keeping duties under the Companies Act 2006, and a clear audit trail helps you meet them.

Build the evidence pack in order

Work through this sequence and stop at the first gap, because later steps usually rest on earlier ones:

Confirm the right and scope.Check the signed contract and amendments for the records, legal entities and period covered, plus notice, frequency and cost terms. Assign the finance director to confirm the scope before requesting evidence.
Map the transactions and trading model.Define the accounts, campaigns and dates in scope. Establish whether the agency acted as principal or agent, and identify the approvals and records that should support each transaction.
Reconcile costs.Match planned, invoiced and paid spend by line. Check rates, commissions, fees, credits and other adjustments against the contract, and record any difference for follow-up.
Trace income and platform access.Request volume-income records and compare them with the disclosures and supporting records. Check platform access logs, account ownership and permissions with the relevant platform owner.
Check data handling and close findings.Review the data map, lawful basis, retention and any required impact assessment. Record each gap with its evidence, owner, due date and sign-off.

Evidence Pack Sequence

Signed contract, brief and variations
Cost reconciliationplanned to paid
Rebate, bonus and deal register
Platform access and raw data
Data handling notes for targeting

Follow the money through the trading model

The trading position changes what you test. If the agency buys as principal, it buys in its own name and resells, so your audit needs the resale margin. If it buys as agent, commission and volume income should be disclosed.

Ask what the agency earned in total, then compare that with what you were billed. Different structures carry different control and exit terms, as our comparison of media agency business models explains.

Check where the FCA line sits

Rules differ by what you sell. FCA requirements apply only to firms the regulator authorises and to the financial promotions they approve.

Check the relevant legal entity on the FCA Financial Services Register to see whether it is authorised and what permissions it has. An agency buying media for an unauthorised client is not a substitute for compliance sign-off, so keep media evidence and regulated approvals in separate files.

Audit tests and the evidence they need

Use this table to assign owners before fieldwork begins.

If you appoint an external media auditor, specialist firms such as FirmDecisions and Ebiquity are options to assess for the scope. Check their independence, relevant capability and access requirements before appointment; neither replaces the audit rights in your contract. Set the materiality threshold for findings in the contract or audit terms before fieldwork begins.

Audit test	Evidence to request	Sign-off
Cost reconciliation	Planned, invoiced and paid spend by line	Finance director
Volume income	Rebate and bonus register with deal terms	Commercial lead
Access and ownership	Ad account admin list, log-in records	Marketing lead
Audience data	Segment sources, consent basis, retention	Data protection lead

Keep personal data in scope

Programmatic and audience-based buying moves personal data between several parties. Ask for the data map, the lawful basis for each segment and the retention period. Assess whether the processing is likely to result in high risk and therefore requires a data protection impact assessment.

Use the ICO's UK GDPR and data protection impact assessment guidance and template when checking the agency's approach. If the agency cannot produce the map, record it as a finding.

Turn findings into remediation

Each finding needs an owner, a date and evidence that closes it. If the buying was weak rather than the controls, the fix sits in measurement: our media buying measurement guide covers charters and attribution language before the next review.

Common questions

How long should an agency audit take?

For one advertiser and one agency, four to six weeks is typical: two weeks to gather evidence, two on review, the rest on remediation. Multi-entity network audits run longer.

Who pays for the audit?

It depends on the clause. Some agreements charge the agency where a material discrepancy is found and the advertiser otherwise, so agree the trigger before fieldwork.

Can we audit the agency's trading desk?

You can inspect whatever the contract permits. If the trading desk sits in a separate legal entity, the audit right must name that entity, or you are limited to the agency's own records.

What happens if the agency refuses access?

Write to the agency's finance director, cite the clause and set a date. A refusal is a finding in itself; take legal advice before withholding fees.