How a marketing audit uncovered a shocking discovery
Advertising in today's digital age has brought marketing agencies and businesses closer together. Business owners contract the work, agencies do the advertising within their space, and operations generally move forward. Often, however, the lines of digital ownership get way too blurry.
During a routine digital ownership audit for an Alberta business, we expected to find the usual: some accounts the business controlled, some their agency controlled, and a checklist of things to fix. What we didn't expect was to find a single website plugin that gave us a window into every client in the marketing agency's portfolio. Every business they work with was visible through this authenticated plugin. If we or our client wanted to, we could have turned the whole thing off.
A brief history of advertising
Before we get started, it's good to realize that marketing is an age old profession. Advertising can be tracked into the way back when.
From 1500 BC to 500 AD Mediterranean potters stamped their wares to give people a chance to know who made what. And before that, about 2250 - 2000 BC, an ancient civilization called Harrapan used seals to brand their materials (Eckhardt & Bengtsson, 2010). There are many examples of branding throughout history but this gives us a sense of how far back it goes.
In those earliest of days there was no Google and it was pretty easy to determine who made what, and likely what year something was made. In today's extremely fast digital marketplace, ownership is much harder to figure out. The lines are blurred as companies work with agencies, as AI becomes ubiquitous, and as companies like Google and Meta create deeper and more robust marketing tools.
Despite these blurring of lines, company owners who work with a marketing agency are likely more concerned about seeing growth and increased revenue. The finer details, what's under the hood that keeps things moving, are perhaps not the most important things they're looking at. Don't fix it if it ain't broke, right?
But here's a question some business owners might not ask: Do I actually own any of it? What happens to my stuff if my marketing agency ceases operations tomorrow?
It's an important question that's not about your content or you brand. We're talking about the infrastructure underneath. The accounts, the data, the tracking systems, the creative files. The behind-the-scenes machinery that makes your digital presence actually function.
How we got here
Earlier this year, a business owner came to us asking that question.
Our client tasked us with auditing their advertising infrastructure to determine how their system worked and what would be needed if they decided to flip the switch. Working closely with the client, we came up with a full list of tools, questions to ask, and access of systems to review. We then prioritized risks and provided the client with a checklist of what to do to get everything under their business umbrella.
What followed was an extremely interesting digital audit that highlighted general risks and challenges along with a major security issue that some agencies might not realize exists.
It's an interesting conversation: "Give us access to all of your systems to see what your risks are."
A Digital Ownership Audit isn't a quick scan. It's investigative work. We go through every digital account, every platform, your entire ecosystem, and we map out the low, medium, and high risks. For our client, that meant digging into over two dozen individual systems across multiple platforms.
We prefer showing the results as they happen. Each time we needed to connect with the owner, we provided preliminary findings and we outlined how we got there, walking them through each step as well to enhance awareness. It's all about empowerment for us, which further builds trust.
For us, the audit was a great project because it gave us a chance to bring our strategic processes into play, and it gave our client a chance to be confident in their systems and any marketing decisions they made.
Scoring and results
We aren't going to get into the fine details of this particular audit, but we want to highlight that the scoring system we created helped the client understand where things needed to be.
We assessed the business's digital independence across 12 categories, scoring each system from 1 to 10 based on who owned the account, who had admin access, who controlled billing, and how recoverable the system was if the relationship ended.
The result was a structured, measurable picture of exactly where the business stood and where the gaps were.
The risks (they're big)
The underlying risk to all of these interconnected structures occurs when an agency decides to link clients into their own ad systems rather than the company's, and that's what we found.
The agency had linked one single website plugin that they managed into our client's site. Together with our client we were able to click into the account, look at all of the marketing agency's clients - there were quite a few - and we could even remove access to their sites if we wanted to (we didn't).
This process brings real risks to both the business and the agency:
If the agency's account becomes compromised this means that bad characters have access to their clients' information
Relationships sour and people make hasty decisions when they're angry
Business privacy and confidentiality is compromised
Someone could accidentally revoke permissions by accessing the application
There's no clean off-boarding (or onboarding) path for a business
This is how some agency relationships get set up by default; it's not a plugin issue. The agency creates the analytics property because it's faster. The agency builds the ad account because it's easier. The agency connects the tracking because they know how. Nobody thinks twice about it. The work gets done, results show up in monthly reports, and everyone moves forward.
However, the risks outweigh the benefits. It is way better to set things up under the umbrella of your business and creating a checklist for incoming and outgoing agencies that need to gain access to the system. We've built onboarding and off-boarding checklists for exactly this, and they're included as part of our audit deliverables.
In digital marketing, paying for something and owning the infrastructure are two different things, and your business security might just be at risk because of it.
The work behind the work
When we delivered the audit, it included a Master Account Register documenting every system, a scored assessment across 12 categories, a plain-language risk analysis, a day-by-day transition plan, and a framework for structuring future agency relationships so this situation never repeats itself.
The owner walked away with complete clarity. They knew what they owned, what they didn't, and exactly what steps to take to secure their digital independence before making any changes.
For us, this project reinforced something we believe deeply: businesses should stand on their own. Your digital presence, the one you've invested real money and real time into, should belong to you. Not because agencies are untrustworthy. Because independence is just good business and important for your own security.
Our recommendation
You don't need to be unhappy with your marketing provider to ask these questions. In fact, the best time to do this is when things are going well. No pressure, no urgency. Just clarity, and you both might learn something.
If you're a business owner, here are four questions worth asking:
If you logged into Google Analytics right now, would you see your data under your own account?
If your agency closed its doors tomorrow, would your ads keep running?
Do you have independent copies of your logos, photos, videos, and design files on storage you control?
Can you name every digital platform your business uses and confirm who has admin access to each one?
If you can't answer yes to these questions that's not a failure. It's an opportunity.
A Digital Ownership Audit gives you the clarity to answer all four with confidence. We document every account, every platform, every access point. We score your independence and give you a clear, prioritized plan to close the gaps.
It's peace of mind. And every business deserves that.
A puzzle with a lot of pieces
Digital assets are not just your logo or your website's homepage. We're talking about the systems and accounts that power everything you see (and a lot of things you don't).
A digital audit requires a checklist. For us, it's a deep look into the operations of a business through the lens of business continuity and a step-by-step process ensures nothing's missed. The following list isn't the complete step-by-step but it gives you an idea of the scope:
Website analytics: Most businesses use Google Analytics on their sites. The question is: whose Google account?
Advertising accounts: They're valuable because they contain years of learning about what works for your business. Don't knock that learning either, AI and learning systems do really well with this information.
Tracking pixels and tags are small pieces of code installed on your website that connect your advertising to your analytics. It's like having a thin piece of string attached to a person. From viewing to clicking to finally becoming a client, the pixel shows you behavioural information.
Search performance data comes from tools like Google Search Console, which shows you how your website appears in Google search results: what people are searching when they find you, how often you show up, and where you rank.
Creative assets are your logos, photography, videos, graphic designs, social media templates, and ad creative. These are the visual building blocks of your brand. They exist as files, and those files live somewhere: on someone's computer, in a cloud drive, in a design platform, or maybe in as a branded piece of pottery.
Social media management tools: They often hold months or years of content calendars and engagement data as well as being able to access your systems.
Reach out to Brick and Bridge (info@brickandbridge.ca). We'll set up a free 15-minute discovery call to see if an audit is right for you.
Brick and Bridge Communications is a strategic communications consultancy based in Central Alberta. We specialize in crisis communications, media relations, and helping organizations build digital independence.
Comments