Reviews
Part of Marketing attribution reviews: a gated test framework
Attribution route evidence to check, with no scores or invented thresholds
Use these checkbox items to expose missing evidence before an attribution route decision, covering identity, PECR, operations, contracts and exit. No buyer scores.
Use this marketing attribution selection checklist to expose missing evidence, not to manufacture a score.
Start with one organisation operating in England and one buyer decision. The checklist was researched on 6 September 2026 from UK regulator and government guidance. It names no product or supplier, contains no buyer thresholds, and records no hands-on testing.
Publication and procurement remain on HOLD until named qualified reviewers complete their gates. A named qualified reviewer is a person with relevant legal, statistical, security or procurement authority, recorded by name, role and date. A gate is a checkpoint where that reviewer signs one of the permitted outcomes before the next stage begins.
What to take away
- Use the checklist to expose missing evidence, not to create a score or average unrelated strengths.
- A causal claim needs a credible counterfactual, not just an allocation rule, per HM Treasury guidance.
- The ICO's storage and access technologies guidance does not make a generic attribution configuration permissible.
- The NCSC assigns SaaS security work to the customer as well as the provider, so trust pages are insufficient.
- Publication and procurement remain on hold until named qualified reviewers complete their gates.
Decision and method
- State whether the job is platform credit, reconciliation, descriptive analysis, marketing mix modelling, or experiment and incrementality support.
- Define the decision, eligible population, outcome, period, Europe/London timezone and owner.
- Shortlist two or three candidate routes, one of which is the existing manual route. Retain the manual route where it already meets the decision and acceptance thresholds, or where no candidate passes the gates.
- Set acceptance thresholds and stop or rollback triggers. Example: accept reconciliation variance at or below the finance owner's agreed materiality limit; stop if two consecutive daily runs breach it or any refunded state stays unmatched after one working day. The exact limit comes from the buyer's own error tolerance.
- Define stop, rollback and expiry triggers.
A causal claim needs more than an allocation rule. HM Treasury's QPIE guidance explains the role of a credible counterfactual in impact evaluation. Use a named statistician or evaluator to decide what the buyer's evidence can support.
Attribution route decision setup
- State the jobcredit, reconciliation, descriptive, MMM, experiment
- Define decision, population, outcome, period, timezone, owner
- Record existing or manual route as candidate
- Set weights and acceptance thresholds
- Define stop, rollback and expiry triggers
Candidate identity and evidence
- Record the legal entity, exact service and edition, geography and evidence date.
- Link each material claim to a current first-party record.
- Attribute demonstrations, case studies, testimonials and certifications to their source and scope.
- Mark unknown or incompatible evidence as unknown.
- Record conflicts, funding, access, samples and reviewer qualifications.
Data, privacy and PECR
- Map purposes, personal-data fields, sources, recipients and actual controller or processor roles.
- Document identity matching, missingness, retention, deletion and rights handling.
- Identify tags, pixels, scripts or other storage and access technologies by purpose.
- Obtain a qualified decision on the relevant PECR and UK GDPR route.
- Assess sub-processors and restricted-transfer questions for the configured service.
The ICO's final storage and access technologies guidance covers several technologies used in measurement. It does not make a generic attribution configuration permissible. ICO international transfer guidance helps identify restricted-transfer questions, which depend on actual data flows and parties.
Operation and assurance
- Test authorised fixtures for late, duplicate, missing, unmatched, refunded and corrected states.
- Preserve source, query and model versions with uncertainty and causal limits.
- Review least privilege, authentication, service identities, logs, incident response and recovery.
- Test configured user tasks, reports and support routes for accessibility.
- Keep observed results separate from supplier claims.
The National Cyber Security Centre's guidance for using SaaS securely assigns work to the customer as well as the provider. A trust page cannot show whether the buyer configured its tenancy safely.
Contract, cost and exit
- Confirm parties, service scope, edition, term, fees, tax basis, limits and change rights.
- Check data instructions, confidentiality, sub-processors, security, assistance, audit and end-of-contract terms where a processor relationship exists.
- Count buyer labour, validation, legal review, operation, support, migration and exit.
- Prove export format, completeness, restore route, deletion evidence and continuity.
The ICO's controller and processor contract guidance is under review after the Data (Use and Access) Act. Obtain current UK legal advice for the actual relationship.
Decision record
Choose only: admit to the next test, return for evidence, reject at a named gate, retain the manual route, or HOLD. No selection follows from this blank checklist. Record the decision maker, reviewer objections, evidence version and next review date before use.
Worked example: Candidate is platform credit plus the existing manual reconciliation. Gate is the named data protection reviewer signing the PECR and UK GDPR route, and the finance owner signing the acceptance threshold. Outcome is return for evidence because the transfer record is missing.
Before you act
- Define the decision, eligible population, outcome, period, timezone and owner.
- Link each material claim to a current first-party record.
- Obtain a qualified decision on the relevant PECR and UK GDPR route.
- Test authorised fixtures for late, duplicate, missing, unmatched, refunded and corrected states.
- Count buyer labour, validation, legal review, operation, support, migration and exit.
- Record the decision maker, reviewer objections, evidence version and next review date.
Common questions
What should you do with an unchecked item on this checklist?
An unchecked item is a question for its accountable reviewer. It should not be converted into points or averaged against an unrelated strength. The checklist is designed to expose missing evidence, not to manufacture a score. So treat each unchecked box as an open question, not a negative mark.
Does the ICO's storage and access technologies guidance make a generic attribution configuration permissible?
No. The ICO's final storage and access technologies guidance covers several technologies used in measurement, but it does not make a generic attribution configuration permissible. You still need a qualified decision on the relevant PECR and UK GDPR route for your specific setup, based on purposes and data flows.
What does the NCSC say about responsibility for SaaS security?
The NCSC's guidance for using SaaS securely assigns work to the customer as well as the provider. A trust page cannot show whether the buyer configured its tenancy safely. So you must review least privilege, authentication, service identities, logs, incident response and recovery for your own configuration.
