Operations
Part of Marketing attribution operations: a controlled workflow
Attribution service standards: clocks written out, thresholds blank
How to write the response, resolution and recovery clocks of an England attribution service standard, with a worked card and every threshold left blank.
What to take away
- A clock is a standard only when its start, stop, timezone, calendar and permitted pauses are written down.
- Response and resolution are separate clocks with separate stop events.
- A pause needs a named authority and a resume event, or the clock can be stopped at will.
- An expired timer never passes a privacy, PECR, security, accessibility, statistical or legal decision.
- Every failure needs an owner, an escalation route, a safe state and a recovery test.
- Thresholds stay blank until the buyer approves them with evidence.
Anatomy of a service clock
A service clock is a pair of observable events with a timezone and a calendar between them. If either event can be argued about, the clock cannot be audited. Write both events as states that a record can be seen to enter.
| Clock | Starts when | Stops when | What the buyer must still write |
|---|---|---|---|
| Response | An eligible ticket with all mandatory evidence enters the accepted state | A named responder records in the ticket an acknowledgement that states the evidence job and the next evidence step | Timezone, working calendar, pause authority |
| Resolution | The same accepted state | A correction is reproduced from the input manifest and the approved route is restored | The declared evidence state and the restart event |
| Recovery | The failure owner declares a failure in the run record | The prior approved route is restored and the recovery test passes | Safe state, test fixture, approver |
Start the response clock when an eligible ticket with all mandatory evidence enters an accepted state, not when an incomplete email arrives. That way the clock measures the service rather than the inbox.
Specify Europe/London time, the working calendar, permitted pauses, pause authority and the event that restarts the clock. A resolution clock stops only at the declared evidence state, never because someone closed the ticket.
Put each clock on a card
Each clock belongs on a standard card, with one card for each commitment. The clock fields are start and timezone, stop, permitted pauses and resume event. A card with a blank clock field cannot be judged.
Standard card fields
- Service and evidence job
- Triggering event
- Eligible population
- Measure and unit
- Clock start and timezone
- Clock stop
- Permitted pauses and resume event
- Exclusions
Reject a card if a blank field changes whether the service passed. Do not fill gaps with a supplier default or a figure copied from another buyer. Every threshold field stays blank until the buyer holds evidence for it.
The card below is an example for a reconciliation correction. The roles come from a typical analytics team, and the threshold stays empty on purpose.
| Field | Example entry |
|---|---|
| Service and evidence job | Reconciliation |
| Triggering event | A reported mismatch between source and input counts |
| Eligible population | Reconciliation tickets with all mandatory evidence |
| Measure and unit | Elapsed working time, in the unit the buyer approves |
| Clock start and timezone | Ticket enters the accepted state, Europe/London |
| Clock stop | Correction reproduced and approved route restored |
| Permitted pauses and resume event | Waiting for the data owner's authorisation, resumed when it is recorded |
| Exclusions | Tickets that lack mandatory evidence |
| Threshold and evidence for it | ____ |
| Source, query and model version | Recorded in the run record |
| Evidence owner | Data engineer |
| Failure owner and escalation | Marketing analytics lead, escalating to the data protection lead where personal data is involved |
| Remediation and recovery proof | Recovery test on a synthetic fixture |
Keep service-provider clocks apart from internal review clocks. Privacy, PECR, security, accessibility, statistical and legal decisions cannot be deemed passed because an operational timer expired.
Match the stop event to the job
The stop event differs by evidence job, so one clock shape does not fit all. Reconciliation stops when records reach a declared state: matched, unmatched, duplicate, late or corrected. An MMM clock stops when model, input-period and uncertainty records exist.
Platform credit allocation might stop when the documented rule and configuration versions are recorded. Experiment support stops when implementation checks and a preserved comparison exist. General analytics stops with event coverage and query provenance.
Standards by job
Job
- Platform credit allocation
- Documented rule
- Reconciliation
- Matched
- MMM
- Model
- Experiment support
- Implementation checks
- General analytics
- Event coverage
Required records
- Platform credit allocation
- Configuration versions
- Reconciliation
- Unmatched
- MMM
- Input period
- Experiment support
- Preserved comparison
- General analytics
- Query provenance
One aggregate "data quality" score would hide these differences, which is why each job needs its own clock and its own card.
Design failure and recovery
Every standard needs a failure owner, an escalation route, a safe state, a communication audience and a recovery test. Name the people in the team roles before a failure happens, because a clock with no owner measures nothing.
The NCSC's incident response guidance recommends planned contacts, categorisation, escalation, technical response and post-incident review. Adapt that guidance to the organisation rather than treating it as a ready-made procedure.
Test recovery with synthetic or specifically authorised fixtures. Where an incident involves personal information, a qualified privacy and legal reviewer must determine the current duties and timing for the actual facts, not the operational clock.
Keep the evidence that the clock ran
The run record should link ticket state, input manifest, code or query version, configuration, model version, exceptions, approval and release. Keep audit information protected from silent alteration, so a start or stop time cannot be edited after the event.
The NCSC's guidance on audit information for users says buyers should be confident that all important operations result in audit information. It does not guarantee that a buyer's own logs are complete.
Quality claims need denominators. If a standard concerns processed records, show eligible, received, accepted and excluded populations. Missing and unmatched records must stay visible, because a clock that excludes them quietly flatters the result. A launch review asks what evidence a service must show.
Approve thresholds and set review triggers
The buyer should record why each threshold is proportionate, who approved it and what change triggers review. Useful triggers include a new event schema, identity rule, supplier release, model version, data source, user population or legal position.
If the evidence cannot reproduce a result, report unknown and keep the service claim on HOLD. Publish performance only with the card, denominator, period, exclusions, source and uncertainty. The quality checklist covers the sign-off before anything is published.
The way these standards sit inside daily running of the service is set out in operating marketing attribution.
Before you act
- Write the start event, stop event and timezone for each clock.
- Name the pause authority and the resume event.
- Keep service-provider clocks apart from internal review clocks.
- Name a failure owner, escalation route and recovery test.
- Link ticket state, query version, configuration and approval in the run record.
- Record who approved each threshold and what triggers review.
Common questions
When should a response clock start?
When an eligible ticket with all mandatory evidence enters an accepted state, not when an incomplete email arrives. The card then records Europe/London time, the working calendar, permitted pauses, pause authority and the event that restarts the clock.
Can an operational timer clear a privacy or security decision?
No. Privacy, PECR, security, accessibility, statistical and legal decisions cannot be deemed passed because an operational timer expired. Each needs its own review by a qualified reviewer.
What happens when evidence cannot reproduce a result?
Report unknown and keep the service claim on HOLD. Publish performance only with the card, denominator, period, exclusions, source and uncertainty, and keep missing and unmatched records visible.
