Operations
Part of Marketing attribution operations: a controlled workflow
The roles inside an attribution team, from decision owner to release reviewer
Map attribution functions in England using a dated, non-ranked method that separates decisions, data authority, analysis, assurance and release.
Marketing attribution team roles are functions, not a prescribed list of job titles. No job titles, salaries or headcount are given; the article sets out the functions and the evidence each one must produce. One person may hold several functions in a small organisation; the record, not the structure, shows which.
Method: functions were included where an official UK source or government analytical standard gives them a distinct control or evidence responsibility. Research date: 6 September 2026. Scope: attribution operated by organisations in England, with UK-wide privacy and security sources. Inclusions: decision, data authority, analysis, independent challenge, security, accessibility and release. Exclusions: no recruitment advice, headcount, salary, job-market prevalence or universal structure. Ranking: non-ranked. Conflicts: no employer, supplier or recruitment business funded this draft.
What to take away
- Seven functions are in scopedecision, data authority, analysis, independent challenge, security, accessibility and release.
- The operator and the statistical challenger must be different people for any causal claim.
- Every run closes with a responsibility recordfunction, assignee, evidence, decision, date and conflict.
- Where functions collapse onto one person, the record must show which checks that person cannot run alone.
Decision owner
This function states the decision, eligible population, period, acceptable uncertainty and action that may follow. The owner chooses whether unresolved evidence permits a limited decision, requires more work or keeps the output on HOLD. They do not rewrite analytical findings to fit the preferred answer.
HM Treasury presents the Magenta Book as guidance for evaluating government activity. Its separation of process, impact and economic evaluation means the decision record should name the evidence type that answers the question asked and the limit on what may be claimed.
Data authority and privacy review
The data authority confirms which source, fields, people, purpose, environment and period may be used. A qualified privacy and PECR reviewer considers personal-information processing and storage or access technologies. Neither function should be inferred from who can technically export the data.
The ICO's accountability guidance discusses documented responsibilities, contracts, security and continuing review. Parts of that page were under review after the Data (Use and Access) Act 2025 at the research date, so current advice is required.
Analysis operator
The operator builds the event and identity dictionaries, validates inputs, runs the recorded query or model and produces the exception file. They preserve source, code, configuration, dependency and model versions. Platform credit, reconciliation, MMM, experiment support and general analytics must remain separate outputs.
The Government Analysis Function's RAP strategy promotes version control, input validation and documented manual steps in government analysis. A run record should name the code version, the validation checks and any manual step.
Statistical challenger
A second competent function checks eligibility, denominators, missingness, duplicate and unmatched treatment, model assumptions, uncertainty and claim wording. For an incremental-effect claim, the challenger examines the counterfactual and whether implementation preserved the design.
HM Treasury's QPIE guidance explains that monitoring observed outcomes alone does not identify cause. Causal wording needs a written counterfactual, a design check and a named approver before publication.
Security and incident owner
This function approves access, logging, alert handling, change control, incident escalation, rollback and recovery evidence. It should not be the only person able to change production logic and approve the resulting output.
The NCSC's operational security principle covers vulnerability, monitoring, incident and configuration management. It provides assessment questions rather than assurance, so the answers belong in an evidence log for the specific setup.
Accessibility and release reviewer
This reviewer checks whether intended users can complete critical tasks in the configured report, export and correction notice. The release function then verifies review status, permitted claim, audience and withdrawal route before use.
GOV.UK's accessible technology guidance concerns public-sector accessibility and procurement. Its prompts are a starting point rather than a pass, so test the critical tasks with intended users and record the correction route.
Finish with a responsibility record for each run: function, named assignee, evidence, decision, date and conflict. If a required function is unassigned or cannot act independently enough for the risk, keep the release on HOLD.
Example record (illustrative only):
| Function | Assignee | Evidence | Decision | Date | Conflict |
|---|---|---|---|---|---|
| Decision owner | Marketing director | Question brief and signed decision note | Proceed with a limited, non-causal claim | 14 Sep 2026 | None declared |
| Data authority | Data governance lead | Source, field, purpose and retention record | Approve the paid search source to 30 Jun 2026 | 14 Sep 2026 | None declared |
| Analysis operator | Paid search analyst | Query script v4.2 and exception file | Model channel credit as recorded | 14 Sep 2026 | Cannot challenge own output |
| Statistical challenger | Analytics manager, not the operator | Independent re-run and counterfactual check | Reject the incremental claim, keep the descriptive result | 15 Sep 2026 | None declared |
| Release reviewer | Analytics lead | Accessibility check, permitted-claim note and withdrawal route | Release the descriptive report only | 15 Sep 2026 | None declared |
How this maps to team size
The seven functions do not require seven people. What matters is that the operator is never the only evidence reviewer for their own output.
- Two to three peoplethe analyst operates one model and challenges a colleague's different model. Decision and release sit with the team lead. Independent challenge for the analyst's own work needs someone outside the team.
- Five peoplethe analytics lead holds decision and release. Two analysts each operate one model and challenge the other's. A data governance lead covers data authority and privacy. A security engineer covers security and incident response.
- Ten or moreeach function can have a named owner and a named deputy.
Before you act
- State the decision, population, period and acceptable uncertainty.
- Confirm permitted source, fields, people, purpose and period.
- Separate analysis outputs from credit, reconciliation and experiments.
- Check eligibility, denominators, missingness and model assumptions.
- Approve access, logging, change control and incident escalation.
- Verify review status, permitted claim, audience and withdrawal route.
Common questions
Which functions must stay separate?
Analysis and independent challenge must sit with different people whenever a causal claim rests on the analyst's own model. The release reviewer must not be the only person able to change production logic.
What does the responsibility record cover?
Function, named assignee, evidence, decision, date and conflict, completed for each run rather than left as a blank template.
