Backup Administrators and Credential Continuity: Keeping Delivery Running When a Person Is Away

Editorial team Spend Ledger

Treat access as part of campaign continuity

Advertising work depends on more than campaign settings and available budget. Someone must be able to review delivery, handle billing or policy notices, update creative, and respond when an account needs attention. If access rests with one person, an ordinary absence can become an operational problem. A departure, lost device, illness, or unexpected security check can leave colleagues unsure who is authorised to act or how to restore access safely.

Continuity planning is not a way to bypass platform rules, identity checks, restrictions, or verification. It is a way to make sure that the people who are genuinely responsible for the work can access the appropriate tools through the platform’s normal permission system. Each person should use their own login and be identifiable to the platform. If access is blocked or a review is required, the organisation should use the platform’s official support and appeal channels rather than trying to route around the issue.

A useful plan connects access to the structure of the business. It should make clear which business-level settings, advertising accounts, payment arrangements, and campaigns a person is responsible for. It should also specify what a backup administrator may do during an absence and what requires approval. The goal is not to give everyone unrestricted control. It is to avoid a single point of failure while keeping responsibility understandable.

Assign more than one trusted administrator

At least two trusted people should understand how the relevant business and advertising tools are organised, and more than one should have appropriate administrator access where the platform’s permissions allow it. A backup who cannot reach the required settings may be unable to help when the primary administrator is unavailable. On the other hand, granting broad access to people who do not need it increases the consequences of mistakes or compromised credentials.

Choose administrators based on responsibility, reliability, and a legitimate business role. Keep access scoped to what each person needs. One person may manage billing, while another handles campaign operations or account administration; the exact division depends on the organisation and the platform’s permission options. Make sure the backup knows where the relevant accounts sit in the business hierarchy, which work is active, and who approves consequential changes.

Do not treat a backup administrator as a substitute identity. The backup should sign in using their own account, with their own authentication and an accurate representation of their role. Avoid asking a colleague to use someone else’s login, even temporarily. Shared credentials blur the record of who acted, make offboarding harder, and can complicate a security review. If a platform’s access model does not support the arrangement the business needs, check its official guidance or contact support.

Use individual logins and a company-owned password vault

A company-managed password vault can help store and maintain access information without circulating passwords through email, chat, or informal notes. The organisation should own the vault and define who administers it, how access is granted, and how it is recovered if an administrator leaves or becomes unavailable. A personal vault controlled only by one employee may simply move the same continuity problem to another place.

Use the vault for credentials that the organisation is permitted to manage, such as shared operational records or recovery information, while keeping platform sign-ins individual whenever the platform provides individual access. Do not use a vault as a reason to pass one person’s login among a team. Keep stored records limited to what is necessary, protect the vault with strong authentication, and review its membership when roles change.

Separate the vault’s administration from day-to-day campaign work where practical. A person who can manage campaign settings does not automatically need permission to administer every stored secret. Establish a process for requesting and approving access, and ensure that the business can regain control of the vault without relying on the private email or device of a single employee. The vault’s own official help materials should guide setup and recovery, since available controls can change.

A vault is not a complete record of the organisation’s access. It should sit alongside an inventory that describes which business assets exist, who is responsible for them, and how access is granted through the relevant platform. Record the location of the information securely, but do not put passwords or sensitive recovery codes in an ordinary document that is broadly available.

Keep two-step login and recovery under business control

Two-step login adds a further check when someone signs in, but it can create a continuity issue if the only recovery method belongs to one person. Configure authentication in line with the platform’s requirements, and make sure the organisation understands how the authorised administrators can recover access if a device is lost or an employee is away. The precise options vary by platform, so consult its official security and recovery guidance.

Where recovery information is intended to serve the business, store it in a company-controlled, access-restricted place. Do not leave recovery codes in a personal inbox, on an unattended desk, or in a document available to the whole team. Limit access to trusted people with a clear operational need, and record who can use the recovery method and under what circumstances. Recovery details should be protected as carefully as passwords.

Avoid making one employee’s phone number, personal email, or private device the only route back into a business-critical account when the platform offers a compliant alternative. At the same time, do not enter misleading contact details or attempt to conceal who operates an account. Identity and contact information must remain accurate and consistent with platform requirements. If the organisation cannot maintain recovery access without changing those details improperly, ask the platform’s official support channel for guidance.

Test the organisation’s understanding of the recovery process without deliberately triggering a lockout or weakening security. Confirm that designated administrators know where approved recovery information is held and how to reach the official recovery process. Keep a record of the procedure, not a record of secrets in an insecure location.

Document an emergency procedure

A written procedure should help colleagues make sound decisions under pressure. It can begin with how to identify the affected asset, who is the primary administrator, who is the backup, and how each person obtains authorised access. Include where to find the account inventory, the company vault, internal approval guidance, and the platform’s official support and appeal channels. Do not rely on remembered URLs or invented button names; direct staff to the platform’s current help and policy pages.

The procedure should distinguish routine cover from an emergency. During planned leave, a primary administrator can brief the backup on active campaigns, pending changes, billing issues, and any open platform correspondence. The backup should know what they may handle independently and which decisions require a manager or finance approval. For an unexpected absence, the procedure should explain how to confirm the person is unavailable, notify the responsible manager, and activate the approved backup.

Set out how to respond if a device is lost, credentials may have been exposed, or an administrator’s access stops working. The response should prioritise securing the affected login, using the platform’s official account recovery or security process, and notifying the organisation’s relevant security and finance contacts. Do not create a replacement account to evade a restriction or continue activity that the platform has paused. If a policy review or verification is involved, address the underlying issue through the official process.

Keep the document practical and concise enough to use. Store it where authorised staff can reach it during an incident, but restrict sensitive details. A procedure that is technically complete yet inaccessible to the backup does not provide continuity.

Connect access to the account and campaign structure

An access plan is easier to use when it reflects how the advertising operation is actually organised. Document the relationship between the business-level area, advertising accounts, payment responsibilities, and the campaigns or teams that use them. Note who owns each business relationship and who is responsible for maintaining access. If an agency or another service provider is involved, record the agreed scope of its access and the process for changing or ending that access.

Keep ownership, administration, and operational work distinct. The business should understand which assets it controls and how to reach them independently of any individual employee or external service provider. Where an outside party has a legitimate role, use the platform’s normal permission arrangements and agree responsibilities in writing. Do not treat an account supplied by another party as a reason to obscure who controls it or who is operating it.

This structure also supports routine decisions about campaign changes. For example, a backup may be authorised to pause work that is clearly causing a problem, while a larger change to payment arrangements or business ownership may require separate approval. Define those boundaries before an absence occurs. Do not assume that administrator access alone grants authority to make every financial or commercial decision.

Review access when people or responsibilities change

Access continuity is not a one-time setup. Review the administrator list when someone changes role, leaves the organisation, or no longer needs access. Remove or adjust permissions through the platform’s normal controls, and update the vault and recovery arrangements where relevant. Make sure the business retains a trusted administrator who can manage the remaining access without depending on the departing person.

Review the account inventory and emergency procedure when the business changes its structure, adds or retires an advertising account, changes its agency relationship, or updates its internal approval process. Check that the named responsibilities still match the work being done. Where the platform changes its security options or account hierarchy, follow its current help and policy information rather than relying on an old internal description.

A review should also look for unnecessary access, stale recovery details, and unclear ownership. If access cannot be removed or transferred through the available controls, do not try improvised workarounds. Contact the platform through its official support channel and keep a record of the steps taken. For a suspension, verification request, or other restriction, use the platform’s appeal or support route and address the stated cause.

Make continuity a normal security practice

The most resilient arrangement is transparent and understandable: each operator uses an individual login; trusted backups have appropriate permissions; the business controls its vault and recovery information; and a written procedure explains what to do when the usual administrator is away. These practices reduce dependence on personal memory and personal devices without weakening platform checks.

Keep the plan proportionate to the business. Too little access can make ordinary cover impossible, while excessive access can increase the impact of error or compromise. Assign roles deliberately, explain them to the people involved, and make sure a backup can find the right information without being given authority they do not need.

Continuity is ultimately about preserving responsible operation, not guaranteeing uninterrupted delivery. Platforms can require verification, restrict access, or pause activity, and an organisation must respect those decisions. A sound internal process helps the team respond calmly, use official channels, and maintain an accurate record of who is responsible for the advertising work.