Offboarding and Access Audits for Ad Accounts: A Recurring Checklist

Editorial team Spend Ledger

Why access reviews belong in routine account management

An advertising account is a work tool connected to campaigns, audiences, billing, reporting, business settings and, in some cases, other people’s accounts. Access should reflect who currently needs to perform which work. When a colleague, contractor or agency relationship ends, or when responsibilities change, leaving access untouched can make account ownership and accountability unclear.

An access audit is not a way to work around a platform restriction or to conceal who is responsible for an account. It is a record-keeping and risk-control practice: check who can reach each asset, confirm that access matches current duties, and correct anything that does not. Apply the platform’s rules and use its official support or appeal channels if an access or ownership problem arises.

Use this checklist when someone leaves and at a recurring review. The suitable review rhythm depends on the team’s operating practices and the platform’s requirements. Current access rules, available controls and account policies are published on each platform’s own help and policy pages.

Checklist: prepare for a departure

Before removing access, identify the person’s account identity and the assets they can reach. Do not assume that access to the main advertising account is the only access that matters. A person may also have a role in a business portfolio, page, data source, audience, catalogue, payment setting, reporting workspace or partner relationship. The asset types and controls vary by platform, so use the platform’s current access overview as the working record.

• Confirm the person’s final responsibilities and the point at which those responsibilities end.
• List the advertising accounts and related business assets they can access.
• Identify work that is still in progress, including scheduled campaigns, draft changes and unresolved reviews.
• Assign a current owner for each campaign, report, audience, data source and operational task that needs continued attention.
• Confirm who will handle billing questions, platform notices and support requests after the departure.
• Preserve business records in approved locations, following internal privacy and retention rules.

Coordinate the timing with the appropriate business contact. Removing access too early can interrupt legitimate work; leaving it in place after responsibilities end can create unnecessary exposure. If the person is unavailable or the relationship ends unexpectedly, follow the organisation’s documented process and the platform’s official procedures. Do not ask someone to share a personal password as a substitute for transferring work through supported access controls.

Checklist: remove the person from every relevant asset

Start with the platform’s business-level access view, then check each connected asset separately. A person may have inherited access through a group, business role or partner relationship as well as direct access. Removing a direct role alone may not remove access granted elsewhere. Confirm the result in the platform rather than relying on an old internal list.

• Remove the person’s business-level role where it is no longer needed.
• Review each advertising account and remove or adjust their account-level permissions.
• Check connected pages, profiles or other publishing assets used by campaigns.
• Review data sources, tracking settings, audiences and catalogues that the person could manage.
• Check reporting workspaces and shared files containing campaign or billing information.
• Review partner or agency access, including assets shared through another business.
• Revoke any additional access granted through platform-supported groups or shared workspaces.

For each asset, ask whether the person still appears as an administrator, editor, analyst, advertiser or another role. The exact labels differ across platforms. Also check whether a role permits access to more than the person needs, such as changing payment settings or managing other users. If the interface does not make the scope clear, consult official help or support before changing a role with uncertain effects.

Checklist: rotate shared credentials and review recovery routes

Removing an individual’s platform role does not necessarily end access through shared credentials. Review any shared login, password, recovery channel, authentication method, API credential or other access mechanism used for advertising work. Follow the platform’s rules and the organisation’s security policy. Never use credential sharing to hide who is working on an account or to bypass a platform control.

• Change shared credentials that the departing person could know or access.
• Replace or revoke access tokens and integrations when the platform provides a supported control and the item is no longer required.
• Confirm that authentication devices and recovery methods are controlled by the appropriate current owner.
• Review recovery email addresses and phone numbers for accuracy and authorised access.
• Check that account notices reach a monitored business contact, where the platform supports that arrangement.
• Store updated credentials only through an approved security process; do not circulate them in ordinary messages.

A recovery contact should be able to help an authorised business representative regain access, but should not be a former worker’s personal channel or an unmonitored mailbox. If a recovery setting cannot be changed because ownership or verification is unclear, use the platform’s official support route. Do not submit false information or create another account to get around the issue.

Checklist: reassign campaigns, reports and operational ownership

Access removal is only part of offboarding. Campaigns and records need a responsible owner so that work does not become orphaned. Review both active and paused work, and make sure a current team member understands what is running, what has been changed recently and what requires a decision. Ownership should be explicit in the platform where possible and in the team’s own records.

• Assign a current owner to each campaign that needs monitoring or further editing.
• Transfer responsibility for drafts, scheduled work and unresolved platform notices.
• Reassign reporting tasks and confirm who can access the underlying data.
• Record relevant campaign settings, approvals and business context in an approved location.
• Check that recurring reports or notifications are not routed only to the departing person.
• Review audience and data-source ownership where future campaign work depends on them.
• Confirm that changes do not leave a campaign connected to an asset the business no longer controls.

Do not assume that a new owner automatically understands the previous owner’s decisions. A concise handover record can explain the purpose of the work, the current status and any open questions without exposing unnecessary personal information. Where records contain sensitive or personal data, follow the applicable platform terms and the organisation’s privacy and retention procedures.

Checklist: review partners, agencies and other businesses

Partner relationships can provide access across several assets, and those permissions may remain even when a particular contact leaves. Review the relationship itself, not only the named individuals. Confirm that each partner still has a valid business purpose and that its permissions are limited to the work agreed. If an agency or service provider manages advertising, responsibilities and access should be clear in writing.

• List partner businesses with access to the account or related assets.
• Confirm the business purpose for each active relationship.
• Check which assets are shared and what each partner can do with them.
• Remove access that is no longer required, using the platform’s supported process.
• Confirm who is responsible for campaign changes, billing communication, reporting and support requests.
• Review any written agreement for its access, data handling, handover and termination terms.

A partner’s access should not be treated as a substitute for clear business ownership. Before changing a relationship, check whether the change could interrupt work that the business still needs and arrange a proper handover. If the platform’s record of ownership does not match the business’s documentation, resolve the discrepancy through official support rather than attempting to disguise or transfer control informally.

Checklist: review roles, payment owners and account structure

A recurring role audit should test whether permissions remain appropriate, not merely whether every listed person is familiar. Compare each person’s current duties with the permissions they hold. Look for inactive users, duplicate access, broad administrator rights that are not needed for the role, and permissions granted through more than one route. Check whether the account structure still reflects the business’s actual operating model.

• Confirm that each person has a current business reason to access each asset.
• Check whether their role permits actions beyond their responsibilities, especially user management, billing or business settings.
• Look for people who have access through a group, partner or business-level role as well as directly.
• Confirm that at least one appropriate current business contact can manage routine administration, consistent with platform rules.
• Review payment owners, billing contacts and payment-related permissions.
• Check that payment methods and billing responsibilities belong to the correct business or authorised party.
• Review recovery contacts and notification recipients alongside the role list.

Payment ownership deserves particular care because campaign access and billing responsibility are not always the same. Confirm who is authorised to make payment changes, who receives billing notices and who handles disputes or failed-payment questions. Do not leave a former employee as the sole contact for financial or account-recovery matters. Platform-specific billing arrangements and eligibility rules can change; consult the platform’s current help and policy pages for the applicable requirements.

Checklist: document the audit and set the next review

Record each review in a business-controlled location. The record should make it possible to understand what was checked, what changed and who is responsible for any unresolved item. Avoid keeping passwords or other secrets in the audit log. If a change could not be completed, note the issue and the official support route being followed, without claiming that the platform will resolve it in a particular way.

• Log the review date.
• Record which business, advertising accounts and related assets were checked.
• Note access removed, roles adjusted and partner relationships reviewed.
• Record campaign, report and operational ownership changes.
• Confirm that shared credentials and recovery contacts were reviewed, without writing the credentials themselves.
• Note payment-owner and billing-contact checks.
• Assign an internal owner and next step for any unresolved access or ownership question.

Set the next review according to the team’s operating process, and repeat the checklist when responsibilities or business relationships change. A reliable audit is not a one-time cleanup: it is a way to keep access aligned with real work, make handovers visible and spot changes that need attention. Where the platform’s controls or requirements are uncertain, rely on its official help, policy and support channels, and correct the underlying access or ownership issue rather than trying to bypass it.