Careers
Part of Reading programmatic advertising with a sceptical eye
Programmatic advertising checklist, from first line to sign-off
Programmatic advertising checklist covers scope, suppliers, access, data, creative, supply, auctions, measurement, invoices, incidents, and exit readiness.
What to take away
- Turn every checkbox into an owner, artifact, date, and decision.
- Review supplier security and service dependencies, not only media performance.
- The launch gate should include tested pause, recovery, export, and exit procedures.
- Block launch while any mandatory privacy, security, data-quality, accessibility, or correction failure stays open, whatever the remaining score says.
A programmatic advertising checklist is a signoff record, not a substitute for judgment. Adapt the controls to the market, contract, inventory, data, claim, customer, and risk.
The sequence runs in nine steps.
- Businessoutcome, budget, capacity, risk, and stop rule.
- Commercialentities, fees, audit, credits, and exit.
- Supply and supplierssellers, deals, exclusions, monitoring, and vendor dependencies.
- Creativeclaims, rights, disclosure, accessibility, and expiry.
- Datapurpose, permission, fields, retention, and deletion.
- Measurementunits, vendors, filtering, and reconciliation.
- Securityroles, authentication, logs, recovery, and incidents.
- Financecost bases, invoices, credits, and cash timing.
- Pilotfailure tests, exceptions, owners, dates, and sign-off.
Programmatic campaign build checklist
Treat the controls below as account-level checks that supplement the nine-step sequence. Example platforms include Google Display & Video 360, The Trade Desk, and Amazon DSP; supply platforms include Google Ad Manager, Magnite, PubMatic, and Index Exchange. Record the selected DSP, SSP or exchange, and ad server, such as Campaign Manager 360, with the account owner and evidence location.
Campaign setup and trafficking
- Plan and booking — Owner: media buyer.Map the approved media plan to the insertion order (IO), campaign, and line items. Record dates, geography, formats, placements, targeting, exclusions, bid strategy, budget, pacing, and frequency settings. Evidence: approved plan, IO, and DSP export. Pass when the export matches the approved booking or a documented exception is approved.
- Trafficking and launch QA — Owner: ad operations.Check creative IDs, ad server tags, macros, impression and click trackers, landing-page URLs, redirects, and campaign naming. Preview each creative and destination combination, test tags and events, and verify pause controls. Evidence: trafficking sheet and test results. Pass when every required test succeeds and defects are resolved before release.
Supply, privacy, and measurement
- Deals and inventory — Owner: programmatic trader.Record whether buying through an open auction, private marketplace (PMP), private auction, or preferred deal; verify the deal ID, seller, inventory, and supply path. Check publisher declarations in ads.txt or app-ads.txt, seller identities in sellers.json, and the OpenRTB SupplyChain Object against the contracted path. Use IAB Tech Lab standards, including OpenRTB, where applicable. Evidence: deal settings and supply-path review. Pass when the selected inventory and intermediaries match the approved plan and contract.
- Privacy and audience data — Owner: privacy or data lead.Confirm which laws apply, including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and the General Data Protection Regulation (GDPR) where applicable. Document the consent approach, such as the IAB Transparency and Consent Framework, Global Privacy Platform (GPP), or Google Consent Mode where relevant, and test that signals reach the ad tech partners. Treat Unified ID 2.0 (UID2), RampID, and data clean rooms as optional solutions; approve their specific data use and permissions before activation. Evidence: documented review and signal-test results. Pass when the approved purpose, permissions, and signals match the campaign configuration.
- Measurement and verification — Owner: measurement lead.Define the reporting source and calculation for CPM, vCPM, CPC, CPA, and ROAS, as applicable, along with attribution and reconciliation rules. Specify viewability, brand-safety, and invalid-traffic requirements using applicable Media Rating Council (MRC) standards; name contracted verification vendors such as Integral Ad Science (IAS) or DoubleVerify. Evidence: measurement plan and vendor reports. Pass when test events and reporting reconcile to the agreed definitions and requirements.
Supplier and system gate
NIST Special Publication 800-161 Revision 1 Update 1 provides cybersecurity supply-chain risk management practices that support checklist item 3 on suppliers.
Eight gates before launch
- Businesscustomer, offer, outcome, budget, stop rule
- Commercialentities, agent status, fees, audit, exit
- Supplypublishers, sellers, deals, exclusions, monitoring
- Creativeclaims, rights, disclosure, formats, expiry
- Dataorigin, purpose, permission, retention, deletion
- Measurementunits, vendors, filtering, reconciliation
- Securityaccounts, roles, authentication, logs, incidents
- Financecost bases, invoices, taxes, credits, cash timing
| Gate | Evidence | Owner |
|---|---|---|
| Business | Customer, offer, outcome, budget, capacity, risk, and stop rule | Business lead |
| Commercial | Legal entities, agent or principal status, scope, fees, audit, credits, and exit | Procurement and counsel |
| Supply | Publishers, apps, sellers, nodes, deals, contexts, exclusions, and monitoring | Media lead |
| Creative | Claims, rights, disclosure, formats, accessibility, feed, page, and expiry | Creative and legal |
| Data | Origin, purpose, permission, fields, identity, retention, sharing, and deletion | Privacy and data |
| Measurement | Units, vendors, filtering, outcomes, maturity, experiments, and reconciliation | Analytics |
| Security | Accounts, roles, authentication, integrations, logs, recovery, and incidents | Security |
| Finance | Cost bases, invoices, taxes, credits, net value, and cash timing | Finance |
- Confirm current seller and inventory evidence
- Preview every creative and destination combination
- Test events from impression through mature business outcome
- Set pacing, quality, frequency, cost, and incident alerts
- Record administrators, vendors, tokens, and emergency contacts
- Approve launch, rejection, exception, and expiry dates
Run the gate on a representative pilot, not an empty account. Include a disapproved creative, unsuitable placement, missing event, user removal, invoice variance, and platform outage. The team should demonstrate the response and preserve its evidence. A pilot that surfaces these failures also answers common programmatic advertising questions about who owns each fix.
Access and recovery gate
In Display & Video 360, confirm administrator and billing roles, the partner-level and advertiser-level user assignments, the per-partner user limit, and service account and API access. Confirm the role held by each person: administrator, standard, read-only, or reporting.
Apply the business's own identity, approval, review, and offboarding standards on top of the vendor defaults. Remove access when a contract or role ends, and keep the offboarding ticket.
- Business-controlled administrator and billing access verified
- Individual accounts used instead of shared credentials
- Least privilege tested for agencies and vendors
- Recovery contacts and authentication methods current
- API and linked-product access inventoried
- Exports and a bounded replacement drill completed
Close the checklist with unresolved risks, accepted exceptions, compensating controls, owners, deadlines, and a final authority decision. Reopen it after a material platform, contract, supply, data, creative, event, agency, or legal change. A material platform change is also the moment to trace supply paths and reconcile costs, as the guide to improving programmatic advertising sets out.
Record the gate result
The W3C Privacy Principles statement gives web-system designers shared privacy concepts that support checklist item 5 on data, and the governing law still decides the local case.
The CISA software acquisition fact sheet sets out development, supply-chain, deployment, and vulnerability questions that support checklist item 7 on security.
The contract sets the binding tolerance; the figures below are typical starting points.
| Control | Typical pass | Fail example |
|---|---|---|
| Daily pacing | Spend within 10 percent of the planned daily figure | Three days beyond 10 percent with no logged cause |
| Invoice | Within 2 percent of the contracted fee | Variance above 2 percent without a credit note |
| Event match | Within 5 percent of the platform event count | Gap above 5 percent open for more than 48 hours |
| Placement | No spend on excluded inventory | Any impression bought from an exclusion entry |
| Access | No shared logins, no orphaned users | A vendor login active after the contract end date |
For every checklist item, record pass, fail, not applicable, or accepted exception. Add the evidence location, reviewer, decision date, and next review. A checked box without proof cannot protect a release.
An accepted exception still needs an owner, a compensating control, and an expiry date. That register is how teams avoid repeating the same programmatic advertising mistakes.
Common questions
Should every campaign use the same checklist?
Use a common control spine, then add requirements for the specific market, inventory, data, claims, vendors, and risk.
What blocks launch?
Block launch for unresolved legal, customer, security, claim, data, supply, measurement, payment, or recovery failures beyond the approved tolerance.
How often should access be checked?
Review it on a risk-based schedule and immediately after staffing, agency, integration, security, or ownership changes.
