Social Media Audit Template

In plain language: Identifies the auditor (agency or consultant) and the client as legal entities, defines which platforms and accounts are in scope, and records the date the audit engagement begins.

Common mistake: Listing platform handles by display name rather than unique account URL or ID. Display names can be changed; account URLs provide a permanent audit trail.

In plain language: Specifies how the auditor will receive and handle login credentials, admin permissions, and read-only access tokens — and what happens to those credentials when the audit concludes.

Common mistake: Granting full admin access when read-only or analyst-level access is sufficient. Excess permissions create liability if the auditor account is compromised during the engagement.

In plain language: Prevents the auditor from disclosing the client's audience data, performance metrics, or strategic findings to third parties — and prevents the client from misrepresenting the audit conclusions externally.

Common mistake: Using only a mutual NDA and not including audit-specific confidentiality language in the audit document itself. The NDA may not cover forward-looking strategic recommendations produced during the engagement.

In plain language: Documents the tools, date ranges, and metrics used to collect data — so findings can be reproduced, disputed, or updated with comparable parameters in a future audit.

Common mistake: Omitting the measurement period from the methodology. A follower count or engagement rate without a defined date range is meaningless for benchmarking or year-over-year comparison.

In plain language: Requires the auditor to flag any content, advertising claims, or account practices that violate platform terms of service, applicable advertising standards, or data privacy regulations.

Common mistake: Limiting the compliance review to content only and ignoring advertising account settings, pixel configurations, and data collection practices — all of which are subject to platform policy and privacy law enforcement.

In plain language: Defines the format, content, and delivery date of the written audit report — including the specific sections, charts, and benchmarks the client is entitled to receive.

Common mistake: Not specifying the deliverable format or deadline in the engagement clause. Disputes over what was promised are the most common reason audit engagements end in client dissatisfaction.

In plain language: Allocates responsibility for fixing identified issues — distinguishing what the auditor will fix, what the client must fix, and the timeline for completing remediation before follow-up review.

Common mistake: Leaving remediation responsibility ambiguous. When neither party has explicit ownership, critical compliance violations can remain unaddressed — creating regulatory or reputational exposure for the client.

In plain language: Clarifies who owns the audit report, the methodology, the underlying data, and any strategic frameworks or templates used — and what rights the client has to reuse or share the deliverable.

Common mistake: Assuming the client automatically owns the full report because they paid for it. Without an IP clause, the default in many jurisdictions is that the creator (auditor) retains copyright in the deliverable.

In plain language: Caps the auditor's financial exposure for errors, omissions, or missed compliance issues — and disclaims liability for platform algorithm changes or policy updates that occur after the audit date.

Common mistake: Omitting a liability cap entirely. Without one, an auditor who misses a critical ad policy violation can face claims disproportionate to the audit fee — especially if the client's account is subsequently suspended.

In plain language: Specifies which jurisdiction's laws govern the agreement and how disagreements over findings, deliverables, or fees are resolved.

Common mistake: Selecting a governing law that has no connection to where either party operates. Courts in several jurisdictions apply local consumer or service-provider protection laws regardless of the contractual choice.

A social media audit is a structured review of every social media account associated with a business — assessing platform presence, content quality, engagement performance, brand consistency, and compliance with platform policies and advertising regulations. When conducted formally between an agency and a client, it is documented in a signed agreement that binds both parties to the findings and any agreed remediation steps.

A signed audit agreement protects both parties. For the auditor, it caps liability for missed findings, establishes IP ownership over the methodology and deliverables, and defines exactly what was promised. For the client, it creates an enforceable obligation to receive a specific deliverable by a specific date, and it governs how confidential analytics data and strategic findings are handled and disclosed. Without a signed document, either party can dispute what was agreed.

At minimum, audit every platform where the business has an active account. A complete audit also inventories inactive or legacy accounts — these are frequently overlooked but remain visible to the public and can contain outdated claims, old branding, or abandoned advertising pixels that still collect user data. Common platforms to include are Facebook, Instagram, LinkedIn, X (Twitter), TikTok, YouTube, Pinterest, and Google Business Profile.

Most marketing professionals recommend a formal audit at least twice per year for active brands, and at the start of any new agency engagement. Trigger-based audits are also warranted before a product launch or rebrand, following a platform policy update that could affect compliance status, or when a business is being acquired and the buyer needs to assess digital presence as part of due diligence.

Analyst or read-only access to native platform analytics is sufficient for most audits — covering follower demographics, reach, impressions, engagement rates, and posting history. Paid advertising audits also require access to ad account data, pixel configurations, and audience targeting settings. The access clause in the audit agreement should specify the exact permission level required for each platform and confirm that all credentials are revoked upon audit completion.

A compliance-focused audit reviews content against platform terms of service, FTC or ASA disclosure requirements for sponsored posts and influencer partnerships, advertising policy violations (prohibited claims, targeting restrictions), and data privacy obligations such as GDPR consent for pixel-based tracking and CCPA disclosures for California users. High- severity findings typically require immediate corrective action to avoid account suspension or regulatory enforcement.

Ownership depends on what the agreement says. Without an explicit IP clause, the default in most common-law jurisdictions is that the creator of the work — the auditor — retains copyright. Most audit agreements grant the client a non-exclusive license to use the report for internal purposes, while the auditor retains ownership of the underlying methodology and templates. If the client intends to publish or share findings externally, this must be addressed explicitly in the agreement.

A social media audit is a point-in-time comprehensive assessment covering all platforms, compliance status, and strategic positioning — typically conducted at the start of an engagement or annually. A social media report is a recurring performance review for a defined period, usually monthly or quarterly, covering agreed KPIs for accounts already under management. An audit produces a baseline and recommendations; a report tracks progress against that baseline.

For straightforward domestic agency-client engagements, a well-drafted template is typically sufficient. Legal review is advisable when the client operates in a regulated industry such as financial services, healthcare, or pharmaceuticals, where social media content carries heightened compliance risk; when the engagement involves cross-border data flows subject to GDPR; or when the audit fee exceeds a threshold where the liability cap could expose meaningful financial risk to either party. A one-hour review typically costs $200–$400 and is worthwhile for enterprise-scale engagements.