A marketing risk register is a short, scored list of risks that could derail a campaign’s commercial, brand, or compliance outcomes. Each risk should have a named owner, clear mitigation, and review date.
Most enterprise marketing teams already have something similar: a “risks and mitigations” slide in the planning deck that rarely gets revisited once the budget is approved.
Company-wide risk processes do not always fill that gap. In the 2025 AICPA and NC State survey of 273 US organizations, only 27% of executives said their enterprise risk process would help them manage a significant event affecting reputation and brand.
The problem is usually unclear ownership. A risk listed without an owner, score, review date, or action threshold is little more than a concern.
This guide explains how to identify and score marketing risks, assign ownership, set escalation thresholds, and build a practical risk register that helps enterprise teams make informed decisions and keep campaigns on track.
Marketing risk management is the process of identifying, assessing, and controlling risks that could affect a campaign's performance, brand reputation, or compliance. A campaign risk register documents these risks, their likelihood and impact, assigned owners, mitigation plans, escalation triggers, and review dates.
Unlike company-wide risk management, this approach focuses on campaign-specific exposures and decisions marketing leaders can influence before launch and during execution.
Marketing risk management focuses on risks affecting campaign execution and outcomes, while enterprise risk management (ERM) addresses threats across the entire organization. Marketing teams manage campaign-level exposures, but risks involving legal, cybersecurity, financial, or operational functions may require escalation to enterprise risk owners.
These risks mostly overlap. A campaign's unsubstantiated advertising claim, for example, could create regulatory exposure beyond the marketing department.
At the briefing stage, define which risks require escalation, who receives them, and what score or event triggers a review. Keep the campaign register focused on marketing decisions while flagging cross-functional risks to the appropriate teams.
A risk register tracks specific threats, assigns owners, scores their likelihood and impact, and defines mitigation actions. SWOT and PESTLE analyses help teams understand strategic conditions, while project plans organize tasks and deadlines. An enterprise risk register tracks broader organizational exposures.
| Tool | What it captures | Scored and owned? | Updated during campaign? | Best use |
|---|---|---|---|---|
| SWOT or PESTLE | Broad strengths, threats and external forces | No | Rarely | Framing strategy before a brief exists |
| Project plan | Tasks, dependencies and dates | Owned, not scored | Yes, for schedule | Sequencing delivery |
| ERM register | Company-wide exposures | Yes | Quarterly or annually | Board and audit oversight |
| Campaign risk register | Specific campaign exposures with triggers | Yes, one owner per row | At every gate and weekly in flight | Changing launch decisions |
Marketing risks are the specific ways a campaign can lose money, damage the brand, or breach a rule, and they cluster into four areas that map to how most enterprise teams are organized.
Market risks, such as a competitor price cut or a shift in demand, sit upstream in strategy; log them only when they could change a launch decision. Each category below should become a concrete register line with a trigger.
The common ones are:
Each becomes a row when you add the trigger: "claim substantiation not received by week two" is actionable; "regulatory risk" is not. Teams that test creative before it is locked tend to catch these earlier; structured creative testing gives that check a method.
Regulators do act on these rows. In 2025, the UK's Advertising Standards Authority resolved over 40,000 complaints about 25,397 ads, and 22,383 ads were amended or removed as a result of its work.
Here the exposures are:
The last one gets its own treatment in the scoring section below.
Three exposures sit here:
Any new first-party data capture belongs on this list. European data protection authorities issued about €1.2 billion in GDPR fines in 2025, bringing the total since 2018 to €7.1 billion, per DLA Piper's annual survey.
A fourth area, execution and partner risk, covers unclear ownership between internal teams and agencies, approval bottlenecks and scope creep, and it is usually the one that makes the other three worse.
| Typical trigger | Who usually owns it | Early warning signal | |
|---|---|---|---|
| Brand and creative | Claim or concept not validated before lock | Brand or creative lead with legal | Substantiation or test results missing at a gate |
| Media and measurement | Plan approved on platform-reported return only | Media lead with measurement lead | No holdout or read date in the media plan |
| Data privacy and compliance | New data capture or new vendor added | Marketing operations with privacy counsel | Consent language or data-processing terms unreviewed |
| Execution and partner | Decision rights unclear between teams | Campaign owner | Same question raised in two meetings without a decision |
Pro tip: Before any scoring, run a 30-minute cross-functional session and list the campaign's exposures under these four areas. Scoring comes next.
Copy the field list below into whatever planning tool your team already uses, then populate the first five rows for your next major campaign. The value of a structured, repeatable register is that it stops the team relying on memory and last-minute reactions; the fields force the same questions every time.
| Field | What to enter | Example entry | Who fills it |
|---|---|---|---|
| Risk ID | Unique reference code | BR-03 | Register owner |
| Description and trigger | What could happen and what would cause it | Hero claim lacks substantiation if testing is delayed | Area lead |
| Risk area | Brand, media, compliance or execution | Brand and creative | Area lead |
| Likelihood (1–5) | Probability of occurrence | 3 | Area lead |
| Impact (1–5) | Severity of consequences | 5 | Area lead with legal or finance |
| Risk score | Likelihood × impact | 15 | Calculated |
| Owner | Named person responsible for action | Legal lead | Register owner |
| Response type | Avoid, reduce, transfer or accept | Reduce | Risk owner |
| Mitigation action | Preventive step and deadline | Complete claim substantiation before creative lock | Risk owner |
| Contingency | Action if the risk occurs | Use a pre-approved alternative claim | Risk owner |
| Escalation trigger | Score or event requiring a decision | Score ≥15 or missed testing deadline | Risk owner |
| Review date | Next review checkpoint | Creative lock | Register owner |
| Status | Open, mitigated, materialized or closed | Open | Risk owner |
The example entries are hypothetical. Each completed row should show what could go wrong, how serious the consequences might be, who is responsible, and when the team needs to act.
Rate each marketing risk's likelihood and impact on a consistent 1–5 scale. Multiply both values to calculate a risk score between 1 and 25. Higher scores generally require greater attention, although serious compliance or reputational risks may need escalation regardless of their score.
Define the scoring levels before assessment so marketing, creative, media, and legal teams evaluate risks consistently.
For likelihood, use observable conditions:
For impact, consider financial loss, campaign delays, reputational damage, and regulatory consequences.
These definitions are illustrative. Adapt them to your organization's budget, risk tolerance, and campaign complexity.
Mitigation actions should address the specific trigger. For example, a campaign involving an unverified product claim may require substantiation testing and legal approval before creative lock.
Each campaign risk should have one named owner responsible for monitoring exposure, coordinating mitigation, and escalating decisions. The owner should have the authority to act or a clear escalation path to someone who does.
Agency partners can own risks within their operational control. For example, a media agency may manage brand-safety monitoring, while the internal marketing lead retains responsibility for major budget or campaign decisions.
Every risk also needs a documented response:
Set review dates around key campaign milestones or changes in exposure. High-priority risks may need weekly monitoring, while lower-priority risks can follow a less frequent schedule.
Keep the register manageable by prioritizing material risks, closing resolved items, and reviewing new exposures as campaigns evolve.
Three kinds of rows deserve more care than the scoring rules alone provide: brand reputation, compliance and media spend. A wrong score on a routine delivery risk costs a few days. A wrong score on these can cost the campaign.
Score impact on the worst credible case. A substantiation gap that has never caused trouble before tempts teams to score impact as a 2. The relevant question is what happens in the realistic bad outcome: a regulator's inquiry, a competitor complaint or a journalist's question.
In the US, a civil penalty for violating an FTC order or trade regulation rule can reach $53,088 per violation, the 2025 level the agency is keeping for 2026.
The brand lead and legal lead should set this level jointly, because each sees half the exposure. For privacy rows, the same logic applies and the evaluation needs more than legal sign-off. The signal that a privacy mitigation worked includes consent rates and complaint volume after launch, alongside compliant copy.
Those signals matter commercially: in Cisco's 2024 survey of 2,600 consumers in 12 countries, more than 75% said they won't buy from an organization they don't trust with their data.
A media plan approved on a platform's own attributed return carries a risk that belongs on the register in its own right: the number may overstate what the spend actually caused. The mitigation is a holdout or geo-based incrementality test with a defined read date, after which the row is re-scored. Your attribution model decides how much weight the platform number gets in the first place.
For example, a channel scored as low risk on reported return might show a smaller incremental lift in a holdout, moving its budget pacing from accept to reduce. That re-score is the register doing its job. Write the scoring rules for media rows in advance so a measurement team's score can be challenged.
The timing is rarely convenient. Gartner's 2026 CMO Spend Survey of 401 marketing leaders found budgets flat at 7.8% of company revenue, and 56% of CMOs said they lack the budget to deliver their 2026 strategy. Budget pressure is when teams are most tempted to skip the holdout because the reported number already looks good.
For each mitigated row, record three things: the success signal defined before launch, the observed outcome, and whether the score should move. Without a signal defined in advance, the observed outcome can't tell you whether the mitigation did anything.
| High-stakes row | Impact definition | Mitigation | Evidence that it worked |
|---|---|---|---|
| Unsubstantiated hero claim | Worst credible case: pulled campaign or regulatory finding | Substantiation test before creative lock; pre-cleared fallback claim | Test report on file; no claim challenge in the first review period |
| Brand-unsafe placement | Sustained negative coverage or partner withdrawal | Inclusion lists and verification vendor on the media plan | Placement audit shows exposure within agreed threshold |
| Optimistic platform attribution | Budget shifted to a channel that isn't driving incremental sales | Geo holdout with read date before next budget reallocation | Incremental lift measured; pacing adjusted to match |
| Consent gap on new data capture | Regulatory complaint or forced list deletion | Counsel review of consent flow; vendor data terms signed | Consent rate stable; complaint volume at or below baseline |
Pick the three highest-score rows on your own register and write a one-line evaluation signal for each before launch. If the signal can't be written, the mitigation isn't specific enough yet to be evaluated. The same discipline applies when a media partner owns the row: the reviewer checks the signal.
A risk register fits into campaign workflow when it rides on five checkpoints you already hold: brief, creative lock, media plan sign-off, the weekly standup, and the retrospective. Assign one owner to run it.
The slowdown objection usually assumes a new governance layer. Done properly, the register is five agenda items in meetings that already exist.
This sequence means the register is never more than one gate out of date.
Escalation needs two pre-agreed rules.
The first is a score threshold that triggers a decision by a named leader: for instance, any row at 15 or above goes to the head of growth within 48 hours.
The second is a pre-written contingency on every high-score row, so that when a risk materializes, the team can act at once.
For example, a weekly media standup notes that a channel's brand-safety audit has crossed the threshold; the row is escalated with its contingency already attached, the head of growth confirms the pause, and the budget moves to the pre-agreed alternative the same day. The decision took minutes because the thinking was done at creative lock.
Durability depends on the single owner. That person prunes closed rows, adds new ones when the brief changes, and refuses to let the register become a graveyard of items nobody will close. A register with 40 open rows usually signals failed ownership.
Not every campaign needs the full template. Use a light version, five rows and a single review at launch, for routine activity: always-on media, recurring email, small regional promotions. Reserve the full template for anything above an agreed budget threshold, anything with a new claim, a new market or a new data capture, and anything involving a partner the team hasn't worked with before.
Write the threshold down so the choice isn't relitigated every quarter. The agency relationship matters here too: if a partner runs the campaign day to day, it should run the register day to day, with the internal lead holding the escalation decisions.
Scale also depends on who else can see the exposure. A campaign that looks small from marketing's desk may carry a disproportionate compliance or reputational exposure once legal or investor relations sees it. Ask once, at brief, whether anyone outside marketing should see the register.
A campaign risk register pays for itself in most enterprise contexts, though the honest answer is that the return shows up as losses that didn't happen, which are harder to put on a slide than a conversion rate.
The cost is mostly time: the exposure session, a few minutes at each gate, the weekly review and one owner's ongoing attention. For a major launch, a rough tally might be ten to fifteen hours across a quarter, spread over several people.
There is no software to buy; the existing planning tool is enough. The one real cost is the discipline of writing scoring definitions once, which takes one cross-functional meeting before the first campaign uses the register.
The return appears as avoided creative re-shoots, fewer pulled assets, less media committed to channels whose incremental value was never tested, and fewer compliance rewrites after launch. None of those come with a reliable industry percentage, and we won't attach one.
Research on enterprise programs offers indirect support: a Wisconsin School of Business study of insurers with ERM programs linked a dedicated risk manager who reports to the board or C-suite with higher efficiency and return on assets. It covers company-wide programs at insurers, so treat it as context for a campaign register. We're not aware of a study that measures register return for marketing specifically.
Marketing risks usually emerge between teams. An unsubstantiated claim involves creative and legal. Inaccurate attribution affects media and measurement. Data consent issues may involve operations, vendors, and legal teams. Managing these risks requires clear ownership and coordination across disciplines.
At Fieldtrip, we bring specialist teams together through shared strategy and consistent quality standards. This approach helps identify risks early, assign responsibility, and address potential issues before they affect campaign performance.
Start with one campaign, identify the most significant risks, and assign an owner to each. Expand the register as needed, using it to guide decisions rather than add unnecessary processes.
If you're planning a campaign where creative, media, measurement, and compliance risks overlap, talk to Fieldtrip about building a more coordinated approach to managing them.
One person owns the document, and that person should sit wherever the campaign is run day to day. If the agency runs delivery, the agency's campaign lead owns the register and the internal marketing lead owns escalation decisions. Individual rows go to whoever controls the mitigation, on either side.
Cap open high-score rows at around ten for a major launch and five for routine activity. Beyond that, attention spreads too thin, and the weekly review stops changing anything. If a new row arrives above the cap, something else gets mitigated, accepted, or closed.
Execute the pre-written contingency, escalate to the named leader at the agreed threshold, and record the outcome against the row. At the retrospective, ask whether the score, the mitigation, or the trigger definition was wrong, and adjust the scoring rules so the next campaign benefits.
Name the interface at brief: which rows, above which score, get reported to legal, security, or the corporate risk owner, and at what cadence. The campaign register stays focused on marketing-controlled risks; anything touching cyber, supply chain, or financial exposure is flagged upward rather than managed in the register.
Yes, whenever a budget decision depends on it. The row's trigger is a reallocation made on reported return alone, the mitigation is a holdout or geo test with a read date, and the row closes when incremental lift has been measured and pacing adjusted.
