Skip to content
Free resource

Client onboarding checklist for paid traffic agencies

Use the eight phases to prepare a new client, document decisions, and launch campaigns with clear responsibilities.

Progress stays only in this browser. We do not ask for email or personal data.

Overview

Checklist by phase

Check an item when its completion criterion is proven.

Your progress

Phase 1

Closing and formalization

Confirm the agreement, start, and administrative terms.

  • Welcome and next steps

    The client received the welcome message, start date, and onboarding sequence.

    View full guidance
  • Scope and deliverables

    Services, channels, deliverables, limits, and responsibilities are described without ambiguity.

    View full guidance
  • Contract formalized

    The contract has been signed and the start date is confirmed.

    View full guidance
  • Billing and tax invoice ready

    Payment method, due dates, financial contact, and tax requirements are defined.

    View full guidance

Phase 2

Expectations and communication

Define owners, channels, deadlines, and decision methods.

  • Owners on each side

    Owners are named for strategy, operations, creative, approval, and finance.

    View full guidance
  • Official communication channel

    The official channel and the topics that must go through it are defined.

    View full guidance
  • Meeting and status routine

    The frequency, participants, agenda, and status format are agreed.

    View full guidance
  • Approval deadline

    Deadlines, owners, and the effect of approval delays are agreed.

    View full guidance
  • Lead feedback and escalation

    When applicable

    There is an owner for lead feedback and a path for urgent problems.

    View full guidance

Phase 3

Briefing and diagnosis

Understand the business, goals, budget, and restrictions.

  • Business and offer

    The business model, offer, differentiators, price, and delivery capacity have been understood.

    View full guidance
  • Audience and market

    Priority segments, regions, needs, and exclusions are defined.

    View full guidance
  • Goals, indicators, and baseline

    Objectives, indicators, period, and baseline are defined.

    View full guidance
  • Budget and seasonality

    Investment, limits, calendar, and seasonal periods are confirmed.

    View full guidance
  • Sales funnel and SLA

    When applicable

    The funnel stages, owners, and lead response time are defined.

    View full guidance
  • History, brand, and compliance

    Previous learnings, brand rules, and legal or industry restrictions are recorded.

    View full guidance
  • Historical campaign audit

    When applicable

    Previous objectives, campaign types, offers, creatives, audiences, and outcomes were reviewed under consistent conversion definitions.

    View full guidance

Phase 4

Files, assets, and access

Organize materials and grant only the necessary access.

  • Central file folder

    There is an official folder with a defined structure, owners, and permissions.

    View full guidance
  • Brand and creative assets available

    Logos, guides, images, videos, fonts, and usage rights are available.

    View full guidance
  • Client account inventory

    The required accounts, their owners, and identifiers are recorded.

    View full guidance
  • Delegated access

    The agency received partner or user invitations to the required accounts.

    View full guidance
  • Least privilege applied

    Each person has only the permissions required for their role.

    View full guidance
  • Two-factor authentication

    2FA is active for all users and platforms that offer the feature.

    View full guidance
  • Password manager policy

    Exceptional use of shared credentials follows a policy in a secure vault.

    View full guidance
  • Access register and revocation

    There is an up-to-date register of access, owners, dates, and a revocation plan.

    View full guidance
  • Technical website and CMS access

    When applicable

    The CMS, hosting, domain, forms, and technical owners are inventoried with named access and a rollback plan.

    View full guidance

Phase 5

Measurement and integrations

Plan conversions, data, and the complete lead flow.

  • Website and landing pages ready

    When applicable

    Each destination page is published, works on desktop and mobile, and leads to the expected action without a critical error.

    View full guidance
  • End-to-end conversion path test

    When applicable

    Each path used by campaigns has been tested from the ad through lead receipt and handling.

    View full guidance
  • Conversion measurement plan

    Each conversion has a purpose, event, source, counting rule, value, priority, and owner.

    View full guidance
  • Tag manager configured

    When applicable

    The container is present on in-scope pages, and tags, triggers, variables, consent, and publishing follow the measurement plan.

    View full guidance
  • Google Analytics 4 configured

    When applicable

    The account, property, web stream, time zone, currency, collection, retention, key events, access, and Google Ads link are validated.

    View full guidance
  • Google Search Console configured

    When applicable

    The correct property is verified, access is named, the sitemap is submitted, and priority URLs were inspected.

    View full guidance
  • Website behavior monitoring

    When applicable

    A tool such as Microsoft Clarity or Hotjar is installed, respects consent, and masks sensitive data.

    View full guidance
  • Pixels and server events

    When applicable

    The applicable Meta Pixel or dataset, Google tag, and server events fire without duplication and with validated consent.

    View full guidance
  • CRM pipeline and qualification

    When applicable

    Stages, entry and exit criteria, owners, loss reasons, and service level are configured in the CRM.

    View full guidance
  • Lead routing and alerts

    When applicable

    Each source sends the lead to the correct destination and owner with an alert, deduplication, and failure handling.

    View full guidance
  • Offline conversion feedback

    When applicable

    Commercial stages useful for optimization are mapped and, when applicable, returned to the correct platform.

    View full guidance
  • UTM and naming standard

    Campaign, group or ad set, ad, creative, and UTM conventions are documented and preserved through the destination.

    View full guidance
  • Privacy and data governance

    Purpose, consent, retention, owners, and data access are defined.

    View full guidance

Phase 6

Media platforms

Audit each channel's accounts, billing, and settings.

  • Google Ads account, access, and billing

    When applicable

    Ownership, users, billing, time zone, currency, 2FA, and auto-tagging have been checked before campaign creation.

    View full guidance
  • Google Ads goals and conversions

    When applicable

    Each conversion action is active, not duplicated, and configured for its intended reporting and optimization use.

    View full guidance
  • Google Ads audience baseline

    When applicable

    Segments needed for observation, remarketing, and exclusion have been created with coherent sources and durations.

    View full guidance
  • Google Ads automation and history

    When applicable

    Automatically applied recommendations, rules, scripts, and previous changes have been reviewed and have a recorded decision.

    View full guidance
  • Google Ads columns and views

    When applicable

    Campaigns, groups, ads, keywords, terms, and landing pages have saved views suited to the operation.

    View full guidance
  • Meta Ads assets, access, and continuity

    When applicable

    The business portfolio, ad account, page, Instagram, domain, dataset, billing, 2FA, and owners have been audited.

    View full guidance
  • Meta Ads domain and events

    When applicable

    The domain, dataset, Pixel, and applicable browser and server events are linked, tested, and not duplicated.

    View full guidance
  • Meta Ads audiences and exclusions

    When applicable

    Required audiences and exclusions have the correct source, window, purpose, and access.

    View full guidance
  • Meta Ads reporting and controls

    When applicable

    Attribution, columns, spending limits, rules, and automated recommendations match the approved plan.

    View full guidance
  • Google Business Profile configured, formerly Google My Business

    When applicable

    The correct profile was found or created without duplication, is client controlled, and has reviewed location, contact, hours, website, and media.

    View full guidance
  • YouTube channel prepared

    When applicable

    The official channel, ownership, permissions, usable videos, and applicable Google Ads link are confirmed.

    View full guidance
  • Google Merchant Center prepared

    When applicable

    The account, website, product source, countries, shipping, returns, brand, diagnostics, and applicable advertising link are valid.

    View full guidance
  • Additional scoped channels

    When applicable

    Each additional channel beyond those detailed in this checklist has validated ownership, billing, content, and applicable measurement.

    View full guidance

Phase 7

Operations and reporting

Approve the roadmap and establish sources of truth.

  • Strategy and roadmap approved

    Priorities, hypotheses, deliverables, owners, and the initial sequence have been approved.

    View full guidance
  • Creative testing buffer

    When applicable

    Approved variants beyond the initial launch are tied to hypotheses about offer, angle, format, and audience.

    View full guidance
  • Lead tracking adopted

    When applicable

    The sales team demonstrated that it can record lead source, status, quality, and outcome in the official CRM or spreadsheet.

    View full guidance
  • Reports and sources of truth

    Indicators, definitions, sources, filters, time zone, currency, refresh, and reconciliation are defined.

    View full guidance
  • Scheduled report delivery

    When applicable

    Frequency, format, time, recipients, and delivery channel have been defined and tested.

    View full guidance

Phase 8

Launch and first 30 days

Run QA, monitor the start, and review the data.

  • Final QA before launch

    Goal, conversion, budget, bid, geography, language, schedule, networks, placements, audiences, ads, URLs, and tracking have been reviewed.

    View full guidance
  • Launch and initial monitoring

    Campaigns have launched and delivery, spend, conversions, leads, and critical website signals are monitored at the start.

    View full guidance
  • Initial client status routine

    When applicable

    The frequency and format of status updates for the first days are agreed, with owners and a condition for reducing cadence.

    View full guidance
  • 30-day review and reconciliation

    Results, lead quality, learnings, and differences between sources have been reviewed for the same period, time zone, and attribution window.

    View full guidance

Items marked as when applicable depend on the client's scope, channels, and operations.

Execution guide

How to complete each item

Review the reason, execution, evidence, and security precautions for each step.

1

Closing and formalization

Confirm the agreement, start, and administrative terms.

Item 1

Welcome and next steps

The client received the welcome message, start date, and onboarding sequence.

Why it matters
A clear start reduces questions and shows what each side will do first.
How to do it
Send an objective message with owners, the initial schedule, and upcoming milestones.
Completion evidence
Message delivered and next steps confirmed by the responsible contact.
Security and conditions
Share only the necessary operational information, without unnecessary personal data.
Item 3

Scope and deliverables

Services, channels, deliverables, limits, and responsibilities are described without ambiguity.

Why it matters
The scope guides priorities and prevents expectations that are not part of the agreement.
How to do it
Record what is included, what is not, and who approves each deliverable.
Completion evidence
Scope document approved by both parties.
Security and conditions
Do not include access details or credentials in the scope document.
Item 4

Contract formalized

The contract has been signed and the start date is confirmed.

Why it matters
Formalization protects responsibilities, deadlines, and commercial terms.
How to do it
Validate the parties, scope, term, cancellation, and signatures before starting execution.
Completion evidence
Contract signed and stored in the client's official folder.
Security and conditions
Restrict contract access to the people who need to consult it.
Item 5

Billing and tax invoice ready

Payment method, due dates, financial contact, and tax requirements are defined.

Why it matters
Agreeing on the financial routine before the start reduces interruptions to operations.
How to do it
Confirm amounts, dates, payment method, tax invoice issuance, and the contact for outstanding issues.
Completion evidence
Financial schedule recorded and confirmed by the client.
Security and conditions
Use authorized providers and never send sensitive financial data in open messages.
2

Expectations and communication

Define owners, channels, deadlines, and decision methods.

Item 6

Owners on each side

Owners are named for strategy, operations, creative, approval, and finance.

Why it matters
Clear responsibilities prevent stalled decisions and requests without an owner.
How to do it
Create a short list with each role, name, and backup when needed.
Completion evidence
Responsibility map validated by the agency and the client.
Security and conditions
Record only the professional details needed for the work.
Item 7

Official communication channel

The official channel and the topics that must go through it are defined.

Why it matters
A known channel preserves context and reduces lost decisions.
How to do it
Choose the channel, name the participants, and agree where approvals and urgent matters are recorded.
Completion evidence
Active channel with shared rules of use.
Security and conditions
Do not use the channel to exchange passwords, 2FA codes, or sensitive documents.
Item 8

Meeting and status routine

The frequency, participants, agenda, and status format are agreed.

Why it matters
A predictable cadence reduces improvised meetings and keeps decisions visible.
How to do it
Define checkpoints, a standard agenda, and the person responsible for recording decisions.
Completion evidence
Recurring schedule and status template confirmed.
Security and conditions
Invite only the necessary participants and control access to recordings.
Item 9

Approval deadline

Deadlines, owners, and the effect of approval delays are agreed.

Why it matters
Campaigns depend on timely decisions to follow the schedule.
How to do it
Define a deadline for each type of deliverable and what happens when there is no response.
Completion evidence
Approval flow recorded and accepted by both parties.
Security and conditions
Approval must come from an authorized person and remain on record.
Item 10When applicable

Lead feedback and escalation

There is an owner for lead feedback and a path for urgent problems.

Why it matters
Perceived quality in the sales process complements platform data.
How to do it
Define frequency, quality criteria, and who to contact when relevant deviations occur.
Completion evidence
Owner, routine, and escalation criteria documented.
Security and conditions
Share aggregated analyses and avoid exposing leads' personal data.
3

Briefing and diagnosis

Understand the business, goals, budget, and restrictions.

Item 11

Business and offer

The business model, offer, differentiators, price, and delivery capacity have been understood.

Why it matters
Media must reflect what the client actually sells and can deliver.
How to do it
Conduct the briefing with examples of offers, objections, and commercial criteria.
Completion evidence
Offer summary approved by the client.
Security and conditions
Restrict confidential commercial information to the team involved.
Item 12

Audience and market

Priority segments, regions, needs, and exclusions are defined.

Why it matters
A clear focus guides the message, channels, and budget allocation.
How to do it
Combine client data, commercial history, and verifiable market research.
Completion evidence
Priority profiles and exclusions recorded in the briefing.
Security and conditions
Do not use personal lists without an adequate legal basis, purpose, and authorization.
Item 13

Goals, indicators, and baseline

Objectives, indicators, period, and baseline are defined.

Why it matters
Without a common reference, results can be evaluated by different criteria.
How to do it
Choose indicators linked to the business and record the available data before launch.
Completion evidence
Goals table with the definition, source, and period of each indicator.
Security and conditions
Grant data access only to those who need to analyze it.
Item 14

Budget and seasonality

Investment, limits, calendar, and seasonal periods are confirmed.

Why it matters
Budget and seasonality determine the pace, coverage, and testing priorities.
How to do it
Record the budget by channel, billing restrictions, and relevant commercial dates.
Completion evidence
Investment plan approved by the financial owner.
Security and conditions
Do not change limits or billing without recorded authorization.
Item 15When applicable

Sales funnel and SLA

The funnel stages, owners, and lead response time are defined.

Why it matters
Media and sales need to measure the same journey through to the commercial result.
How to do it
Map entry, qualification, contact, progression, loss, and the return of feedback.
Completion evidence
Funnel flow and SLA validated by the sales team.
Security and conditions
Use minimal data and permissions compatible with each person's role.
Item 16

History, brand, and compliance

Previous learnings, brand rules, and legal or industry restrictions are recorded.

Why it matters
These limits prevent repeated mistakes and inappropriate messages from being published.
How to do it
Review previous campaigns, brand guides, required approvals, and channel policies.
Completion evidence
Approved summary of learnings and restrictions.
Security and conditions
Do not circumvent platform policies or use assets without authorization.
Item 17When applicable

Historical campaign audit

Previous objectives, campaign types, offers, creatives, audiences, and outcomes were reviewed under consistent conversion definitions.

Why it matters
Account history provides evidence the briefing alone cannot reveal and prevents repeating failed tests.
How to do it
Set a comparable period and review objectives, campaign types, promotions, creatives, audiences, terms, locations, and placements; connect spend and conversions to lead quality.
Completion evidence
The audit separates proven learnings, hypotheses, data gaps, and decisions for the new plan.
Security and conditions
Review only authorized accounts and do not export more data than necessary.
Step by step
  1. Choose a comparable period and confirm which actions counted as conversions in each platform and in the CRM.
  2. Review the objectives and campaign types, budget distribution, offers, and promotions used during that period.
  3. Compare ads, creatives, messages, audiences, search terms, locations, and placements, separating delivery metrics from commercial outcomes.
  4. Connect spend, conversions, and cost to lead statuses such as replied, interested, opportunity, and sale when those data are available.
  5. Classify each conclusion as evidence, a hypothesis, or a data gap, then record what to repeat, stop, or test differently.
4

Files, assets, and access

Organize materials and grant only the necessary access.

Item 18

Central file folder

There is an official folder with a defined structure, owners, and permissions.

Why it matters
A central source prevents duplicate versions and scattered materials.
How to do it
Create folders by purpose and define naming and archiving standards.
Completion evidence
Shared folder accessible to authorized people.
Security and conditions
Prefer individual access, review permissions, and avoid public links.
Item 19

Brand and creative assets available

Logos, guides, images, videos, fonts, and usage rights are available.

Why it matters
Complete assets speed up production and reduce incorrect use of the brand.
How to do it
Request editable formats, approved versions, and the validity of usage authorizations.
Completion evidence
Asset inventory reviewed and organized in the central folder.
Security and conditions
Confirm usage rights and restrict materials that have not yet been published.
Item 20

Client account inventory

The required accounts, their owners, and identifiers are recorded.

Why it matters
The inventory reveals gaps without transferring ownership to the agency.
How to do it
List media, analytics, website, CRM, and other assets within the scope.
Completion evidence
Inventory validated by a client administrator.
Security and conditions
The accounts must belong to the client, never to the agency's personal profiles.
Item 21

Delegated access

The agency received partner or user invitations to the required accounts.

Why it matters
Delegated access keeps ownership, auditing, and revocation under the client's control.
How to do it
Ask the administrator to invite the company or each professional through the official feature.
Completion evidence
Invitations accepted and access tested without using the client's credentials.
Security and conditions
Never request a personal login, a password by message, or remote access as the standard method.
Item 22

Least privilege applied

Each person has only the permissions required for their role.

Why it matters
Limited permissions reduce errors, exposure, and the impact of compromised accounts.
How to do it
Map tasks by role and remove unnecessary administrative privileges.
Completion evidence
Permission matrix reviewed by a client administrator.
Security and conditions
Do not grant administrative access for convenience.
Item 23

Two-factor authentication

2FA is active for all users and platforms that offer the feature.

Why it matters
The second factor reduces the risk of access after a password leak.
How to do it
Enable 2FA for each user and keep recovery methods under the account holder's control.
Completion evidence
2FA confirmation in each account's security panel.
Security and conditions
Never share temporary codes or recovery keys in messages.
Item 24

Password manager policy

Exceptional use of shared credentials follows a policy in a secure vault.

Why it matters
A vault reduces scattered copies when delegation is not available.
How to do it
Prioritize invitations. If unavoidable, use a business vault, named access, and rotation.
Completion evidence
Approved policy and item shared only with authorized people.
Security and conditions
Never send passwords by WhatsApp, email, or document. The vault is an exception.
Item 25

Access register and revocation

There is an up-to-date register of access, owners, dates, and a revocation plan.

Why it matters
Control makes audits, team changes, and secure contract termination easier.
How to do it
Record each invitation, review it periodically, and define who revokes access during offboarding.
Completion evidence
Register checked and revocation procedure documented.
Security and conditions
Revoke access immediately when the role or contract ends.
Item 26When applicable

Technical website and CMS access

The CMS, hosting, domain, forms, and technical owners are inventoried with named access and a rollback plan.

Why it matters
Measurement and landing pages depend on safe website changes and a clear recovery path.
How to do it
Identify the CMS, such as WordPress when used, hosting, DNS, forms, checkout, and repository; request named invitations and agree on backup, staging, and rollback before editing.
Completion evidence
Access was tested in every required system, owners were recorded, and the backup and rollback procedure was approved.
Security and conditions
Do not request client passwords or change themes, DNS, or production without authorization and a backup.
Step by step
  1. List the CMS, such as WordPress when applicable, hosting, domain and DNS provider, forms, checkout, and code repository used by the site.
  2. Confirm the owner and technical contact for each system and request a named invitation through the official access feature instead of receiving a client password.
  3. Test whether the assigned role supports only the scoped changes and record who authorizes production changes.
  4. Before editing, confirm a recent backup, a staging environment when available, and a rollback procedure with an owner and deadline.
  5. Perform a harmless inspection or controlled change to validate access, then record unavailable systems, blockers, and next owners.
5

Measurement and integrations

Plan conversions, data, and the complete lead flow.

Item 27When applicable

Website and landing pages ready

Each destination page is published, works on desktop and mobile, and leads to the expected action without a critical error.

Why it matters
The campaign loses value when the page prevents navigation, contact, or purchase.
How to do it
Review the offer, CTA, form fields, contact buttons, links, redirects, confirmation page, policies, responsiveness, and speed.
Completion evidence
A QA script is completed for each URL on the defined devices and browsers, with issues and owners recorded.
Security and conditions
Do not collect more data than necessary and protect forms against abuse.
Step by step
  1. Open every final URL on desktop and mobile, then confirm the value proposition, offer, CTA, form, phone number, WhatsApp, and every planned contact path.
  2. Submit each form with fictitious data and test validation, error messages, the confirmation page, and redirects.
  3. Review policies, consent, HTTPS, broken links, perceived speed, and any element that covers or blocks the primary action.
  4. Record each issue by URL, device, impact, owner, and deadline. Repeat the test after the fix before approving the campaign for launch.
Item 28When applicable

End-to-end conversion path test

Each path used by campaigns has been tested from the ad through lead receipt and handling.

Why it matters
A page can look ready while losing the source, failing to submit, or not alerting the sales team.
How to do it
Open every campaign URL on desktop and mobile with test UTMs, complete the action with fictitious data, and confirm the thank-you page, CRM record, and owner alert.
Completion evidence
A test log by source records the URL, time, result, CRM destination, and fixes for any failures.
Security and conditions
Use fictitious data and remove test records when they are no longer needed.
Step by step
  1. Create test UTMs for every source that will be used and open the complete URL in a clean session on desktop and mobile.
  2. Complete the action with a fictitious lead and record the time, page, form, expected event, and confirmation message.
  3. Confirm in analytics and the advertising platform that the conversion occurred once with the correct source and parameters.
  4. Find the record in the CRM, check its owner and alert, and confirm that the team can move the lead to the next status.
  5. Fix any issue, repeat the complete journey, and remove the fictitious data when it is no longer needed as evidence.
Item 29

Conversion measurement plan

Each conversion has a purpose, event, source, counting rule, value, priority, and owner.

Why it matters
The plan connects user actions to the results used in decisions.
How to do it
List primary and supporting actions, then define the event name, trigger point, source, count, value, optimization use, and test method for each one.
Completion evidence
The measurement map is approved before implementation, with no duplicate events or undefined purpose.
Security and conditions
Collect only necessary data and respect consent and applicable policies.
Item 30When applicable

Tag manager configured

The container is present on in-scope pages, and tags, triggers, variables, consent, and publishing follow the measurement plan.

Why it matters
Controlled tag management reduces untested changes and duplicate measurement.
How to do it
Map each action, test it in Preview and Tag Assistant on critical pages and forms, and publish a named version after approval.
Completion evidence
Each event occurred once without duplication, and the published version records the changes.
Security and conditions
Limit who can publish and do not insert scripts from unknown sources.
Step by step
  1. Turn the measurement plan into an event table with the action, page or element, variables, destination, and expected result.
  2. Confirm that the container belongs to the client, is installed in every in-scope template, and has no second installation duplicating tags.
  3. Create or review tags, triggers, and only the required variables. Prefer the dataLayer or stable signals over fragile layout selectors.
  4. Open Preview and Tag Assistant on the exact URL, complete the journey from the landing page, and check the event, values, fired tags, and tags that should remain inactive.
  5. Confirm delivery in GA4 DebugView, Google Ads, or Meta according to the destination, then fix duplicate events, empty parameters, and overly broad triggers.
  6. Test every consent state and publish a named version with a description, date, and owner only after approval.
Item 32When applicable

Google Analytics 4 configured

The account, property, web stream, time zone, currency, collection, retention, key events, access, and Google Ads link are validated.

Why it matters
GA4 organizes acquisition and behavior, but only helps when events arrive once in the correct stream.
How to do it
Find existing properties and streams, then validate the Google tag, events, key events, DebugView, Realtime, internal traffic, unwanted referrals, retention, reporting identity, attribution, and Google Ads link.
Completion evidence
Delegated access works and a test journey appears in the correct stream with the expected events, parameters, and key events.
Security and conditions
Keep the client as owner, use least privilege, and do not send unnecessary personal data in events.
Step by step
  1. Find the existing account, property, and web data stream before creating anything and confirm that the client owns them.
  2. Review the stream URL, time zone, currency, and Google tag installation strategy to avoid duplicate measurement through both the site and GTM.
  3. Map recommended and custom events, their parameters, and which business outcomes should be marked as key events.
  4. Enable debug mode, run the journey, and confirm in DebugView and Realtime the event name, parameters, and one trigger per action.
  5. Review internal traffic, unwanted referrals, data collection, retention, reporting identity, and attribution under the approved governance.
  6. Link GA4 to Google Ads, enable only necessary sharing, and decide which imported events are primary or secondary.
Item 33When applicable

Google Search Console configured

The correct property is verified, access is named, the sitemap is submitted, and priority URLs were inspected.

Why it matters
Search Console shows whether Google can discover, crawl, and index acquisition pages.
How to do it
Find an existing property, prefer a Domain property when DNS control is available, verify ownership, submit the sitemap, and inspect the homepage and priority landing pages.
Completion evidence
The property, verification method, users, sitemap, status, and indexing issues are recorded.
Security and conditions
The client controls the domain and DNS. Do not request registrar credentials or change records without authorization and rollback.
Step by step
  1. Search for existing properties and confirm with the domain owner which protocols and subdomains need coverage.
  2. Create or validate a Domain property through authorized DNS access; use a URL-prefix property only when the scope requires that boundary.
  3. Keep the verification method active and add named users with the lowest permission sufficient for their work.
  4. Confirm the sitemap opens without authentication, is not blocked, and was submitted in the Sitemaps report with a success status.
  5. Inspect the homepage and priority landing pages, then record blocks, unexpected preferred URLs, non-indexed pages, security issues, or manual actions.
Item 34When applicable

Website behavior monitoring

A tool such as Microsoft Clarity or Hotjar is installed, respects consent, and masks sensitive data.

Why it matters
Recordings and heatmaps reveal friction that media and conversion metrics do not explain.
How to do it
Choose a tool, install it through a controlled method, exclude sensitive fields and pages, enable masking, validate consent, and link it to Analytics when useful.
Completion evidence
Sessions and heatmaps reach the correct project without capturing sensitive content.
Security and conditions
Do not record passwords, personal data, authenticated areas, checkout, or payment information.
Step by step
  1. Choose Microsoft Clarity, Hotjar, or an equivalent tool based on the question that session recordings and heatmaps need to answer.
  2. Create the project under client control and install it through GTM, an official integration, or a reviewed technical implementation.
  3. Configure consent, text and field masking, and exclusions for login, checkout, authenticated areas, and other sensitive pages.
  4. Run a fictitious session, wait for processing, and confirm the URL, device, recording, and heatmap in the correct project without exposing sensitive content.
  5. Connect it to GA4 only when there is a defined use, and record retention, owners, people with access, and the review date.
Item 35When applicable

Pixels and server events

The applicable Meta Pixel or dataset, Google tag, and server events fire without duplication and with validated consent.

Why it matters
Consistent events support attribution, audiences, and campaign optimization.
How to do it
Implement only the approved plan and validate the browser, server, conversion linker, testing tools, and deduplication.
Completion evidence
Test events reached the platforms with the expected names, parameters, consent, and count.
Security and conditions
Do not send sensitive data or prohibited parameters to the platforms.
Item 36When applicable

CRM pipeline and qualification

Stages, entry and exit criteria, owners, loss reasons, and service level are configured in the CRM.

Why it matters
Without clear states, the agency cannot distinguish slow follow-up, an invalid lead, and a real opportunity.
How to do it
Adapt stages such as new, contacted, replied, qualified, opportunity, won, lost, invalid, duplicate, and spam; define who updates each stage and by when.
Completion evidence
The published pipeline includes approved definitions, owners, and classification examples for the sales team.
Security and conditions
Restrict sensitive fields and permissions according to each user's role.
Step by step
  1. Audit the current pipeline and list sources, fields, owners, automations, and reports before changing any stage.
  2. Define statuses with clear criteria, such as new, contacted, replied, interested or qualified, opportunity, won, lost, invalid, duplicate, and spam.
  3. Set the entry rule, exit rule, owner, and SLA for each status, and configure loss reasons that distinguish service, customer fit, and offer issues.
  4. Preserve source, campaign, and UTMs in dedicated fields, and require only the fields that the team can consistently update.
  5. Move a fictitious lead from entry to won or lost and confirm that the history can reconstruct the complete follow-up.
Item 37When applicable

Lead routing and alerts

Each source sends the lead to the correct destination and owner with an alert, deduplication, and failure handling.

Why it matters
Website forms, native lead forms, WhatsApp, and other sources can fail in different ways.
How to do it
Test each form, WhatsApp, and other source separately; confirm fields, UTMs, owner, alert, deduplication, retry, and fallback when the integration fails.
Completion evidence
A source matrix records the fictitious lead received, time, owner, alert, and result of a simulated failure when possible.
Security and conditions
Use official integrations, fictitious data, and never expose lead content in public alerts.
Step by step
  1. List website forms, native lead forms, WhatsApp, phone, checkout, and every other lead source separately.
  2. For each source, define the destination, fields, owner, distribution rule, alert, deduplication, retry, and fallback.
  3. Send one fictitious lead from each source and record the time, test identifier, received fields, assigned owner, and delivered alert.
  4. Simulate a safe failure when possible and confirm that the integration records the error, retries, or alerts the owner without losing the lead.
  5. Fix discrepancies and repeat the test until every source reaches the correct pipeline with UTMs preserved.
Item 38When applicable

Offline conversion feedback

Commercial stages useful for optimization are mapped and, when applicable, returned to the correct platform.

Why it matters
A click or form alone does not show whether the lead qualified, became an opportunity, or generated revenue.
How to do it
Define which stages return as an offline conversion, along with identifiers, window, value, and consent; test one fictitious record end to end through an official integration.
Completion evidence
The test event appears in the correct destination without duplication, and the mapping from CRM stage to conversion is documented.
Security and conditions
Send only permitted fields with the lawful basis, protection, and handling required by the platform.
Step by step
  1. Choose commercial stages that represent real value, such as qualified, opportunity, sale, or revenue, instead of returning every CRM movement.
  2. For each offline conversion, define the matching identifier, name, window, value, currency, consent, and destination platform.
  3. Configure the official integration or a controlled import and document how duplicates and updates will be handled.
  4. Use a fictitious record, advance its status, and confirm that the event appears under the correct action without creating a second conversion for the same outcome.
  5. Record latency, match rate, failures, and the owner responsible for periodic integration reviews.
Item 39

UTM and naming standard

Campaign, group or ad set, ad, creative, and UTM conventions are documented and preserved through the destination.

Why it matters
Consistent names make analysis, search, and reconciliation across sources easier.
How to do it
Define vocabulary and required fields by level; standardize utm_source, utm_medium, utm_campaign and, when used, utm_content and utm_term; test redirects and link shorteners.
Completion evidence
The published standard and a test URL reach the page and analytics with names and UTMs intact.
Security and conditions
Do not place personal data or confidential information in URLs and names.
Item 40

Privacy and data governance

Purpose, consent, retention, owners, and data access are defined.

Why it matters
Governance reduces excessive collection and use of data outside the stated purpose.
How to do it
Map the data collected, applicable basis, destinations, retention, and deletion process.
Completion evidence
Data map and privacy decisions approved by the client.
Security and conditions
Do not activate collection without adequate need, authorization, and protection.
6

Media platforms

Audit each channel's accounts, billing, and settings.

Item 46When applicable

Meta Ads assets, access, and continuity

The business portfolio, ad account, page, Instagram, domain, dataset, billing, 2FA, and owners have been audited.

Why it matters
Client-owned and correctly linked assets reduce operational blockers and dependence on one person.
How to do it
Record asset IDs and ownership, confirm partners and permissions, billing, business verification when applicable, 2FA, at least two client owners, and official recovery contacts and steps.
Completion evidence
The continuity plan records assets, links, administrators, recovery, billing, and issues without depending on one person.
Security and conditions
Do not share personal logins or create multiple business portfolios or reserve accounts to bypass restrictions.
Step by step
  1. Inventory the business portfolio, Page, professional Instagram account, ad account, dataset or Pixel, catalog, domain, and phone or WhatsApp number used in ads.
  2. Record the ID and owner of each asset and confirm that legitimate assets belong to the client, not to an employee or former agency.
  3. Connect the Page and Instagram account when applicable, and grant partner or user access only to the required assets and tasks.
  4. Validate billing, limits, 2FA, business verification when required, and at least two authorized client administrators for continuity.
  5. Document links, permissions, contacts, and official recovery without creating backup profiles, portfolios, or accounts to evade restrictions.
Item 47When applicable

Meta Ads domain and events

The domain, dataset, Pixel, and applicable browser and server events are linked, tested, and not duplicated.

Why it matters
Correct assets do not compensate for missing, duplicated, or misrouted events.
How to do it
Validate the domain and dataset, priority business events, permitted parameters, browser and server delivery, event_id deduplication, match quality, and Events Manager diagnostics.
Completion evidence
Test events appear in the correct dataset with origin, parameters, deduplication, and critical alerts resolved or assigned.
Security and conditions
Do not send sensitive data or customer information outside the parameters and handling permitted by Meta.
Step by step
  1. Confirm the correct domain and dataset, then map each funnel event to a standard event only when there is a real match.
  2. Validate the browser Pixel on every required page and check the event name, URL, parameters, value, currency, and number of fires.
  3. Add Conversions API or another server-side send only for planned events, with the required consent and permitted data handling.
  4. When the browser and server send the same action, use the same event name and matching identifier for deduplication, then confirm a single conversion.
  5. Test the journey in Events Manager and resolve diagnostics, match quality, and coverage issues with an owner and deadline.
Item 48When applicable

Meta Ads audiences and exclusions

Required audiences and exclusions have the correct source, window, purpose, and access.

Why it matters
Separating prospecting, re-engagement, and converters prevents overlap and unsuitable messaging.
How to do it
Create visitors, key pages, Instagram or Facebook engagement, video viewers, lead form starters or submissions, converters, and permitted customers; set matching windows and exclusions.
Completion evidence
The inventory lists each audience's name, source, window, availability, authorized account, and intended use.
Security and conditions
Use customer lists only with authorization, a lawful basis, and handling accepted by the platform.
Step by step
  1. Create Custom Audiences for visitors, key pages, events, Facebook or Instagram engagement, video, and forms according to the plan.
  2. Separate journey stages and retention windows, recording the source, rule, duration, purpose, and authorized account.
  3. Create converter and permitted customer audiences to exclude them from prospecting campaigns or incompatible messages.
  4. When using Advantage+ audience, confirm which selections are controls and which may be expanded before considering targeting complete.
  5. Grant access only to the correct account and validate availability, initial size, and exclusions inside the applicable campaign.
Item 49When applicable

Meta Ads reporting and controls

Attribution, columns, spending limits, rules, and automated recommendations match the approved plan.

Why it matters
The team needs a shared view of delivery and cost and must prevent unexpected financial automation.
How to do it
Configure columns for delivery, spend, reach, frequency, link CTR, CPC, landing page views, results, and cost per result; review attribution, limits, rules, and automated recommendations.
Completion evidence
A saved operating view and register of limits, rules, recommendations, and adopted decisions.
Security and conditions
Continuity must use legitimate client assets, approved administrators, and official recovery, never reserve accounts to bypass restrictions.
Step by step
  1. Save a view with delivery, spend, impressions, CPM, reach, frequency, link clicks, link CTR, CPC, and landing page views.
  2. Add results, conversion rate, cost per result, and objective-specific metrics without mixing different lead definitions.
  3. Review the attribution window and document how it will be compared with GA4, the CRM, and the report.
  4. Audit spending limits, rules, and automated recommendations, then record whether to keep, change, or disable each one, with a reason and owner.
  5. Test the view in the correct account and confirm that all continuity arrangements use legitimate assets and official recovery.
Item 50When applicable

Google Business Profile configured, formerly Google My Business

The correct profile was found or created without duplication, is client controlled, and has reviewed location, contact, hours, website, and media.

Why it matters
For local businesses, the profile is a discovery, contact, and trust surface that must match the real operation.
How to do it
Search name, address, and phone before creating; claim or verify the profile, then review category, location or service area, phone, hours, website, description, photos, and applicable products or services.
Completion evidence
The profile is verified or verification has an owner, users are correct, fields and media were reviewed, and issues are documented.
Security and conditions
The client remains primary owner. The agency is a manager and never receives verification codes or the Google account password.
Step by step
  1. Search Google and Maps for the exact business name, city, location, and phone number to find the correct profile and avoid duplication.
  2. If it exists, request official ownership or access; if it does not, add the business and assign the Google-offered verification step to the client.
  3. Review real business name, primary and additional categories, address or service area, map pin, phone, website, description, and regular and special hours.
  4. Add logo, cover, storefront, interior, team, and other real photos that help people recognize the business and its products or services.
  5. Add products or services when applicable and confirm that price, description, link, and availability match the real offer.
  6. Add the agency as manager, keep the client as primary owner, and record verification, users, reviewed fields, and open issues.
Item 51When applicable

YouTube channel prepared

The official channel, ownership, permissions, usable videos, and applicable Google Ads link are confirmed.

Why it matters
Video campaigns depend on the correct channel and assets without sharing the client's Google account.
How to do it
Locate the official channel, request YouTube Studio permission, review identity, links, videos, and usage rights, and link the channel to Google Ads when the plan requires it.
Completion evidence
Channel URL and ID, assigned role, video inventory, and Google Ads link status are recorded.
Security and conditions
Use channel permissions. Never share the Google account password and grant management rights only when necessary.
Step by step
  1. Locate the official channel and confirm its URL, ID, owner, and whether another channel could cause the wrong asset to be used.
  2. Request access through YouTube Studio channel permissions and choose Viewer, Editor, or Manager according to the actual task.
  3. Review name, handle, description, links, contact, logo, banner, existing videos, visibility, and advertising usage rights.
  4. Confirm that campaign videos have the required visibility and that the approved destination uses the correct video.
  5. When required, link the channel to Google Ads, approve the request in the correct account, and record sharing permissions and status.
Item 52When applicable

Google Merchant Center prepared

The account, website, product source, countries, shipping, returns, brand, diagnostics, and applicable advertising link are valid.

Why it matters
Shopping and catalog campaigns depend on product data that matches the website and real commercial terms.
How to do it
Confirm the existing account and ownership, verify the website, configure an integration or feed, review a product sample, set shipping and regions, complete business information, and resolve Needs attention issues.
Completion evidence
The source is processed, products are approved, policies are configured, required links are active, and disapprovals are resolved or assigned.
Security and conditions
Do not advertise prices, stock, shipping, or policies that differ from the website, and do not create a duplicate account before investigating the existing one.
Step by step
  1. Look for an existing account and confirm owner, legal name, address, country, website, contacts, and responsible people before creating another.
  2. Verify and claim the website through an authorized method and choose the countries where the business actually sells, aligning language, currency, and landing pages.
  3. Configure the product source through an ecommerce integration, feed, file, API, automatic source, or eligible manual entry, and document who maintains it.
  4. Review a product sample: title, description, image, price, availability, identifiers, brand, and specific URL must match the website.
  5. Configure shipping, delivery time, returns, and served regions to match the website, then complete business information and branding.
  6. Open Needs attention, fix account issues before product disapprovals, and record approved quantity, warnings, and owners.
Item 53When applicable

Additional scoped channels

Each additional channel beyond those detailed in this checklist has validated ownership, billing, content, and applicable measurement.

Why it matters
TikTok, LinkedIn, marketplaces, and other channels have their own dependencies that must not remain implicit.
How to do it
Create a channel-specific list for account, ownership, access, billing, assets, policy, destination, measurement, diagnostics, and owner.
Completion evidence
The channel checklist records configuration, testing, issues, owner, and launch decision.
Security and conditions
Use official resources, follow policies, and remove unnecessary accounts or permissions.
7

Operations and reporting

Approve the roadmap and establish sources of truth.

Item 54

Strategy and roadmap approved

Priorities, hypotheses, deliverables, owners, and the initial sequence have been approved.

Why it matters
The roadmap turns the diagnosis into executable, ordered decisions.
How to do it
Present choices, dependencies, risks, and criteria for moving forward or adjusting.
Completion evidence
Roadmap approved by the client's owner.
Security and conditions
Do not promise guaranteed results or propose practices that violate policies.
Step by step
  1. Combine the briefing, historical audit, access inventory, measurement plan, brand restrictions, and sales capacity into one decision base.
  2. Define hypotheses by channel, audience, offer, creative, and destination, making the evidence behind each choice explicit.
  3. Allocate the initial budget, testing sequence, dependencies, and criteria for keeping, adjusting, pausing, or scaling each workstream.
  4. Present risks and likely failure modes, including approval delays, page failures, incomplete measurement, and missing commercial feedback.
  5. Record the client's approval, owners, dates, and roadmap deliverables before starting production or launch.
Item 55When applicable

Creative testing buffer

Approved variants beyond the initial launch are tied to hypotheses about offer, angle, format, and audience.

Why it matters
A buffer prevents work from stopping when a creative fatigues, is rejected, or needs a new hypothesis.
How to do it
Map hypotheses, formats, and channel ratios, produce extra named variants, and record what changes in each version and which test it supports.
Completion evidence
The library contains approved launch and replacement assets with hypothesis, format, rights, and approval status.
Security and conditions
Confirm image, brand, audio, testimonial, and talent rights before using any variant.
Step by step
  1. Turn the approved hypotheses into a matrix of offer, angle, message, format, aspect ratio, audience, and funnel stage.
  2. Define the quantity required for launch and produce enough additional variants to replace assets or open new tests.
  3. Name each file with its hypothesis, format, and version, and record exactly what changes between variants.
  4. Review copy, identity, image and audio rights, channel specifications, URL, and consistency with the landing page.
  5. Obtain approval and organize the library into launch, reserve, and rejected assets, including the reason and intended next use.
Item 56When applicable

Lead tracking adopted

The sales team demonstrated that it can record lead source, status, quality, and outcome in the official CRM or spreadsheet.

Why it matters
A configured pipeline does not help if the team does not update the data returned to the agency.
How to do it
Choose the CRM or spreadsheet as the official source, configure fields and loss reasons, train the owner with examples, and move a test lead through closure.
Completion evidence
The test shows source, owner, status changes, final reason, and the feedback routine.
Security and conditions
Use fictitious data for training and restrict access to real lead data.
Step by step
  1. Choose the CRM or spreadsheet as the official source and configure source, campaign, contact, owner, status, quality, and loss reason.
  2. Define who updates each field and within what timeframe, including examples of replied, interested, opportunity, won, and lost.
  3. Train the sales owner with a fictitious lead and show how to correct its status, duplication, and incorrect source.
  4. Follow the test lead through closure and confirm that the agency can review its history and receive quality feedback.
  5. Record the review routine and treat missing updates as an operational blocker, not as proof that advertising produced no result.
Item 57

Reports and sources of truth

Indicators, definitions, sources, filters, time zone, currency, refresh, and reconciliation are defined.

Why it matters
An agreed source prevents differences between dashboards and contradictory decisions.
How to do it
Validate connected accounts, period, time zone, currency, dimensions, filters, and calculated metrics; document the origin, formula, refresh, and owner of each indicator.
Completion evidence
The dashboard is validated with sample data and samples checked directly against platforms and the CRM.
Security and conditions
Share reports only with authorized recipients and with the minimum amount of data.
Step by step
  1. Duplicate an approved template or create a new dashboard, then rename the report, data sources, and visual elements for the correct client.
  2. Connect only the in-scope GA4, Google Ads, Meta, and CRM sources, and confirm the account, period, time zone, currency, and delegated access for each source.
  3. Create date dimensions, source, medium, and event filters, and calculated fields with a documented formula, type, and definition.
  4. Review every page, logo, period, filter, chart, and no-data state. Reconnect fields when a source schema changes.
  5. Compare samples directly with each platform and the CRM for the same period, and designate the dashboard as the source of truth only after explaining discrepancies.
  6. Store the dashboard in the official folder, assign maintenance owners, and record the refresh schedule and next reconciliation.
Item 58When applicable

Scheduled report delivery

Frequency, format, time, recipients, and delivery channel have been defined and tested.

Why it matters
A correct dashboard still fails operationally when nobody receives, opens, or understands the update.
How to do it
Configure scheduled delivery only after validating the numbers, send a test to authorized recipients, and confirm access, subject, displayed period, and the owner of the executive summary.
Completion evidence
The correct group received and opened the test delivery, with schedule and owner recorded.
Security and conditions
Review permissions and recipients whenever the team or contract changes.
Step by step
  1. Define the frequency, day, time, reporting period, format, channel, recipients, and owner of the executive commentary.
  2. Confirm viewing permissions and default filters before scheduling any recurring delivery.
  3. Send a test to authorized recipients and validate the subject, link or attachment, reporting period, brand presentation, and access without requesting excessive permissions.
  4. Fix delivery issues, record the schedule and automation owner, and review recipients whenever the team, scope, or contract changes.
8

Launch and first 30 days

Run QA, monitor the start, and review the data.

Item 59

Final QA before launch

Goal, conversion, budget, bid, geography, language, schedule, networks, placements, audiences, ads, URLs, and tracking have been reviewed.

Why it matters
An independent review finds errors before they affect spend or the experience.
How to do it
Compare each setting with the approved plan, test destinations and measurement, review creatives and exclusions, and ask another person to check before publishing.
Completion evidence
A signed checklist for each campaign includes review links or captures and issues resolved or formally accepted.
Security and conditions
Do not publish without final authorization and confirm spending limits.
Step by step
  1. Compare the objective, campaign type, budget, bid, geography, language, schedule, networks, and placements with the approved plan.
  2. Review audiences, exclusions, keywords or negative terms, creatives, copy, identity, approvals, and each channel's policies.
  3. Open every final URL with UTMs and confirm the page, form, event, CRM record, alert, and experience on desktop and mobile.
  4. Verify conversions, the primary action, attribution, spending limits, billing, and pause conditions before publishing.
  5. Request a second-person review and record screenshots, resolved issues, and the client's final authorization.
Item 60

Launch and initial monitoring

Campaigns have launched and delivery, spend, conversions, leads, and critical website signals are monitored at the start.

Why it matters
Initial monitoring makes it possible to correct delivery, links, and measurement quickly.
How to do it
Log checks after publishing, in the first hours, and at the 24-hour and 72-hour marks; verify delivery, spend, disapprovals, links, conversions, leads, CRM, website behavior, and pause conditions.
Completion evidence
The launch log records time, owner, observed metrics, incident, decision, and resolution for each check.
Security and conditions
Respect approvals and do not increase the budget without authorization.
Step by step
  1. Record the approved configuration and time before publishing to create an audit baseline.
  2. Immediately after launch, confirm status, delivery, budget, disapprovals, URLs, and that no unexpected campaign or ad remained active.
  3. During the first hours, check spend, clicks, events, leads, CRM routing, and signs of friction on the website.
  4. Repeat the checks at 24 and 72 hours, compare commercial lead quality, and record every change with its reason, owner, and result.
  5. Pause according to the defined critical conditions, and do not increase budget, expand targeting, or change the offer without the required approval.
Item 61When applicable

Initial client status routine

The frequency and format of status updates for the first days are agreed, with owners and a condition for reducing cadence.

Why it matters
Early on, the client needs visibility into progress, blockers, and decisions without improvised meetings.
How to do it
During the first days, send a short status with completed work, active campaigns, incidents, next steps, and pending decisions; reduce frequency when operations stabilize.
Completion evidence
The status template, cadence, channel, owner, and transition criterion to normal operations are documented.
Security and conditions
Do not include credentials, personal lead data, or sensitive screenshots in status updates.
Step by step
  1. Define the channel, time, owner, and update frequency during preparation, launch, and the first days of the campaign.
  2. Use a short format covering completed work, active campaigns, metrics that are still immature, incidents, next steps, and the decision required.
  3. Include the updated roadmap or schedule when a dependency changes and explain the impact on timing, budget, or testing.
  4. Confirm that the responsible contact received and understood the update without turning the group into a channel for sharing credentials or lead data.
  5. Reduce the frequency once operations stabilize and move to the approved regular meeting and reporting cadence.
Item 62

30-day review and reconciliation

Results, lead quality, learnings, and differences between sources have been reviewed for the same period, time zone, and attribution window.

Why it matters
The first review adjusts priorities with data from real operations.
How to do it
Compare the platform, GA4, CRM, and report; analyze campaign, audience, creative, search term or placement, lead quality, and cost by commercial stage; document differences and next tests.
Completion evidence
The shared review presents reconciliation by source, learnings, decisions, owners, and an updated plan.
Security and conditions
Use aggregated data whenever possible and keep access under review.
Step by step
  1. Set the same period, time zone, currency, and attribution window before comparing Google Ads, Meta, GA4, the CRM, and the dashboard.
  2. Compare samples of spend, clicks, conversions, leads, and revenue or sales stage, recording the definition used by each source.
  3. Analyze by campaign, audience, creative, search term, location, or placement, and connect cost to lead quality and response speed.
  4. Explain discrepancies caused by attribution, latency, time zone, consent, duplication, lost UTMs, or integration failures, and assign each fix.
  5. Record learnings, decisions, new tests, owners, and the date of the next monthly reconciliation between the report and its sources.

Author

Portrait of Vitor Asse

Vitor Asse

Founder of Agencify

Passionate about paid media, technology, AI, and automation. At Agencify, we develop a platform that centralizes Google Ads and Meta Ads campaign management, enables teams to create and publish campaigns at scale, monitor results, and automate reporting, reducing repetitive agency work.

Ready to scale your operation with AI?

Start using Agencify to centralize Google and Meta Ads, create and publish campaigns at scale, and deliver professional reports. 7 days free. No card. No risk.

Start without a credit card
  • 7 days free
  • No credit card