Last reviewed: October 2026
No Credit Card Required
This free social media audit checklist is for marketing managers, social media teams and agencies that run accounts for a brand. One run is one quarterly audit of every account the brand runs. It starts with an inventory that includes forgotten and unofficial accounts and impersonators, then checks who has admin access, two-factor authentication and recovery details, the consistency of names, bios, links and images, performance against last quarter and the goals from each platform’s own analytics, the content and how quickly people got replies, ad labelling, accessibility and privacy, and three competitors. It ends with a decision for each account and an action plan with owners, approved by the head of marketing. The platforms you use, paid social and creator partnerships add the matching notes and tasks.
Social media accounts pile up. A product launch gets its own account, an event gets another, a regional team starts one, and an agency sets up a fourth. People join and leave, and their admin roles stay. Meanwhile the daily work of posting and replying never stops long enough for anyone to ask whether each account is still safe, still on brand and still worth the effort.
A quarterly audit is that pause. It is not the daily routine of monitoring, posting and replying, which the Social Media Manager Daily Checklist covers, and it is not the launch of one campaign, which belongs in the Campaign Launch Checklist. It looks across every account at once, once a quarter, and ends with decisions.
Asks: which accounts do we have, who can get into them, are they on brand, and are they meeting their goals?
When: once a quarter, over about four weeks, and after a big change such as a new agency.
Output: a full inventory, security fixes, a decision for each account and an approved action plan.
Asks: what needs a reply, what is going out today, and what is planned for tomorrow?
When: every working day, in the Social Media Manager Daily Checklist.
Output: posts published, comments and messages answered, and tomorrow’s content ready.
Asks: is everything for this campaign ready, approved and tracked before it goes live?
When: once per campaign, in the Campaign Launch Checklist.
Output: a campaign launched with its assets, approvals and tracking in place.
Eight phases follow one quarterly audit of every account the brand runs, from the inventory to the head of marketing’s approval. The first task records the platforms in use, which add notes for LinkedIn, YouTube, Facebook and Instagram, and TikTok where they matter. Paid social adds an ad account and pixel review and a paid results task, and creator partnerships add two disclosure checks. An account the brand does not control, a security problem or an account to close each add a task to deal with it.
Answer the questions in the first task before anything else: which platforms the brand uses, whether it runs paid social and whether it works with creators. They add the matching tasks and platform notes. Every due date counts in working days from the day the audit starts.
List every account before judging any of them. Old campaign, event, regional and product accounts are the ones nobody watches. An account the brand does not control adds a task to recover it or have it removed.
Most social media account takeovers start with a login nobody remembered: a former employee, an agency that has moved on, a shared password or a recovery email nobody reads. Paid social adds a review of ad accounts and tracking pixels, and a security problem found here adds a task to fix it the same day.
Look at each profile the way a customer would, on a phone. The name, description, links and images should match the brand today, not the one from two campaigns ago.
Use each platform’s own analytics for the same dates as last quarter, and your web analytics for clicks and conversions. Compare with last quarter and the goals set in Phase 1, not with industry averages.
Look at what was posted and how people were answered, not only at the numbers. A slow or missing reply to a customer’s comment or message is often what people remember.
Paid, gifted and affiliate content has to be clearly labelled as an ad, whoever posts it: the brand, an employee or a creator. Working with creators adds two checks. Then look at three competitors to see what you might be missing.
Decide what happens to each account, then turn the findings into actions with owners and dates. The head of marketing approves the audit and the action plan, and nothing after that step can be completed until they do. Closing or merging an account adds a task after the approval.
Phase 7 checks that paid, gifted and affiliate content is labelled as an ad. These are the main points from the UK and US guidance for brands and the people who post for them. The table is a starting point, not legal advice.
| Topic | UK (ASA, CAP and CMA guidance) | US (FTC Endorsement Guides) |
|---|---|---|
| Who is responsible | Both the brand and the creator are responsible for making sure content is disclosed. The CMA expects brands to check content that refers to them and not to ignore posts that are not labelled. | Advertisers can be liable for failing to disclose unexpected material connections with their endorsers, even when the endorser is not. Agencies and other intermediaries can be liable too (16 CFR 255.1(d) and (f)). |
| What counts as a connection | Any payment or incentive, including free products, even when there is no obligation to post; and being an owner, employee or shareholder, or having another commercial or personal interest. | A business, family or personal relationship, payment, free or discounted products, early access or the chance to win a prize, whether or not an endorsement is required (16 CFR 255.5(a)). |
| Words to use | Say what it is: “Ad” or “Advert”. Avoid “Gifted”, “Sponsored”, “Spon”, “Collab”, “Aff”, “In partnership with” or just tagging the brand. | Simple, clear words such as “Advertisement”, “Ad” or “Sponsored”. Avoid vague terms such as “sp”, “spon” or “collab”. |
| Where the label goes | Clear, prominent and upfront: at the very start, not buried in hashtags, behind “more” or part-way through a video. Label each story in a series. | Difficult to miss and easy to understand; on social media it should be unavoidable (16 CFR 255.0(f)). Not only on a profile page or behind a “more” link (16 CFR 255.0, example 9). |
| Video and live | Wherever people look first, such as the title or thumbnail. Each format (a story, a post, a reel) needs its own label. | In the video itself, not just the description, and repeated during live streams. In both the picture and the sound when the claim is made in both (16 CFR 255.0(f)). |
| Platform labelling tools | A tool such as Instagram’s Paid partnership label may be enough if it is upfront, clear and prominent; if not, add “Ad”. | Do not assume a platform’s disclosure tool is good enough. A built-in label that is easy to miss is not clear and conspicuous (16 CFR 255.0, example 9). |
| Employees and tags | An employee or owner posting about the brand has a connection to disclose. Tagging the brand is not a label. | Employees promoting their employer’s products should disclose the connection, and the employer should train and monitor them (16 CFR 255.5, example 8). Tags in social media posts can be endorsements (16 CFR 255.0(b)). |
| What the brand should do | Put the labelling requirement in the contract or with gifted products, have a written policy for creators and agencies, check posts, and get unlabelled content corrected promptly. | Give endorsers guidance on disclosure, monitor what they post, and act to fix non-compliance (16 CFR 255.1(d)). |
Sources. UK: the ASA and CMA’s Influencers’ guide to making clear that ads are ads (third edition, March 2023) and the CMA’s Social media endorsements: guidance for brands (updated August 2025). The ASA says the influencer guide will be updated for the Digital Markets, Competition and Consumers Act 2024, which replaced the Consumer Protection Regulations, and that its advice remains broadly correct. US: the FTC’s Guides Concerning the Use of Endorsements and Testimonials in Advertising (16 CFR Part 255, revised in July 2023) and its Disclosures 101 for Social Media Influencers.
Other countries. Rules on advertising disclosure differ by country. Check the rules where your audience is, and the platforms’ own branded content policies, with an adviser.
Enter the day the audit starts and every task falls due a set number of working days after it. Tasks are assigned from the four people named in the first task, overdue alerts go to the assignees, and audits in progress show on the Reports Grid. Run it on a recurring schedule so it starts every quarter without anyone remembering.
The platforms you tick add notes on the tasks they affect, such as LinkedIn’s admin roles and Instagram’s Paid partnership label. Paid social adds the ad account and results reviews, creators add the disclosure checks, and an account you do not control or a security problem adds a task to fix it. Every check records In order or Gaps found.
The head of marketing reviews the summary, the account decisions and the action plan, and records Approved, Approved with changes or Not approved. Nothing after that approval step can be completed until a decision is recorded, so no account is closed on one person’s say-so.
CheckFlow does not connect to social media platforms, post for you or pull their analytics. Your team uses each platform’s own tools and analytics. CheckFlow makes sure every account is checked the same way each quarter, that every gap has an owner and a date, and that the head of marketing’s approval is on record. Workflow software shows how hand-offs like these run across a team.
Run the day-to-day work with the Social Media Manager Daily Checklist, and plan what to post with the Digital Content Strategy Checklist. Switch on two-factor authentication across the company with the MFA Rollout Checklist, remove a leaver’s access to every tool with the SaaS Access Offboarding Checklist, check the website the profiles link to with the WCAG 2.2 Accessibility Audit Checklist and the Website Privacy & Cookie Compliance Checklist, and prepare for a public problem with the Crisis Management Plan Checklist.
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
An inventory of every account the brand runs, including forgotten and unofficial ones and any impersonators; who has access and whether two-factor authentication and recovery details are in place; whether names, bios, links and images are consistent; performance against last quarter and the goals; what content worked, how often you posted and how quickly people got replies; ad labelling, accessibility and privacy; a look at competitors; and a decision for each account with an action plan that someone senior approves.
This checklist is built for a quarterly audit, which keeps the comparison with last quarter simple and catches leavers’ access before it builds up. Run an extra audit when you change agency, after a security incident, or when someone who managed the accounts leaves. The daily posting and replying in between belongs in a daily routine, not in the audit.
Search each platform for the brand name, product names and old campaign names; follow the links from your website, email signatures and old campaigns; and ask staff, former staff and agencies which accounts they set up. Check that each account you find is registered to a company email address and that the business holds the top admin role. For an account you cannot get into, or one pretending to be you, use the platform’s own recovery or impersonation reporting process and record what you did.
Only the people who need it, each through their own login and the platform’s business roles rather than a shared password, with the lowest role that does the job. Keep at least two admins from the business on every account so one person leaving cannot lock you out. LinkedIn Pages, for example, separate super admins, content admins and analysts, and YouTube recommends channel permissions over sharing a password. Remove leavers and former agencies every quarter.
In the UK, the ASA and CMA guidance says both the brand and the creator are responsible, and the CMA expects brands to tell creators to label content as an ad, check their posts and get unlabelled ones corrected. In the US, the FTC’s Endorsement Guides say advertisers can be liable for an endorser’s undisclosed connection and should give guidance, monitor posts and act on problems. Free products count as a connection in both. The table above sets out the main points.
The ones tied to your goals: usually reach or impressions, engagements, clicks to the website, the conversions those clicks led to, and follower growth, per platform. Take them from each platform’s own analytics for the same dates as last quarter, and conversions from your web analytics. Compare with last quarter and your goals rather than published averages, which measure other brands with other audiences.
The Social Media Manager Daily Checklist runs every working day: monitoring, publishing, replying and preparing tomorrow’s posts. The audit runs once a quarter and steps back from the daily work to check every account’s security, branding, results and compliance, then decides what to keep, change, close or merge. A campaign launch is different again: it gets one campaign ready to go live.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request
