Speak to an expert

Audit · Social media account and access audit

Know who has access. See what needs checking.

Plan an auditSee a sample report

Business outcome

A ranked view of potential policy breaches, stale permissions and unknown owners.

We compare approved access with available account records, check current permissions where authorised, then rank verified exceptions for action.

One engagement. Fixed scope. No ongoing commitment.

  • Policy alignment

    Flag access that may breach policy.

    Check leaver, agency and administrator roles against approved rules and owners.

  • Evidence

    Separate verified grants from old records.

    Show which permissions are verified and which mismatches still need a current check.

  • Action

    Give owners a ranked fix list.

    Put evidence, open questions and next actions in front of the responsible teams.

A public profile cannot show who still has access.

A supplied export flags a possible policy breach, not confirmed live access.

Acme / Account control reviewAccess policy

A leaver and former agency appear in the access record.

The supplied export names a departed employee and former agency. Their recorded roles fall outside the approved roster; live permissions must be checked before calling either a breach.

In the record
Jonah Lee · Admin; Northlight Media · PartnerSupplied export, leavers list and approved roster
Still to confirm
Live grants not confirmedCurrent platform permissions check outstanding
Recommended next step

Have the authorised account owner check both roles. Revoke any grant still active without an approved need.

Suggested action ownerIT security + socialWhenPriority check
Findings reflect supplied evidence at a point in time; no account changes are made here.

When to audit

Review access when policy or ownership needs a clear answer.

A policy check is reason enough. Changes in staff, partners or ownership make that check more urgent.

  • Access-policy review

    Compare recorded administrator and partner roles with approved access rules.

  • Leaver and partner cleanup

    Flag former staff and agencies who still appear in access records for a current permissions check.

  • Estate hygiene

    Find dormant profiles, stale recovery routes, unknown owners and outdated account details.

  • Change of ownership

    Review control across teams, agencies or inherited businesses before a handover.

  • Rebrand or launch

    Review account ownership, names, profiles and coverage before rollout.

What we review

See the evidence, then decide what to fix.

We separate observed current grants from older records and unknowns before ranking what needs action.

  1. Estate hygiene

    Active, dormant, duplicate and campaign accounts; stale details and missing owners.

  2. Ownership & access

    People and partner roles, current permissions where authorised, multi-factor enrolment and recovery routes.

  3. Identity

    Whether official profiles look and read consistently as the brand.

  4. Coverage

    Names held, missing or conflicting across the brands and markets in scope.

  5. Policy & governance

    Approved access rules, leaver records, named decision owners and unresolved exceptions.

The result

Know what to fix first.
  • Evidence-backed findings
  • Issues ranked by severity
  • Clear next actions and open questions
Explore the sample report

A historic role in a supplied record is a potential exception until current permissions confirm it. Account changes remain with authorised owners.

What comes back

Give account owners a clear action plan.

The engagement ends with a shared record of what was inspected, what was found and who needs to move it forward.

Evidence-backed report

A scoped account record and findings ranked by severity, with the evidence behind each one.

Prioritised fix list

Confirmed issues, current-access checks still needed and decisions requiring a named owner.

Stakeholder walkthrough

A working session with the people responsible for the accounts, not only the people who commissioned the audit.

Audit scenarios

What the audit should make visible.

Conflicting evidence becomes a ranked, owned handover plan.

Transition resolution · Aurora CollectiveIn review
Trigger
Outgoing agency handoverNorthlight Media · contract ended 30 June
Scope
42 accounts · UK & EuropeAccess, ownership and recovery routes
Deadline
7 days before transitionTwo priority decisions required
Evidence comparison

One account. Two versions of control.

InstagramLive platformCaptured 12 Sep
Owner
Northlight Media
Recovery
Agency controlled
Access active
Handover registerApproved 18 Jun
Owner
Group Social
Recovery
Aurora controlled
Marked complete
Critical finding · ownership & accessThe outgoing agency still controls the primary account.The live platform record takes precedence until access is retested.
Decision queue

Three actions close the handover.

  • P1Replace the primary ownerGroup Social48h
  • P1Move recovery inside AuroraIT IdentityThis week
  • P2Revoke remaining agency accessPlatform OpsBefore handover
3 / 3 actions assigned2 teams in the readout
Handover packEvidence file, owned action plan and stakeholder readout.Ready for decision

Aurora Collective is a fictional brand. Example records only.

Related customer work

The value of a clear estate, at scale.

The published adidas customer story covers a broader social identity programme. Its account-mapping work shows why ownership and coverage need an evidence-backed record.

adidas × handles

250+licensed handles identified and aligned

The case describes an estate spanning regions, product lines and partnerships, brought into one management suite. That wider engagement is related evidence, rather than a result promised by this one-off audit.

Read the customer story

How we work

Agree the scope. Check the evidence. Rank the work.

Private checks cover only what you authorise and make available. Anything outside the evidence stays marked as an unknown.

  1. 1

    Agree the scope

    Brands, markets, platforms, accounts, business managers, stakeholders and the access policy to test.

  2. 2

    Gather the evidence

    Existing inventories, authorised platform access, ownership records and relevant policies.

  3. 3

    Review and reconcile

    Compare policy, supplied records and current permissions where available; keep unverified roles visible as open checks.

  4. 4

    Return and walk through

    Deliver the report, ranked action plan and a working session with the account owners.

The first useful result starts with your records.

Share the account list, approved access rules, leaver and partner records, and the people who can authorise a current permissions check. Once scope and access are agreed, we can identify policy mismatches and mark any role that still needs validation. The full report follows review; timing depends on the estate and available records.

FAQ

Frequently asked questions

How do we know whether access breaches policy?

We compare approved access rules, people and partner records, and the platform evidence available in scope. A name on an old export is a potential mismatch, not proof of a live permission or a confirmed breach. We show the source and the current check needed; authorised owners decide on any access change.

Can former staff or agencies still have access?

Roles may remain after a person leaves or a contract ends. The audit flags leavers and former partners in the records, then distinguishes grants confirmed in current platform permissions from older entries that still need validation.

How often should a social media audit be run?

Commission one when access policy is being checked, a leaver or partner list needs reconciling, ownership is unclear, or a transition is approaching. The audit is a scoped review at a point in time; a standing inventory is a separate job.

What does a social media security audit cover?

Accounts and named owners, administrator and partner roles, policy alignment, multi-factor enrolment, recovery routes, dormant profiles and coverage in the agreed scope. We identify confirmed findings and open checks separately. The audit does not change account access or review published content.

A snapshot, by design.

The audit is a one-off engagement. Monitoring, software and ongoing administration are separate decisions made after the report.

Further reading: How to audit social media permissions and the social media security audit checklist.

Plan an audit