How to audit an influencer agency before signing a UK contract

Mistake: Signing with the wrong legal entity

What goes wrong and why: The costliest mistake is signing with an entity different from the business that pitched, invoices or receives payment. That mismatch can blur responsibility for delivery, refunds and disputes. Names or bank details that do not align are a substantive contracting risk, not a clerical detail.

Fix: Search the register at Companies House, using its free Find and update company information service on GOV.UK. Check the company status, registered office, officers, filing history and latest accounts. Match the registered name, company number, directors and filing history against the contract, invoice, bank details and VAT details. Ask why another business will buy media or receive funds. Review confirmation statements as one record, then require any remaining discrepancy to be resolved in writing before signing.

Mistake: Treating a polished pitch as compliance proof

What goes wrong and why: A polished presentation can look like proof of compliant practice without showing what happens to live posts. If the agency cannot evidence how disclosures, creator relationships and claims are checked, the brand is left relying on broad assurances rather than a repeatable review process.

Fix: Search ASA rulings for the agency and named creators, then request its disclosure policy, relationship register and claim approval record. Compare these materials with the agency's process for checking advertising and claims before publication. Test them against the ASA's CAP Code: rule 2.1 requires ads to be obviously identifiable, and Section 3 covers misleading claims and evidence. Ask also how the agency follows the CMA's guidance for influencers and the consumer protection rules in the Digital Markets, Competition and Consumers Act 2024. Ask for records, not only a summary of staff training or stated intentions.

A ruling should prompt a question rather than an automatic rejection. Ask the agency to explain any relevant outcome and show what it changed afterwards. Repeated issues, or an inability to evidence a corrected process, are more concerning than a general assurance that staff understand the rules.

Mistake: Accepting reputation instead of delivery evidence

What goes wrong and why: Logos, testimonials and screenshots do not establish what an agency delivered for a British brand.

Without evidence connected to a campaign brief and contracted scope, a reference may not explain who approved posts, how late changes were managed or whether a reported result relates to the actual work.

Fix: Ask for British brand referees and a dated result connected to each campaign brief and scope. Speak to referees without the agency present, and ask what was delivered and how late changes were managed. Request an insurance certificate and compare the claims with agency review records.

Mistake: Leaving personal data questions until later

What goes wrong and why: Postponing privacy checks leaves a gap when an agency handles audience lists, creator payments or analytics. A general privacy statement does not identify responsibility for campaign data, its retention periods or the other organisations that may handle it, so the practical arrangement remains unclear.

Fix: Before appointment, review the data protection questions. Request a data processing agreement, retention periods, a sub-processor list and a breach process. The framework is the UK GDPR and the Data Protection Act 2018, regulated by the Information Commissioner's Office (ICO). Article 28 requires a written contract between a controller and a processor, and Article 33 requires a controller to report a notifiable breach to the ICO within 72 hours. Establish whether each party acts as controller or processor, who answers data requests and which response deadline will be written into the schedule. Individuals' requests for their data must normally be answered within one month under Article 12 of the UK GDPR. Check that the agency is registered with the ICO and has paid its data protection fee, which the ICO's public register shows.

Mistake: Agreeing a scope that cannot be checked

What goes wrong and why: Broad phrases such as campaign management make it hard to decide what the agency must deliver, who can approve work or when payment is due. Missing exit wording also creates uncertainty over creator content, campaign assets and the practical steps required when the relationship ends.

Fix: Put the contracting entity, scope, deliverables, approval rights, payment triggers and exit terms in the contract. Check auto-renewal, exclusivity and media buying mark-ups, then attach a schedule listing each creator, platform and deliverable. Compare the draft with contract terms to review and commercial contract schedules.

Mistake: Proceeding despite an evidence refusal

What goes wrong and why: An agency that refuses to share relevant evidence leaves its central claims untested. Verbal assurances and pitch material cannot resolve gaps about delivery, personal data or payment, so proceeding anyway converts unanswered questions into accepted risks without a recorded decision.

Fix: Offer a mutual confidentiality agreement and a short evidence window. Keep a record of what has been supplied, what remains unclear and who must resolve each gap. If key documents remain unavailable, pause the appointment rather than letting an unanswered request disappear into an informal exchange. Use a campaign quality checklist to keep the outstanding checks visible.

For every item that cannot be verified, record the gap and decide whether to request a correction, pause payment or stop the appointment. Use qualified advisers where your legal, tax or data protection position is uncertain. Put any agreed correction or stop condition into the written contract before signing.