What should a brand suitability audit trail record for each borderline call?
Part of Brand suitability
The short answer
A brand suitability audit trail records each borderline call so someone else can check it later: the exact page, its content category with the taxonomy version, the tier the brand set, the decision and its reason, the reviewer and the date. With client approval for sensitive exclusions and a retention schedule, the records show where the policy needs to change.
Key takeaways
- A decision record is written when the call is made, in the brand's own tier language, so a later reader can judge it without asking the reviewer.
- Category codes need their taxonomy version, because IAB Tech Lab says major version numbers represent breaking changes.
- A sensitive category exclusion needs the client's sign off on its scope, its tradeoffs and the content it will keep, before it goes live.
- No single public rule sets how long suitability records are kept; the MRC's verification guidance and privacy regulators' retention principles give the reference points.
How do I record a borderline suitability decision for audit?
Definition
- Borderline suitability decision
- A call on a page or placement that sits near a tier boundary in the brand's policy, covers a sensitive but responsible subject, or overrides what a tool recommended, so that two careful reviewers could reasonably disagree.
Clear calls need little explanation. A page of graphic violence is out, a recipe is in. The borderline calls are the ones a client, an auditor or a new planner will question months later, and by then the page has changed and the reviewer may have moved on. The MRC's 2018 supplement on content level brand safety (opens in a new tab) notes that buyers have "different tolerance levels for risk depending on brand suitability." A record that does not state the brand's own tolerance cannot be audited against it.
Six steps to record a borderline call at the moment it is made
- Capture the page. Save a dated copy of the content as reviewed, with its full URL, and crop out personal details the record does not need.
- Name the category and its version. Write the category name and code from the taxonomy the policy uses, with the version number.
- State both tiers. Record the tier the reviewer assigned to the page and the tier the brand set as its brand suitability tolerance for that category.
- Decide at the narrowest scope. Choose allow, exclude the page, exclude the path, exclude the domain or escalate.
- Write the reason in the policy's words. One or two sentences that quote or paraphrase the clause applied, not a personal impression.
- Sign and date it. Add the reviewer, any second reviewer, the decision date and the date the call should be looked at again.
Which fields should each decision record carry?
The fields below are our own schema, built from what the standards ask buyers and verification services to be able to show. No industry body prescribes this form. Two fields deserve care. The URL decides the scope of any exclusion: Google's help page on excluding webpages and videos (opens in a new tab) shows a page URL blocking only that page while a top level domain blocks the domain, its subdomains and pages. The category code needs its version, because IAB Tech Lab's taxonomy repository (opens in a new tab) says "major version numbers represent breaking changes and minor version numbers represent improvements", and that Content Taxonomy 3.0 may not be used alongside versions 1.0 through 2.2.
| Field | What to write | Why it matters later |
|---|---|---|
| Decision ID | A unique reference linked to the campaign and list version | Ties the call to the plan it changed |
| Page URL and scope | The full URL and whether the decision covers the page, path or domain | The URL form sets what an exclusion actually blocks |
| Capture | File name and date of the saved copy | Shows the page as it was, after it changes |
| Category and version | Category name and code, such as Content Taxonomy 3.1 | Codes can change meaning between major versions |
| Assigned tier and tolerance tier | The page's tier and the brand's tolerance for that category | The gap between the two is the decision |
| Decision | Allow, exclude page, exclude path, exclude domain or escalate | Separates allowed calls from blocks in later reviews |
| Reason | The policy clause applied, in one or two sentences | Lets a stranger judge the call |
| People | Reviewer, second reviewer and approver, by role and name | Shows who can explain the call |
| Dates | Decision date and review by date | Old calls are reread, not trusted indefinitely |
| Platform reference | The change history entry that applied the decision | Links the judgment to the setting that enforced it |
The platform reference closes the loop. Display & Video 360's event history (opens in a new tab) records the time, date, description and user for each change, lets users add notes, and downloads as a CSV for a chosen date range. Google adds that notes can be seen by anyone with access to that event history page, so write them for that audience.
Before a decision record is filed
- The URL is complete and the scope of the decision is stated.
- The capture is saved, dated and stripped of personal details it does not need.
- The category carries its code and taxonomy version.
- Both the assigned tier and the brand's tolerance tier are written down.
- The reason cites the policy clause, not a feeling about the page.
- A second reviewer signed any call one tier from the floor.
- The review by date is set.
- The platform change that applied the decision is referenced.
What should the client approve before a sensitive category exclusion?
A sensitive category exclusion is a brand decision, and the record should show the brand made it. TAG's Brand Safety Certified Guidelines (opens in a new tab), version 5.0 of July 2026, say direct buyers "must define the criteria" for where their advertising may appear and communicate them to intermediaries. Google's content suitability page (opens in a new tab) supplies the tradeoffs to explain: the Limited inventory type "may limit your reach and performance," excluded content keywords "only support exact matches," and "some words have multiple meanings." Google also says sensitive content exclusions apply to the Display Network and Google video partners, not YouTube, as checked in October 2026.
Client sign off for a sensitive category exclusion
- The category, the tier at which exclusion starts and the policy clause behind it.
- The surfaces it covers, named one by one, with the date their scope was checked.
- The tradeoff in plain words: the kinds of pages and publishers the exclusion will also remove.
- The responsible content the brand wants kept, such as grief support or public health reporting, and how it will be protected.
- The start date, the review date and who may grant a one off exception.
- Where the approval itself is stored, with the approver's name and date.
How long should decision records be kept?
No public rule sets one retention period for suitability decisions. The closest industry reference is written for verification services: the IAB and MRC Guidelines for the Conduct of Ad Verification (opens in a new tab) of February 2012 call for an audit trail "to enable support, correction and conflict resolution processes among participants," with longer periods for disputes and material errors. Privacy law enters because captures and reviewer fields can hold personal information, such as names in an obituary or a news story.
| Situation | Reference point | Source |
|---|---|---|
| Verification audit trail, general | Suggested minimum of 60 days from the date first reported | IAB and MRC guidelines, 2012 |
| Known dispute | Kept until the dispute is resolved | IAB and MRC guidelines, 2012 |
| Material errors and suspected fraud | 12 months after campaign reporting | IAB and MRC guidelines, 2012 |
| Personal information, Canada | No "one size fits all" period; minimum and maximum periods by type of information | Office of the Privacy Commissioner of Canada (opens in a new tab) |
| Personal information, United States | Keep it "only as long as it's necessary" under a written records retention policy | FTC guide for business (opens in a new tab) |
How do records help refine the policy?
A year of decision records is strong evidence of where a brand's policy is vague. The TAG guidelines ask certified buyers and intermediaries to document their method for adding to and removing from inclusion and exclusion lists, review those lists quarterly, and have "an objective review and evaluation process" for claims that content was wrongly designated as unsafe. Decision records feed all three.
A quarterly policy review from decision records
- Group the calls. Sort the quarter's records by category, tier and decision.
- Look for repeated escalations. A clause that sends the same kind of page to a second reviewer again and again is unclear.
- Look for one way overrides. Reviewers who keep allowing pages one tier above tolerance suggest the tolerance is set too strict.
- Read the reversals and publisher claims. Each overturned call shows where the wording failed.
- Rewrite and version the policy. Change the clause, give the policy a new version and date, and cite that version in future records.
How does PlacementGraph keep tolerance and reasons together?
What does an audit trail look like on a real plan?
Fictional example
A funeral and memorial cooperative in Yukon and the Northwest Territories
An unnamed funeral and memorial services cooperative advertises preplanning services in Whitehorse and Yellowknife, on local news, community and seniors' sites. Its policy allows respectful obituaries and grief support content, allows non graphic local tragedy reporting at low tier, and avoids graphic images of death or injury.
A reviewer meets a local news report on a fatal highway crash. The text is factual and carries no images. She records the URL, a cropped capture without the names of those who died, the category and its Content Taxonomy 3.1 code, a low tier against the brand's tolerance, and the decision to allow, citing the clause on non graphic reporting. A second report on the same crash adds scene photos, and she excludes that page only, with its own record.
At the quarterly review, the cooperative's marketing lead sees several allowed calls on house fire and crash coverage, each with the same reason. She rewrites the clause to name those stories directly, versions the policy and asks the agency to cite the new version from then on. The captures from the quarter are deleted on their disposal date; the decision fields stay.
Frequently asked questions
Should allowed pages be recorded, or only exclusions?
Record borderline allows too. An exclusion leaves a trace in the platform's settings, but a page the reviewer chose to keep leaves none. Allowed calls are also the evidence that the policy protects responsible content, and the quarterly review needs both sides to find clauses that are too strict or too loose.
Can a decision record be edited after it is filed?
Treat records as append only. If a call was wrong, add a new entry that reverses it, with its own reason, reviewer and date, and keep the original. An edited record hides the history an audit is meant to show, while a reversal entry shows the policy working.
Is the buying platform's change history enough as an audit trail?
It covers half. Display & Video 360's event history shows what changed, when and by whom, with optional notes, but it records settings, not the reading of the page that led to them. Keep the decision record for the judgment and link it to the change entry.
What happens when a publisher disputes a suitability decision?
Log the claim as its own record linked to the original call. Have someone other than the first reviewer reread the page against the policy clause, record the outcome and the reason, and tell the publisher. TAG's guidelines ask certified companies to keep an objective review process for such claims.
Sources
- Guidelines for the Conduct of Ad Verification (opens in a new tab)IAB and Media Rating Council, February 14, 2012
- MRC Supplement to IAB Guidelines for the Conduct of Ad Verification: Enhanced Content Level Context and Brand Safety (opens in a new tab)Media Rating Council, September 2018
- Brand Safety Certified Guidelines, version 5.0 (opens in a new tab)TAG (Trustworthy Accountability Group), July 2026
- IAB Tech Lab Taxonomies repository (opens in a new tab)IAB Tech Lab, GitHub
- Event history (opens in a new tab)Google Display & Video 360 Help
- About content suitability (opens in a new tab)Google Ads Help
- Exclude specific webpages and videos (opens in a new tab)Google Ads Help
- Personal Information Retention and Disposal: Principles and Best Practices (opens in a new tab)Office of the Privacy Commissioner of Canada
- Protecting Personal Information: A Guide for Business (opens in a new tab)US Federal Trade Commission
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.