Foundations
Part of Reputation management foundations for England buyers
Reputation management market entry checklist: six gates
Use this reputation management market entry checklist to assess a software offer’s evidence, compliance controls and exit readiness in England.
Use this reputation management market entry checklist for one offer and one fictional England buyer workflow, with the reputation management market as context. Every gate is marked pass, fail or unresolved, with an evidence ID, owner and recheck date. A pass in one area cannot cancel a failure in another.
Complete it against the exact service presented to the buyer. Sales slides, a demonstration and group-level policies may point to further evidence, but they do not answer configuration, contract or operating questions on their own. For a software offer, apply the checklist to the exact proposed configuration of a named product or platform, such as Birdeye, Reputation.com or Trustpilot; a product name alone is not evidence.
What to take away
- A pass in one gate cannot cancel a failure in another, so each area needs its own evidence.
- Sales slides and group policies do not answer configuration, contract or operating questions on their own.
- Stop if the offer relies on fake reviews, shared credentials, missing export or a supplier-controlled account.
- Unresolved means hold, not assumed pass, so enter the market only with current evidence for every item.
- The CMA, CAP, ICO and NCSC sources set the authority to examine, but none approves a provider.
1. Fix the service boundary
- Name the legal supplier, exact service, buyer unit and England operating context.
- Define included sources, item types, languages, hours, outputs and exclusions.
- Separate review collection, moderation, response, complaints, monitoring, PR, search, legal remedies and crisis communication.
- Prohibit fake reviews, undisclosed incentives, impersonation, selective suppression and unsupported removal promises.
Mark this gate pass only when the supplier, buyer context, service boundaries and exclusions are evidenced, and prohibited practices are explicitly ruled out. Mark it fail if the offer includes a prohibited practice or its supplier or service scope is contradicted; mark it unresolved if the necessary records have not been supplied.
The Digital Markets, Competition and Consumers Act 2024 (DMCC Act) contains fake-review provisions. Examine these alongside the CMA’s Online reviews: guidance for businesses when a service publishes reviews or review information; neither the law nor the guidance approves a provider or settles every fact.
Fix the service boundary
- Name legal supplier, service, buyer, England
- Define sources, item types, languages, hours
- Separate collection, moderation, response, complaints
- Prohibit fake reviews, incentives, impersonation
2. Prove the evidence trail
- Preserve the source, exact wording, capture time, visible status and later changes.
- Record whether an item was collected, commissioned, incentivised, moderated or republished.
- Keep fact, opinion, allegation, complaint and advertising claim as distinct fields.
- Require a named approver before a public reply, correction request or removal request leaves the queue.
Mark this gate pass when the sampled items have the listed source, wording, capture details and status history, their treatment is recorded, and the required approval is evidenced. Mark it fail if an item cannot be traced or a required approval is absent; mark it unresolved if the underlying records cannot be inspected.
The CAP Code rules 3.45–3.50 cover testimonials and endorsements in non-broadcast advertising. Keep the underlying documentary record: a supplier dashboard is not the evidence itself.
3. Test rights and communications routes
- Map personal data, purpose, access, recipients, retention and deletion for the case record.
- Provide a route for correction, objection and complaints without forcing public disclosure.
- Keep review participation separate from later promotional contact.
- Escalate disputed facts, threats and regulated-sector matters to the qualified owner.
Mark this gate pass when the data map, applicable rights route, complaints route, marketing separation and escalation owner are documented and tested. Mark it fail if a required route is missing or review participation is tied to promotional contact; mark it unresolved if the applicable requirements or workflow have not been verified.
Check the ICO’s Right to rectification guidance and identify the applicable requirements in the UK GDPR, including Articles 16 and 17, the Data Protection Act 2018 and the Data (Use and Access) Act 2025. Mark this gate pass only when the applicable rights and communications routes are documented and tested; fail it if a required route is absent, or leave it unresolved if applicability or operation has not been checked.
4. Control accounts and suppliers
- Buyer-owned administrators use least privilege and recorded approval.
- A fictional unauthorised-publishing attempt is blocked and logged.
- Incident, recovery and alternative communication routes have named owners.
- The contract identifies support, changes, subcontractors, data return and termination.
Mark this gate pass when the buyer retains account control, the unauthorised-publishing test is blocked and logged, recovery owners are named, and the contract covers the listed supplier terms. Mark it fail if access depends on shared credentials or a supplier-controlled account the buyer cannot recover; mark it unresolved if the test or contract has not been checked.
Use the NCSC’s Supply chain security guidance to structure evidence requests. A certification or policy link answers only its stated scope.
5. Check the public journey
- A user can identify how reviews are collected, checked and challenged.
- Positive and negative material follows the same published policy.
- Incentive or commercial-interest disclosures survive the final render.
- Critical complaint, correction and accessibility tasks work without relying on one channel.
Mark this gate pass when the listed policies, disclosures and user routes are visible and work in the tested journey. Mark it fail if positive and negative material is treated differently or a required disclosure or route is missing; mark it unresolved if the final rendered journey has not been checked.
The CMA’s Online reviews: guidance for businesses calls for clear policies and explains that genuine negative reviews should not be withheld merely because they are unfavourable. Mark this gate pass when the public journey shows the same policy for positive and negative material and its disclosures and routes work; fail it if material is selectively suppressed or required disclosures are missing, and leave it unresolved if the journey has not been tested.
6. Require an exit demonstration
- Export case text, source references, decisions, timestamps and attachments in a usable form.
- Remove supplier access while buyer administrators retain control.
- Restore a sample export in an isolated location.
- Obtain deletion evidence and record any justified retention.
Mark this gate pass when a sample export has been received and restored, supplier access can be removed, and deletion evidence and any justified retention are recorded. Mark it fail if the buyer cannot obtain or restore a usable export or recover account control; mark it unresolved if the export or removal has not been demonstrated.
Enter the market only when every required item has current evidence. Stop if the offer depends on unverifiable claims, unclear authority, fake or manipulated reviews, inaccessible complaint routes, shared credentials, missing export or a supplier-controlled account the buyer cannot recover. Unresolved means hold, not assumed pass. For example, mark Gate 6 unresolved if the supplier shows an export button but the buyer has not received and restored a sample export.
Before you act
- Name the legal supplier, exact service, buyer unit and England context.
- Preserve source, wording, capture time, status and later changes.
- Keep review participation separate from later promotional contact.
- Require least privilege and recorded approval for buyer-owned administrators.
- Confirm positive and negative material follows the same published policy.
- Export case text, decisions, timestamps and attachments in usable form.
Common questions
What evidence must be kept for each review item?
Preserve the source, exact wording, capture time, visible status and later changes. Record whether an item was collected, commissioned, incentivised, moderated or republished. Keep fact, opinion, allegation, complaint and advertising claim as distinct fields, and require a named approver before any public reply, correction request or removal request leaves the queue.
When should a buyer stop or hold rather than enter the market?
Stop if the offer depends on unverifiable claims, unclear authority, fake or manipulated reviews, inaccessible complaint routes, shared credentials, missing export or a supplier-controlled account the buyer cannot recover. Enter the market only when every required item has current evidence. Unresolved means hold, not assumed pass.
How should supplier evidence requests be structured?
Use the NCSC supplier assurance questions to structure evidence requests. A certification or policy link answers only its stated scope. The contract should identify support, changes, subcontractors, data return and termination, and a fictional unauthorised-publishing attempt should be blocked and logged with named owners for incident and recovery routes.
