
Reviews
Part of Reviewing reputation services by comparing only the overlapping job
Reputation management selection checklist: scope, evidence, exit terms
A reputation management selection checklist for England buyers: scope, account access, data terms, acceptance exercises, exit terms and the buying decision.
A reputation management selection checklist should end with a documented buying decision, rather than a collection of feature ticks. For an England business, start with the tasks and accounts the service would handle. Assign a decision owner who can accept a limitation or return the proposal for more evidence.
The checks below are proposed procurement steps. They record work to perform, not completed supplier assessments. No product receives a score or recommendation from this page.
What to take away
- A reputation supplier selection should follow the written tasks, the accounts in scope and the controls required.
- Record dated evidence for each requirement; an empty cell means the question remains open.
- Google's third-party policy gives customers a route to regain exclusive control within seven working days of notice.
- An acceptance exercise can show a task worked under recorded conditions, not higher sales or sentiment.
- Before signing, list unresolved essentials and decide whether each needs rejection, further evidence or a condition.
Fix the job before requesting a proposal
Fix the job
- Write the review channels, branch population and authorised users into the scope.
- Distinguish software access from managed drafting, approval and public response work.
- List the essential controls separately from convenience features.
- Identify who owns the decision and who will review contract and data questions.
Name the accounts and tools the service would cover. For most England businesses that means Google Business Profile, Trustpilot and the other review sites the branches appear on, alongside the review-management software that would sit near them — suites such as Birdeye, Podium or ReviewTrackers, or profile tools such as LocalClarity. For each channel, write down the response time you expect for a public reply, who handles an escalation, and the record you expect to receive at the end.
Use an evidence column alongside each requirement. Record the dated supplier document or observation that supports it. An empty cell means the question remains open; it should not silently become a pass when the checklist is summarised.
Scope and evidence checklist
- Review channels, branches, authorised users in scope
- Software access vs managed drafting and response
- Essential controls separate from convenience features
- Name decision owner and contract reviewer
- Evidence columndated document or observation
- Empty cell means question remains open
An illustrative completed row set for a two-branch England retailer:
Fix the job
| Requirement | Evidence to file | Date checked | Status |
|---|---|---|---|
| Revoke delegated Google Business Profile access | Platform third-party policy page | 6 September 2026 | Recorded |
| Named approver for public replies | Nothing supplied yet | Not yet | Open |
The second row stays open until the supplier names the approver in writing. Replace both illustrative rows with your own channels, evidence and dates before the checklist is used.
Check what the account arrangement permits
Where the proposal includes Google Business Profile, use Google's third-party policy to examine the exit arrangements, and record the date you checked it. The policy gives customers a route to regain exclusive control within seven working days of notice. That is a platform policy condition, not a universal contractual deadline for unrelated services. For every other platform in scope — Trustpilot or a review suite such as Birdeye or Podium — the exit route comes from the contract, so ask for the export format, who owns the account and the termination notice the contract requires.
Account access and exit steps
- Request permission levels and delegated access
- Confirm who approves public replies
- Identify records client receives at termination
- Separate client records from platform content
- Observe handover, not just written assurance
- Regain exclusive control within seven working days
- Request the permission levels and the process for revoking delegated access.
- Confirm which named role approves public replies, on what evidence, and where the approval and its retention period are recorded.
- Identify the working records, export formats and deletion or return duties the client can rely on at termination.
- Note the termination notice each contract requires, separately from Google's seven-working-day platform route.
- Keep client records apart from platform content whose reuse needs its own basis.
Have the operator explain the handover steps in the proposed configuration. A written assurance and a successfully observed handover are different evidence states. Record which one the buyer actually has.
Review the data terms before connecting systems
The ICO's guidance on controller–processor contracts covers the terms needed where a processor acts for a controller, and its source is UK GDPR Article 28, read with the Data Protection Act 2018. Article 28 requires written terms on processing on documented instructions, confidentiality, security, subprocessors, assistance with data subject requests and the return or deletion of data at the end of the contract. The ICO page carries a notice that it is under review following the Data (Use and Access) Act, so record the date you read it against the contract clause you rely on.
Data terms review sequence
- Map personal data sent, stored or exposed
- Identify organisations and obtain contracts
- Resolve roles, subprocessors, end-of-contract handling
- Record unanswered points before connecting
- Keep workflow description with the contract
- Map the personal data the workflow would send, store or expose.
- Identify the organisations involved and obtain the relevant contractual documents.
- Check the supplier's ICO registration number on the ICO register of fee payers, and ask for current ISO/IEC 27001 or Cyber Essentials certification where security claims are made.
- Ask the responsible specialist to resolve roles, subprocessors and the Article 28 end-of-contract duties.
- Record unanswered points before authorising a connection or data transfer.
A supplier's standard document is evidence to review, not proof that it fits the proposed processing. Keep the actual workflow description with the contract so the reviewer can assess both together.
Require an observable acceptance exercise
Define a permitted task that matters to the business, such as taking a draft through approval in a controlled setting. State the starting permissions, expected endpoint and evidence to retain. Do not create fake public customer reviews for the exercise.
Acceptance exercise record
- Define permitted task and expected endpoint
- State starting permissions and evidence to retain
- No fake public customer reviews
- Log errors, interruptions, incomplete tasks
- Separate operator effort from platform waiting
- Mark untouched features as untested
Require an acceptance exercise
- Specify which steps the buyer will perform and which the supplier will demonstrate.
- Keep errors, interruptions and incomplete tasks in the observation log.
- Separate operator effort from time awaiting a platform action.
- Mark every untouched feature as untested in the decision record.
An exercise can establish that a task worked under its recorded conditions. It cannot by itself demonstrate higher sales, better customer sentiment or reliable performance across an unobserved year.
Close the decision with explicit conditions
Request comparable written charges for the same scope and commitment, including setup, recurring services and the VAT basis. Retain the quotation date and exclusions without supplying assumed prices for missing items. Match contract wording to the service that was actually demonstrated.
Before signing, list unresolved essentials and decide whether each requires rejection, further evidence or a documented condition. Give conditional actions an owner and completion date. Circulate the final scope, approved evidence and exit arrangements together so the operator inherits the same service the buyer evaluated.
Before you act
- Confirm the scope file lists every review channel, branch and authorised user.
- Check that each requirement carries dated evidence or is marked open.
- Confirm the written exit route for each platform account in scope.
- Confirm the data terms were reviewed before any system connection.
- Check that the acceptance exercise log, including errors, is complete.
- Sign only where every open point has a named owner and a completion date.
Common questions
What should a reputation management selection checklist end with?
A decision record kept with the scope file. It names the scope, any accepted limitation, the owner of each open point and the evidence behind each requirement.
How should evidence be recorded for each requirement?
Keep one row per requirement, with the dated supplier document or observation beside it, and leave the row open until that evidence exists.
What can an acceptance exercise demonstrate?
An acceptance exercise shows whether the supplier can carry a named task through your own accounts with the permissions, timings and errors written down. It cannot show how the service behaves across a full year, on every channel or at peak volumes, so record those limits as untested in the decision record.
What should the exit terms cover for each platform account?
Account ownership and who may revoke delegated access; the export format and frequency for client records; the notice period the contract requires; and what the supplier returns or deletes at termination. Google Business Profile adds its own seven-working-day route back to exclusive control, and that route applies to Google alone.



