# Evidence request for the marketing data audit

Send this to the owners of each system. Replace the placeholders and delete the sections that do not apply.

Subject: Read-only evidence for the marketing data audit (<window>)

Hi <owner>,

We are auditing the data behind <outputs, for example Paid media daily, Pipeline by source and the qualified-demo upload>. The audit only reads data and settings; nothing in your systems will be changed. We do not need passwords, API keys, tokens or any export with contact details. If something below needs access you would rather not grant, an export or a screenshot works just as well.

## Warehouse (<BigQuery | Snowflake>)

- A read-only route for the audit: BigQuery Data Viewer on <datasets> and BigQuery Job User on the project, used through `execute_sql_readonly` (a custom role with `bigquery.jobs.list` also lets the audit report its own query cost); or a Snowflake role with USAGE and SELECT on <databases and schemas>, an extra-small warehouse, a statement timeout and the query tag marketing-data-audit.
- If no access is possible: someone with access runs the queries we send and returns the CSV results. They return totals, counts and flags, never contact details.
- An administrator's export of who can read <marketing datasets or schemas> and the dbt failure schema (dataset IAM bindings or SHOW GRANTS output).

## Ad platforms (Google Ads, Meta, LinkedIn, Microsoft Advertising)

- The list of every ad account with spend in <window>: account ID, name, currency and time zone, including client accounts under a Google Ads manager account.
- An account-day export for <window>: date, account ID, currency, spend, conversions. Please note the attribution setting (Meta) and which conversion actions count (Google Ads).
- For Google Ads: the click-through conversion window of each primary conversion action.

## GA4

- Property ID, time zone and currency, and whether the BigQuery export is daily, streaming or both.
- The session default channel group report for <window>: sessions and key events by channel.

## Connectors (Fivetran, Airbyte, Data Transfer Service)

- For each connection feeding the warehouse: sync frequency, rollback or conversion window setting, the time of the last successful sync, schema change handling, history mode per table, last sync status and any open warnings. Screenshots are fine; please hide nothing but credentials, which we never need.

## dbt

- The latest production `manifest.json`, `run_results.json` and `sources.json` (or `freshness.json`), from the job artifacts or the `target/` folder. Please do not run anything against production for us.
- The job steps and schedule for the production job, and what triggers the syncs or uploads that read its models.

## CRM (HubSpot or Salesforce)

- Internal names of the first-touch source (HubSpot: Original Traffic Source), its drill-downs and the click ID properties.
- How deal source is decided (the rule, not the data).

## Billing (Stripe or other)

- Which field links a billing customer to the CRM account (for example a metadata key), and where the warehouse copy comes from.

## Dashboards and syncs

- For each critical dashboard: the data source behind three key tiles, their filters, the date range setting and the cache or refresh setting.
- For each audience sync or conversion upload: its schedule or trigger, whether it waits for the dbt job, and the run log for the last 7 days (rows added, changed, removed and failed).

## Definitions

- The definition and owner of each metric on <outputs>, if written anywhere (metrics.md, a semantic layer, a spreadsheet).
- The FX policy used for reporting, and any thresholds or exceptions already agreed.
- If CAC or ROAS sits next to finance numbers: invoiced media per platform and month, net of credits, and which numerator CAC uses (platform cost, invoiced media or fully loaded cost).

Deadline: <date>. Questions to <role>.

Thank you.