No single Google role controls the full marketing system. A Google Ads administrator may not control Analytics, Tag Manager, Search Console, Business Profile, Merchant Center, YouTube, the website, call platform, or CRM. An access review must map who can spend, publish, verify, edit public information, view customer data, change conversion definitions, and recover each account.
Treat unfamiliar access as an investigation, not an automatic deletion. An old agency account may publish tags, own a phone number, verify Search Console, update a product feed, or control a YouTube Brand Account. Add and test replacement company access, preserve configurations, and verify customer paths before removing the dependency.
Evidence to collect before changing Google marketing system
A useful review identifies every account, direct and inherited user, manager link, publisher, owner, billing contact, recovery method, service account, outside provider, public-report link, and production dependency. It assigns a keep, reduce, transfer, remove, or investigate action with an owner and test.
- Exact account IDs and URLs for Ads, GA4, Tag Manager, Search Console, Business Profile, Merchant Center, YouTube, website, call platform, CRM, and billing.
- Users, groups, manager accounts, owners, publishers, outside domains, invitations, roles, 2-Step Verification, and business purpose.
- Product links, conversion sources, audiences, feeds, channels, locations, website verification methods, call numbers, and CRM integrations.
- People who can spend budget, publish tags or pages, change public information, view customer data, alter lead stages, and change billing.
- Last activity, change history, production versions, account recovery, alert recipients, provider contracts, and offboarding evidence.
- A company-controlled backup administrator test plus real lead, website, reporting, public-profile, and recovery checks.
Inventory accounts and company ownership
Google Ads users and manager accounts
Review location: Google Marketing Access Review this access and risk review, Google Ads > Admin > Access and security plus Managers, Billing, Linked accounts, and Change history
Evidence to capture: Record users, roles, invitations, manager customer IDs, allowed domains, authentication, billing control, linked products, conversion changes, last activity, and approved purpose.
Response when the check fails: Keep company administration, remove stale access after testing, reduce roles, and document each outside manager relationship and termination procedure.
GA4 users and sensitive data
Review location: Google Marketing Access Review this access and risk review, GA4 Admin > Account access management, Property access management, Product links, and change history
Evidence to capture: Capture direct and inherited roles, groups, cost and revenue restrictions, service accounts, linked Ads and other products, report dependencies, and users who can create audiences or change key events.
Response when the check fails: Retain internal administrators, narrow roles and data access, transfer company reports, and investigate unexplained configuration changes.
Tag Manager and website publishers
Review location: Google Marketing Access Review this access and risk review, Tag Manager user management and versions, CMS, hosting, consent platform, DNS, forms, and release tools
Evidence to capture: Identify everyone who can publish tags, scripts, pages, forms, redirects, banners, phone numbers, or domain changes. Record individual access, MFA, environment, change evidence, and rollback control.
Response when the check fails: Reserve production publishing for trained accountable users, remove shared accounts, preserve versions, and require customer-path tests after changes.
Review spending, publishing, and public-edit authority
Search Console owners and verification
Review location: Google Marketing Access Review this access and risk review, Search Console > Settings > Users and permissions, Ownership verification, and Associations
Evidence to capture: Record verified and delegated owners, users, DNS or file tokens, Analytics and Tag Manager verification, website and DNS controllers, and connected services.
Response when the check fails: Add durable company ownership, preserve a tested verification method, and remove stale tokens only after the property remains verified.
Business Profile people and public edits
Review location: Google Marketing Access Review this access and risk review, Business Profile settings > People and access plus location and notification settings
Evidence to capture: Capture primary owners, owners, managers, location groups, invitations, public-edit responsibility, review response, phone and website accuracy, suspension alerts, and linked Ads accounts.
Response when the check fails: Protect company primary ownership, add backup users, correct stale providers, and assign public-response and escalation responsibility.
Merchant Center and product feeds
Review location: Google Marketing Access Review this access and risk review, Merchant Center > Settings > People and access, Business information, Data sources, Website, and Linked accounts
Evidence to capture: Record administrators, standard users, email-only users, website claim, data-source owners, feed credentials, scheduled fetches, platform connections, Ads links, diagnostics, and billing where applicable.
Response when the check fails: Transfer feed and website control, remove stale access, rotate exposed credentials, and verify product updates and diagnostics after changes.
YouTube channel and Brand Account
Review location: Google Marketing Access Review this access and risk review, YouTube Studio > Settings > Permissions plus Brand Account permissions where still applicable
Evidence to capture: Identify the exact channel, primary owner or permissions model, managers, editors, viewers, linked Ads account, recovery, monetization or billing, and content-publishing responsibility.
Response when the check fails: Add company-controlled backup ownership, use channel permissions instead of password sharing, and test upload, reporting, and Ads links before removing access.
Inspect data, billing, provider, and recovery dependencies
CRM, call, booking, and customer data
Review location: Google Marketing Access Review this access and risk review, CRM users, call provider, booking platform, chat, integrations, API credentials, lead exports, and retention settings
Evidence to capture: Record administrators, exports, field-change authority, number ownership, recording access, integration accounts, API keys, source mappings, lifecycle-stage changes, and outside-provider access to customer data.
Response when the check fails: Move accounts and numbers under company control, narrow data access, rotate credentials, preserve records, and validate lead flow after corrections.
Billing, alerts, and outside providers
Review location: Google Marketing Access Review this access and risk review, Google payments profiles, Ads billing, Cloud billing where used, platform subscriptions, contracts, alert settings, and company records
Evidence to capture: Identify payment profile owners, cards or invoices, billing contacts, budget-alert recipients, provider scope, renewal, termination, deliverable ownership, and accounts the provider created.
Response when the check fails: Add company billing contacts, document provider access and exit steps, transfer deliverables, and correct personal or expired payment dependencies.
Backup access and continuity
Review location: Google Marketing Access Review this access and risk review, Asset register, password manager, product accounts, tag versions, website backup, reporting, public profiles, and test-lead procedure
Evidence to capture: Have a backup administrator open each product, inspect critical settings, reach billing, access the website and CRM, publish only in a controlled test where appropriate, and complete a labeled lead.
Response when the check fails: Add missing access, transfer ownership, document identifiers and recovery, and repeat the exercise until one unavailable person cannot stop marketing operations.
Prioritize access changes without breaking marketing
Treat missing company ownership, unknown spend authority, exposed customer data, public-report leaks, unexplained publishers, compromised accounts, and broken billing as urgent. Next correct single-provider dependencies, stale external access, and unreliable measurement. Low-risk viewers and naming cleanup can follow once control and continuity are proven.
Priority 1: Account, data, or spending exposure
Use this level for unknown administrators, unauthorized budget control, public customer data, malicious tags, compromised credentials, lost primary ownership, or billing failures that threaten active services.
Priority 2: Production and continuity dependency
Use this level for one-person publishing, agency-owned phone numbers or reports, untested verification, stale providers, undocumented product links, and customer paths that cannot be maintained internally.
Priority 3: Permission and documentation hygiene
Use this level for stale viewers, pending invitations, duplicate accounts, unclear naming, and missing review dates after critical access and production paths are protected.
Official Google Marketing review references and related ALLMSP services
Confirm the current official google Marketing Access Review documentation for Google Marketing Access Review: Who Should Control Each Account? against the live administration screen before approving a procedure.
- Manage Google Ads users and access.
- About search terms insights.
- Set up Google Ads website conversions.
- Link Google Analytics and Google Ads.
- Search Console owners and permissions.
- Business Profile owners and managers.
Google Marketing Access Review review manager work can draw on Google marketing services, Google Ads support, online marketing services from ALLMSP.
Frequently Asked Questions
Who should control a company's Google Ads account?
Review google Ads > Admin > Access and security plus Managers, Billing, Linked accounts, and Change history and retain current evidence that record users, roles, invitations, manager customer IDs, allowed domains, authentication, billing control, linked products, conversion changes, last activity, and approved purpose. If the evidence is incomplete or the control fails, assign an owner to keep company administration, remove stale access after testing, reduce roles, and document each outside manager relationship and termination procedure, then retest before closure.
Which Google Analytics permissions should a marketing access review examine?
Review gA4 Admin > Account access management, Property access management, Product links, and change history and retain current evidence that capture direct and inherited roles, groups, cost and revenue restrictions, service accounts, linked Ads and other products, report dependencies, and users who can create audiences or change key events. If the evidence is incomplete or the control fails, assign an owner to retain internal administrators, narrow roles and data access, transfer company reports, and investigate unexplained configuration changes, then retest before closure.
Why are website and Tag Manager publishers part of a marketing access review?
Review tag Manager user management and versions, CMS, hosting, consent platform, DNS, forms, and release tools and retain current evidence that identify everyone who can publish tags, scripts, pages, forms, redirects, banners, phone numbers, or domain changes, Record individual access, MFA, environment, change evidence, and rollback control. If the evidence is incomplete or the control fails, assign an owner to reserve production publishing for trained accountable users, remove shared accounts, preserve versions, and require customer-path tests after changes, then retest before closure.
Who should own a company's Google Search Console property?
Review search Console > Settings > Users and permissions, Ownership verification, and Associations and retain current evidence that record verified and delegated owners, users, DNS or file tokens, Analytics and Tag Manager verification, website and DNS controllers, and connected services. If the evidence is incomplete or the control fails, assign an owner to add durable company ownership, preserve a tested verification method, and remove stale tokens only after the property remains verified, then retest before closure.
How should Google Business Profile access be reviewed?
Review business Profile settings > People and access plus location and notification settings and retain current evidence that capture primary owners, owners, managers, location groups, invitations, public-edit responsibility, review response, phone and website accuracy, suspension alerts, and linked Ads accounts. If the evidence is incomplete or the control fails, assign an owner to protect company primary ownership, add backup users, correct stale providers, and assign public-response and escalation responsibility, then retest before closure.
What should a Merchant Center access review include?
Review merchant Center > Settings > People and access, Business information, Data sources, Website, and Linked accounts and retain current evidence that record administrators, standard users, email-only users, website claim, data-source owners, feed credentials, scheduled fetches, platform connections, Ads links, diagnostics, and billing where applicable. If the evidence is incomplete or the control fails, assign an owner to transfer feed and website control, remove stale access, rotate exposed credentials, and verify product updates and diagnostics after changes, then retest before closure.
How can a company protect ownership of its YouTube channel?
Review youTube Studio > Settings > Permissions plus Brand Account permissions where still applicable and retain current evidence that identify the exact channel, primary owner or permissions model, managers, editors, viewers, linked Ads account, recovery, monetization or billing, and content-publishing responsibility. If the evidence is incomplete or the control fails, assign an owner to add company-controlled backup ownership, use channel permissions instead of password sharing, and test upload, reporting, and Ads links before removing access, then retest before closure.
Which non-Google systems belong in a Google marketing access review?
Review cRM users, call provider, booking platform, chat, integrations, API credentials, lead exports, and retention settings and retain current evidence that record administrators, exports, field-change authority, number ownership, recording access, integration accounts, API keys, source mappings, lifecycle-stage changes, and outside-provider access to customer data. If the evidence is incomplete or the control fails, assign an owner to move accounts and numbers under company control, narrow data access, rotate credentials, preserve records, and validate lead flow after corrections, then retest before closure.
Why should marketing billing and provider contracts be reviewed with account access?
Review google payments profiles, Ads billing, Cloud billing where used, platform subscriptions, contracts, alert settings, and company records and retain current evidence that identify payment profile owners, cards or invoices, billing contacts, budget-alert recipients, provider scope, renewal, termination, deliverable ownership, and accounts the provider created. If the evidence is incomplete or the control fails, assign an owner to add company billing contacts, document provider access and exit steps, transfer deliverables, and correct personal or expired payment dependencies, then retest before closure.
What proves that Google marketing accounts are ready for a provider or employee departure?
Review asset register, password manager, product accounts, tag versions, website backup, reporting, public profiles, and test-lead procedure and retain current evidence that have a backup administrator open each product, inspect critical settings, reach billing, access the website and CRM, publish only in a controlled test where appropriate, and complete a labeled lead. If the evidence is incomplete or the control fails, assign an owner to add missing access, transfer ownership, document identifiers and recovery, and repeat the exercise until one unavailable person cannot stop marketing operations, then retest before closure.
