Operations
Part of Build it in-house or brief an agency, SAAS marketing operations that hold up
How do I set and audit SAAS marketing service standards?
Set measurable SaaS marketing service standards, score suppliers with a weighted rubric and audit delivery against evidence before renewal.
What to take away
- Decide first what your SaaS marketing team is buyinga defined output (a campaign, a landing page) or a standard of service (response times, reporting, accuracy). Most disputes come from contracts that promise the second and measure the first.
- Write each standard so a stranger could score it from evidence: a threshold, a measurement window, and a named owner.
- Score standards before renewal, not after a failure. A rubric agreed in advance turns a difficult conversation into a short one.
- Keep security, data and reporting standards in the same document as creative standards. Splitting them creates gaps that suppliers rarely fill.
How to define standards you can actually measure
Separate outputs from service levels
An output is a deliverable: a landing page, a nurture sequence, a monthly report. A service level describes how the work is done, such as a two-working-day response to a brief change, or campaign tracking checked before launch.
Outputs vs Service Levels
Output
- What it is
- Deliverable
- Examples
- Landing page, report
- Disputed by
- Opinion
- Proof needed
- Delivered item
Service level
- What it is
- How work is done
- Examples
- 2-day brief response
- Disputed by
- Evidence
- Proof needed
- Timestamp, screenshot
Both belong in the contract, but they fail differently. Outputs are disputed by opinion. Service levels are disputed by evidence. If you cannot point to a timestamp, a screenshot or a dashboard, you have written an aspiration rather than a standard.
Set thresholds, windows and owners
Three Parts of Every Standard
- Thresholdthe pass mark
- Windowperiod measured over
- Ownerperson who answers for it
- Example95% tracking events fire correctly
- Examplemeasured monthly
- Exampleowned by supplier account lead
For example, a team paying £400 a month for campaign support might set a threshold of 95% of agreed tracking events firing correctly, measured monthly, owned by the supplier's account lead. That is checkable. "Good attention to detail" is not.
Build a scoring rubric and use it on a timetable
A five-column rubric
Score each standard from 1 to 5, then weight it. Weighting matters because a missed reporting deadline and a missed security patch should not carry the same consequence.
Rubric Weights by Standard
- Security and data handling25%
- Tracking and event accuracy20%
- Response time to briefed changes15%
- Creative or copy accuracy15%
- Documentation and handover15%
- Reporting delivered on schedule10%
| Standard | Weight | Score (1-5) | Evidence required | Consequence below threshold |
|---|---|---|---|---|
| Response time to briefed changes | 15% | 4 | Ticket timestamps | Written explanation, remediation plan |
| Tracking and event accuracy | 20% | 3 | Analytics screenshots, test log | Fix within five working days |
| Reporting delivered on schedule | 10% | 5 | Report archive | None |
| Security and data handling | 25% | 4 | Completed questionnaire, patch record | Escalation to contract review |
| Creative or copy accuracy | 15% | 4 | Sign-off record | Rework at supplier cost |
| Documentation and handover | 15% | 3 | Shared folder, runbook | Joint workshop within 30 days |
Multiply the score by the weight, sum the results, and you have a single number you can track quarter on quarter. The number is less important than the trend and the named evidence behind it.
Audit quarterly, decide annually
Run a light review every quarter and a full scoring exercise before renewal. Ask the supplier to self-score first, then compare. Differences between the two scores are where the real conversation sits.
At each quarterly review, the buyer's named reviewer should sample evidence across the review period for every standard. Check the sample against the agreed threshold and measurement window; include additional checks for higher-risk areas such as security and tracking.
- Gather relevant evidence, such as ticket timestamps, analytics screenshots, test logs, report archives and patch records.
- Keep an evidence log recording the standard, evidence reference, score and rationale, supplier self-score, reviewer, and any corrective action, owner and due date.
- Compare the supplier's score with the buyer's, record the explanation for any difference, and agree the next action.
Agree an escalation route in the contract, from the reviewer to a named contract owner and the appropriate procurement or legal contact. Record unresolved failures and corrective actions in the log, revisit them at the next review, and use the full scoring exercise to inform the renewal decision.
Build a consistent checklist from the standards in your contract, so each review checks the same thresholds and evidence. For cyber-risk clauses, consult the National Cyber Security Centre's 10 Steps to Cyber Security as a reference for controls to discuss, then specify the supplier's obligations and the evidence it must provide.
Put security, data and reporting in the same document
Security and data standards
A supplier handling your user data is part of your risk surface, even if they never touch production systems. Name the applicable rules in the contract: the UK GDPR and the Data Protection Act 2018, with the Information Commissioner's Office (ICO) as the UK's data-protection regulator. Set out access controls such as multi-factor authentication (MFA) and least privilege, require a current list of sub-processors, and specify how data is returned or deleted at the end of the contract.
Under Article 33 of the UK GDPR, a controller must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to risk people's rights and freedoms. The supplier should notify the controller promptly so the controller can assess its obligations; the 72-hour deadline is for the controller's notification to the regulator, not a default supplier notification deadline. For security assurance, state whether you require evidence against ISO/IEC 27001 or the UK's Cyber Essentials scheme, and what scope that evidence must cover.
Keep the wording plain enough that a non-specialist can check it. If a clause needs a translator, it will not be enforced.
Measurement standards
Agree how events are named, where they are recorded, and who tests them. Google's Google Analytics event setup documentation is a useful reference when writing a tracking standard both sides can follow.
Set service levels against your marketing plan and budget so the measures reflect the delivery model. The Chartered Institute of Marketing also publishes articles, news and reports that are worth reading when you want an outside view on marketing governance.
Common questions
How many standards should a contract contain?
Six to ten weighted standards is usually enough for a small or mid-sized SaaS team. More than that and nobody reviews them properly. Fewer and the contract cannot distinguish good delivery from poor delivery.
Who should own the score?
The buyer owns it, even when the supplier self-scores first. Assign one named person on your side, with a deputy, so the quarterly review does not stall when someone is on leave.
What if a supplier refuses to accept a rubric?
Treat that as evidence in itself. A supplier confident in its delivery will usually welcome a written standard, because it removes ambiguity about what you expect.
Should standards change during the contract year?
Yes, at the quarterly review, with both sides agreeing the change in writing. Standards frozen for twelve months go stale, particularly where tracking or platform rules have moved.
