Retail media risk scenarios with triggers and responses but no invented incidents

What to take away

A retail media risk scenario records what to inspect if a defined change occurs. It is not a forecast of an incident.
Maintain six scenarios, one per operating topic, and review them quarterly and after any change to the operation.
Each record carries a trigger, the evidence needed, a possible consequence, a response and a named owner role.
Attach no likelihood score, loss figure or staffing estimate until someone has measured one.
Keep an announced plan, current documentation and an observed change in separate records.

Example: a completed scenario record

A retailer is about to add an off-site audience segment to an advertising platform such as Google Ads. This is an illustrative proposed data flow, not a claim about an actual retailer or integration.

Completed scenario record

Scenario: Off-site audience segment added to the ad platform
Trigger: A proposed audience sync changes who receives the data
Evidence: Purposes, device activity, recipients, responsibility map
Consequence: Unresolved question about permitted processing scope
Response: Hold the sync and route it to the privacy lead
Owner: Privacy lead, with the measurement owner consulted

The ICO's guidance on storage and access technologies covers consent when advertising involves storing or accessing information on a device under the Privacy and Electronic Communications Regulations (PECR). Personal-data processing also needs assessment under the UK GDPR and Data Protection Act 2018.

Keep the processing in the organisation's UK GDPR record of processing activities. Assess whether a data protection impact assessment (DPIA) is required and, where it is, use the ICO's DPIA template.

Evidence: the audience definition, data fields, proposed recipient, data-flow documentation, privacy information and consent or other applicable basis for processing. Consequence: personal data could be used or disclosed in a way that has not been properly assessed, or advertising could rely on device storage or access without required consent. Response: pause the sync until the privacy lead has reviewed the data path, applicable PECR consent and any DPIA actions. Owner: privacy lead.

Advertising Data Change Review

New feature or recipient changes data path
Document purposes, devices, recipients, responsibility
Refer arrangement for qualified privacy review
Do not rely on tool name or supplier alone

Which topics to cover, and how often to review

Six topics cover most retailer operations: privacy and data paths, claim accuracy, measurement definitions, supplier dependency, competition and trading terms, and price statements.

Competition, trading terms and price scenarios

Competition and trading terms

Trigger: a proposed change to eligibility, exclusivity, placement or access terms for retail-media inventory. Evidence: the current and proposed terms, rate cards, eligibility criteria, placement rules and relevant communications.

Consequence: a restriction or difference in access could prompt a competition or trading-terms dispute. Response: pause the proposed change for commercial and legal review, including the Competition Act 1998 and relevant CMA guidance; check the Groceries Supply Code of Practice and the Groceries Code Adjudicator's remit where the retailer, supplier and arrangement fall within their scope. Owner: commercial or legal lead.

Price statements

Trigger: a campaign proposes a price, saving or comparison claim, or changes one already approved. Evidence: the exact claim, the prices being compared, the basis of comparison and the supporting records.

Consequence: a shopper could be misled, prompting a complaint, correction or withdrawal of the claim. Response: hold the claim until it is substantiated and its basis is clear; check CMA pricing practices guidance, the DMCC Act 2024 consumer-protection provisions and CAP Code rule 3.17. The Advertising Standards Authority (ASA) administers the CAP Code. Owner: pricing or brand-compliance lead.

Review each scenario quarterly, at the start of a campaign cycle, and after any change to the operation. Six is a working number, not a published standard. A retailer selling sponsored placements on its own site needs fewer records than one running off-site media too.

The retail media outlook for England keeps history, forecasts and scenarios in separate columns.

How to write a trigger and its evidence

The trigger names a specific change: a revised attribution specification, a new recipient in a data flow, or a claim that no longer matches its source. A trigger such as 'something changes' produces a record nobody can act on.

The evidence field lists what a colleague would need: the earlier and revised definitions, a scoped export, the claim wording, the source document, the review finding.

Handling a claim that outruns its evidence

Trigger: a reviewer finds a gap between a proposed advertising claim and the document behind it. Evidence: the wording, the source, the relevant output and the review finding. Consequence: the campaign could make an objective claim that is unsupported or misleading.

Response: withhold the claim, correct the wording or the evidence, and investigate. Owner: the brand or creative lead, who needs standing authority to pull a claim without waiting for a committee.

CAP Code rule 3.7 requires documentary evidence for objective marketing claims. The ASA administers the CAP Code. The record assumes no error rate and no level of automated reliability.

Unsupported AI Advertising Claim

Does the claim match its supporting record?

Yes

Keep the claim with evidence

Withhold claim, correct evidence, investigate

When a trigger fires

Write the date and the observation into the scenario record.
Classify the trigger as a plan, a document or an observed change.
Collect every item on the evidence list before drawing a conclusion.
Send the record to the named owner, who proceeds, pauses or escalates.
Log the decision and leave unanswered questions visible.

Definition changes are a separate job, the same discipline the retail media metrics register applies before any target is set.

Keeping plans, documents and observations apart

An announced release is not an incident. A revised specification in a supplier portal is not an incident either. Only an observed change belongs in an incident record.

Trigger: a supplier changes a service, sub-supplier or security control, or cannot provide agreed assurance. Evidence: the contract, current assurance material, access arrangements, incident-notification process and recovery arrangements. Consequence: a service interruption could affect campaign delivery, data handling or measurement. Response: verify the assurance gap, agree remedial action and use the contingency or pause affected access and feeds if needed. Owner: the supplier relationship owner, working with the security lead. The NCSC's supply chain security principle is a useful reference; it does not establish outage probability at your retailer.

Comparing definitions after a measurement change

Trigger: an adopted event or attribution specification is revised. Evidence: the earlier and revised definitions, scoped exports and the correction record. Consequence: two periods become incomparable. Response: explain the definition break before using the series for a performance claim. Owner: the measurement owner.

Clicks and credited sales do not establish incremental sales. Where a modelled figure is used, the assumptions belong in the same record. Check which method produced a figure in the comparison of attribution methods.

Common questions

How many scenarios should a retailer keep?

Keep a record for each relevant operating topic: data paths, claims, measurement, supplier dependency, trading terms and price statements. Add a scenario if the operation introduces another material exposure.

Who should own a scenario?

Name a role rather than a team: privacy lead for data paths, measurement owner for definition breaks, brand or creative lead for claims, supplier relationship owner for dependency, and commercial or pricing lead for trading terms and price statements.

What separates a trigger from an incident?

A trigger is a change that prompts inspection. An incident is an observed failure. A release that has not gone live is a trigger at most.