Appointing a social media agency is only the beginning. The quality of the onboarding process determines whether the agency can work securely, understand the business and produce content that supports real commercial goals. A rushed handover often creates avoidable delays, unclear approvals and unnecessary access risks.
This social media agency onboarding checklist is designed for Malta businesses moving from selection into delivery. It covers ownership, access, brand information, content, customer data, approvals, reporting and the first 30 days. If you are still comparing suppliers, begin with DCP’s guide to briefing a social media agency.
1. Confirm the scope before granting access
Start with a written list of the services the agency is responsible for. Social media management can include strategy, content planning, copywriting, graphic design, video editing, publishing, community management, paid campaigns, influencer coordination and reporting. Do not assume every activity is included.
Record the platforms, posting frequency, content formats, languages, advertising responsibilities and working hours. Define whether the agency is expected to answer comments and direct messages, or whether it should escalate enquiries to an internal team.
- Which platforms and profiles are included?
- Who creates photographs, videos and design assets?
- Who writes and approves copy?
- Is community management included, and during which hours?
- Who handles paid campaigns and advertising spend?
- Which reports and meetings are included?
- What is explicitly outside the agreed scope?
2. Keep the business in control of every account
The company should retain ownership of its social profiles, advertising accounts, billing arrangements, pixels, audiences and analytics properties. The agency should receive the access needed for its role rather than creating critical assets in an employee’s or supplier’s personal account.
Use the platform’s access and partner-management features instead of sharing passwords. Meta allows businesses to invite people or give a partner access to selected assets within a business portfolio. Its guidance also recommends enabling two-factor authentication. Review Meta’s partner-access guidance.
LinkedIn uses separate roles for Pages and Campaign Manager. Some advertising tasks require permissions on both the ad account and the associated Page, so confirm both sides during onboarding. LinkedIn’s permissions guidance explains what each Campaign Manager role can do.
3. Apply least-privilege access
Give each person only the permissions required for their responsibilities. A designer who prepares organic posts may not need billing control, audience downloads or the ability to add other administrators. Restricting privileges reduces the impact of mistakes and makes offboarding easier.
Keep at least two trusted people inside the business with high-level control so access does not depend on a single employee or supplier. Meta’s security guidance recommends having two people with full control of the business portfolio and using two-factor authentication. See Meta’s business-security recommendations.
Create an access register containing the platform, asset, person or partner, role, approval date and planned review date. Review it when responsibilities change and at the end of the agreement.
4. Transfer brand and commercial context
A logo folder is not a complete brand handover. The agency needs to understand the offer, audiences, positioning, buying journey, tone and subjects the brand should avoid. Explain how social media supports the wider marketing plan rather than treating posting as an isolated activity.
- Brand guidelines, approved logos, fonts, colours and templates.
- Products and services, priority audiences and geographic markets.
- Value propositions and claims that can be supported with evidence.
- Tone of voice, spelling conventions and preferred terminology.
- Competitors and examples of content the business considers appropriate.
- Seasonal priorities, launches, events and operational constraints.
- Existing customer questions, objections and sales insights.
For regulated or sensitive sectors, provide a clear list of claims requiring legal, regulatory or technical review. Identify the qualified reviewer and the records that must be retained.
5. Agree content pillars and channel roles
Each channel should have a purpose. LinkedIn may support B2B credibility and conversations, while Instagram may showcase work visually and Facebook may support local community engagement. Reposting identical content everywhere without considering the audience usually weakens the result.
Agree a small set of content pillars connected to customer needs and business objectives. Examples could include practical education, service explanations, proof of process, company news, team expertise and frequently asked questions. The mix should leave room for timely content without making every post reactive.
Document the primary call to action for each campaign or content series. It might be a consultation, quotation, event registration, product purchase or useful resource. The agency should know what happens after someone responds.
6. Build an approval workflow that can meet deadlines
Name the people who can approve content and specify which items need additional review. Set realistic response times and decide what happens if a deadline passes. A single accountable approver is usually more efficient than an undefined group.
- How far in advance will the content calendar be shared?
- Where will drafts, comments and final approvals be recorded?
- Which edits can the agency make without returning for approval?
- Who approves advertising copy, targeting and spend?
- Which subjects require management, legal or compliance review?
- What is the process for urgent or time-sensitive content?
Use one agreed system for final approval. Decisions scattered across email, messaging apps and verbal calls make it difficult to know which version was authorised.
7. Define community-management and escalation rules
Comments and private messages may contain sales enquiries, complaints, personal data or urgent issues. Give the agency response guidance and escalation routes before it begins monitoring the accounts.
Prepare approved answers for common questions, but do not force every situation into a script. Define what the agency may answer independently, what it must acknowledge and escalate, and what it should hide or remove under the moderation policy.
The escalation matrix should cover complaints, threats, discriminatory content, suspected fraud, media enquiries, legal issues and accidental disclosure of personal information. Include internal contacts and backup contacts, not just department names.
8. Address personal data and lead handling
Social profiles, lead forms, custom audiences and private messages can involve personal data. Document what information is collected, why it is needed, where it is stored, who can access it and when it will be deleted. Avoid downloading or retaining more data than the process requires.
The European Commission summarises the GDPR principles as lawfulness, fairness and transparency, purpose limitation, data minimisation, storage limitation, accuracy, integrity and confidentiality, and accountability. Review the Commission’s data-protection overview.
Clarify the company’s and agency’s roles in the contract and document any approved subprocessors or international transfers. Obtain appropriate advice where the processing arrangement is complex. For website-related data collection, DCP’s privacy and cookie checklist provides a related implementation guide.
9. Establish the measurement baseline
Capture the starting position before the agency changes content or campaigns. Save current follower counts, reach, engagement, website referral traffic, lead volumes, advertising results and any available lead-quality information. A baseline helps distinguish improvement from ordinary fluctuation.
Reporting should connect activity to the objective. Publishing volume and follower growth can provide context, but they do not replace measures such as qualified enquiries, booked calls, purchases or event registrations. Use DCP’s social media reporting checklist to agree the monthly view and the digital marketing measurement plan to align channels.
10. Plan the first 30 days
Week 1: access and discovery
Complete the asset inventory, permissions, two-factor authentication, brand handover, data-protection review and stakeholder interviews. Confirm the baseline and identify missing information.
Week 2: strategy and workflow
Agree channel roles, content pillars, target audiences, calls to action, approval steps, community rules and reporting definitions. Resolve account or tracking issues before depending on them.
Week 3: production and review
Prepare the first content batch, test the approval process and check that designs, claims, links and tracking are correct. Build enough lead time for revisions without delaying the planned publishing schedule.
Week 4: launch and learn
Begin publishing, monitor responses and record workflow problems. Review early qualitative feedback and operational issues, but avoid declaring success or failure from a few days of results. Agree what will be tested in the next cycle.
Documents the agency should receive
- Signed scope, deliverables and contact list.
- Account and asset inventory with approved access roles.
- Brand guidelines and organised creative assets.
- Audience, offer and campaign-priority summary.
- Content approval and escalation matrix.
- Community-management and moderation guidance.
- Data-handling instructions and relevant contractual terms.
- Measurement baseline, KPI definitions and reporting schedule.
- Upcoming events, launches, offers and blackout dates.
Common onboarding mistakes to avoid
- Sharing passwords instead of assigning platform access.
- Allowing a supplier to become the only account administrator.
- Starting content production before objectives and audiences are clear.
- Leaving approval responsibility with an unnamed group.
- Treating engagement as the only measure of success.
- Giving the agency customer data without documented handling rules.
- Failing to plan how access and assets will be returned at offboarding.
Create a secure, accountable start
Good onboarding helps a social media agency work faster without weakening the client’s control. The business keeps ownership of its assets, the agency receives clear responsibilities, and both sides know how content, enquiries, data and results will be managed.
Digital Consulting Pros provides social media management for Malta businesses, including planning, content, publishing and performance reporting. A structured onboarding process gives the partnership a stronger foundation from the first month.
