Key takeaways
- Never blend one client’s visitor evidence into another client’s report.
- Lead with readiness and business context before risk counts.
- Show denominators, coverage, freshness, and confidence.
- Use an appendix for sensitive evidence rather than an executive summary.
Design the report around decisions
Executives need scope, material change, impact definition, actions, and next steps. Operators need campaign and incident drill-downs. Investigators may need visitor-level evidence under tighter permissions. One report should not expose every detail to every audience.
Start with tracking and integration health because an incomplete evidence window changes how every later number should be read.
Use a stable metric dictionary
Define measured sessions, eligible sessions, suspicious sessions, confirmed provider invalid activity, analyzed spend, affected spend, estimated impact, provider credit, and verified protection. Include timezone, currency, date range, freshness, and data-source boundaries.
- Show the denominator beside every rate.
- Label estimates and confidence clearly.
- Retain unavailable rather than replacing it with zero.
- Link summary claims to supporting evidence.
Keep client operations accountable
Record who reviewed and approved an action, which client and website it affected, what the provider returned, when it was verified, and how it can be reversed. Portfolio views should aggregate only compatible, permission-safe measures.
Limitations
What this guide does not claim
Reporting does not make incomparable clients or channels comparable. Contractual, privacy, and provider constraints determine which evidence can be shared.
Evidence
Primary sources
- About invalid trafficGoogle Ads Help
- Clicks and sessions discrepancy troubleshootingGoogle Ads Help
- AI Risk Management FrameworkNIST
Read how we source, review, update, and correct content in our editorial standards.