Businesses will happily interrogate a Google Ads report down to the last penny. A three-quid increase in CPA? Questions. ROAS slipping? Meeting. Another £500 going into Performance Max? Better have a reason.
Fair enough. That’s responsible management.
But try a different question: who can actually access your Google Ads account today?
Not who should have access. Who does. Which employees, former employees, agencies, freelancers, manager accounts and connected tools can still get through the door?
It's remarkable how often the campaign numbers are reviewed more carefully than the permissions around them.
This is a business asset, not just a marketing login
Google Ads holds more than keywords and ad copy. It contains advertising budgets, commercial performance, conversion settings, strategy, and access to account administration. Depending on someone's permissions, they may be able to change campaigns, users and billing arrangements.
For plenty of businesses, that account is part of the revenue engine. Yet access is sometimes handled like a spare office key: handed out when it's useful, rarely asked for back.
Agencies change. People leave. Freelancers finish. Projects end. The permission that made perfect sense six months ago might make none today.
Access is not authorisation. Being technically able to open an account does not mean there's a current business reason, or permission, to use it.
An agency relationship is not a security policy
Google Ads Manager accounts are excellent tools. They let an agency manage multiple advertisers without everyone swapping passwords. But a manager account and its client relationships still need oversight.
Google distinguishes between levels of user access, linked manager accounts and administrative ownership. They're not all the same thing. Your business should know who has which level of control.
When a relationship ends, somebody needs to remove the right access, check the remaining administrator arrangements and document what's changed. Revoking one invitation isn't necessarily the whole story if a separate Google identity, another manager link or an authorised integration also exists.
That's not a reason to distrust agencies. It's a reason to have a proper handover. A professional agency should welcome one.
Why the FD should care as much as the marketing director
Imagine two findings in a board report.
Finding one: a profitable Search campaign has significant budget-related impression-share loss. We've modelled the extra investment, potential conversions and Google Ads conversion value — with assumptions clearly stated.
Finding two: nobody can produce a current list of who can administer the advertising account, approve material changes or remove a former supplier.
The first is a growth question. The second is a control question. Both belong in the same conversation.
Who can raise a £300 daily budget to £3,000? Who can change the conversion action that bidding is learning from? Who signs off that decision? Can we establish what happened afterwards?
Google Ads has an account change history. But having a record of changes isn't the same as having an approval process.
Good reporting explains the result. Good governance explains the responsibility.
Five questions worth asking this week
- Who controls the account? Can the business access and administer its own Google Ads account independently of a supplier, with appropriate administrator coverage?
- Who has access now? Review named users, permission levels, connected manager accounts and the relevant hierarchy. Don't mistake the list you expect for the list you've checked.
- What happens on exit? When an employee or agency leaves, who revokes access, reviews sessions and integrations where applicable, and records the handover?
- Who approves a material change? A large budget increase, bidding-strategy switch or conversion-tracking change ought to have a responsible decision-maker.
- Where's the evidence? Can you show when access was reviewed, what risks were identified and what was done about them?
None of that sounds exciting. Neither does reconciling the bank. Both are important.
Now add AI to the picture
Scripts, reporting connectors and AI-assisted analysis can save hours and expose problems that ordinary dashboards miss. I'm enthusiastic about that. We're building tools around exactly this sort of evidence-led PPC analysis.
But the useful question isn't simply can we automate it? It's what are we authorising the system to see, recommend or change?
A read-only audit that produces a source-backed recommendation is one thing. A tool allowed to change bids, export customer information or modify conversion settings is another.
Start with the minimum authorised access. Separate clients. Keep credentials out of code. Record changes and recommendations. Require human approval for material actions. If an AI recommendation is wrong, the business still needs to know who owns the decision.
Automation should improve accountability, not make it harder to find.
Compliance isn't a badge on the website
There is a legal dimension when personal data is involved, too. The Information Commissioner's Office explains that UK GDPR accountability requires appropriate measures and ongoing review. Its data protection by design guidance specifically discusses giving and revoking staff access.
An outdated permission does not, by itself, establish that a personal-data breach occurred. Nor does every Google Ads account contain the same categories of personal data. The obligation is to understand the access, assess the risk, and apply controls appropriate to the circumstances.
In other words, governance is something you do, not something you put in the footer.
The point
I've spent years finding wasted advertising spend: poor search terms, broken measurement, misplaced budget, automation chasing the wrong conversion.
But profit doesn't sit apart from accountability. You also need confidence in the people operating the account, the tools touching it and the decisions being made.
A beautiful ROAS won't fix weak permissions. A clever dashboard won't replace professional judgement. And an excellent agency shouldn't need to be asked twice to help a client retain control of its own business assets.
The best Google Ads account isn't just one performing well. It's one whose performance, decisions and governance can stand up to scrutiny.
Russell Anson runs Compulsion, an independent paid-search consultancy. Performance, profitability and accountability — with evidence you can defend. compulsion.agency
Related reading: Your Google Ads report looks great. So where's the money? and Two identical orders. Two totally different customers.