Five PR risk scenarios you write yourself, with owners and reversal but no probabilities

PR agencies risk scenarios are rehearsal prompts, not predictions. None below has a probability, severity rating, expected loss or claimed occurrence.

What to take away

These PR risk scenarios are rehearsal prompts, not predictions, and carry no probabilities or severity ratings.
Each scenario needs an owner, a trigger, a control, a reversal condition and documented evidence before action.
Publication remains on hold until named specialists test the actual controls with synthetic or authorised fixtures.
Named specialistsare the people the buyer names in the risk register, with the role and competence to test the control. Authorised fixtures are synthetic records, test data or approved samples that the data owner or rights holder permits for rehearsal.
Review the prompts when the service, source, law, guidance, supplier, data route or buyer risk changes.

1. An approved fact changes before release

Signal: the source owner issues a correction or the approved record differs from the draft. Exposure: an inaccurate claim enters controlled material or a pitch. Controls: source register, versioned approval and release hold. Trigger: any unresolved discrepancy. Owner: factual authority with advertising review where relevant. Action: stop release, preserve versions and correct downstream copies. Reversal: restart only when the factual authority confirms the corrected claim in the source register and the account director records that approval with date and version. Evidence needed: source, claim record, correction log and affected recipients.

Fact Correction Release Flow

Signal: source correction or record mismatch
Trigger: unresolved discrepancy
Action: stop release, preserve versions
Reversal: restart after documented approval
Evidence: source, claim, correction log

CAP Section 3 supports substantiation for objective advertising claims in scope. It neither classifies all PR material nor predicts a breach.

2. A media-contact route loses its evidence

Signal: provenance, recipient type, channel basis, transparency record or suppression status is missing. Exposure: personal data or electronic outreach proceeds without a defensible route. Controls: contact ledger, objection list and separated permissions. Trigger: the reviewer cannot reconstruct the decision. Owner: privacy and PECR leads. Action: quarantine the record and halt follow-up. Reversal: use it only after qualified review accepts current evidence. Evidence needed: source, dates, notices, objections and approval.

The ICO's business-to-business marketing guidance frames UK recipient and channel distinctions but does not authorise this scenario.

3. An AI-assisted draft lacks provenance

Signal: a factual passage or asset cannot be traced to the permitted source set. Exposure: error, confidential disclosure or rights uncertainty. Controls: restricted inputs, saved instruction version, human approval and manual fallback. Trigger: any source-trace failure. Owner: factual, AI, privacy, rights and security reviewers. Action: stop assisted production and preserve the artefacts. Reversal: resume after cause, correction and regression test. Evidence needed: inputs, output, licences, edits and test record.

The IPO and government copyright and AI report records policy work, not permission for a use.

4. Confidential account access is compromised

Signal: unexpected access, missing logs, an unrevoked account or suspicious export. Exposure: drafts, media lists or client material leave the approved boundary. Controls: buyer-owned access, least privilege, authentication, logs and rehearsed recovery. Trigger: the incident owner cannot account for an event. Owner: security lead, with legal and privacy escalation. Action: contain, preserve evidence, assess notifications and recover. Reversal: restore access only under documented authority. Evidence needed: timeline, logs, decisions and recovery test.

NCSC's incident-management collection supports preparation, response and recovery for cyber incidents. It does not decide whether a hypothetical event is reportable.

5. An independent media decision is misreported as delivery

Signal: a plan, invoice or dashboard treats editorial acceptance, wording, prominence or timing as agency-controlled. Exposure: a misleading scope or outcome claim. Controls: separate pitch, paid placement, owned content and editorial-result fields. Trigger: the contract or report promises independent coverage. Owner: PR, commercial, claims and measurement leads. Action: stop approval and correct the service and metric definitions. Reversal: proceed only when control and evidence are accurate. Evidence needed: contract, channel classification, pitch log and correction.

Worked example scenario

Scenario: a trade body updates a market-size figure after the account team has drafted a press release.

Field / Filled example

Signal: The source owner sends a correction that conflicts with the approved record.
Exposure: An inaccurate claim reaches media and client materials.
Controls: Source register, versioned approval and release hold.
Trigger: Any unresolved difference between the correction and the approved record.
Owner: Factual authority lead, named in the risk register.
Action: Stop release, preserve versions and correct downstream copies.
Reversal: Restart only when the factual authority confirms the corrected claim in the source register, the account director records the approval with date and version, and the buyer confirms the corrected release in writing.
Evidence needed: Source correction, claim record, correction log, recipient list and written approval.

Blank form to copy: Scenario: ____. Signal: ____. Exposure: ____. Controls: ____. Trigger: ____. Owner: ____. Action: ____. Reversal: ____. Evidence needed: ____.

How to prioritise without probabilities

Rank each scenario by detection time, reach of the exposure, legal or contract deadlines, number of dependent teams, and difficulty of reversal. Start with the scenario that has the longest detection time or the widest recipient set. Use review order, not likelihood. Record the order beside each owner in the risk register.

Review these prompts when the service, source, law, guidance, supplier, data route or buyer risk changes. Publication remains on HOLD until named specialists test the actual controls with synthetic or properly authorised fixtures.

Before you act

Replace every blank with your own approved evidence.
Assign an owner for each scenario before acting.
Define the trigger and control for each risk.
Document the reversal condition and required evidence.
Test controls with synthetic or authorised fixtures.
Keep publication on hold until specialists test controls.

Common questions

What should an England-operating buyer do with the blanks in these scenarios?

Use the worked example to fill each field with the buyer's own source records, then assign the owner before release. Keep the completed form with the risk register.

When should these PR risk prompts be reviewed?

Set a review date in the risk register and reopen the scenario after any listed trigger changes. Record the next review with the owner.

What evidence is needed for the AI-assisted draft scenario?

Keep the input set, output version, licences, edits and regression test record together. Stop assisted production and preserve those artefacts if a source trace fails.