Social media manager red flags for a small business

How should you start with the promise, not the portfolio?

A polished portfolio can show design skill, but it does not prove that a provider can operate your accounts safely or produce qualified business outcomes. Begin with the sales promise. Ask which deliverables are guaranteed because they are under the provider’s control, such as a defined number of finished posts, a review window, scheduled publishing, or a reporting date. Then separate those commitments from outcomes affected by the offer, customer demand, platform distribution, seasonality, competition, sales follow-up, and the business’s own response capacity.

Treat guaranteed virality, followers, rankings, leads, bookings, or revenue as a serious warning sign unless the statement is narrowly defined and supported by evidence you can inspect. Google’s third-party policies specifically prohibit false, misleading, or unrealistic claims and use guaranteed top placement as an example. A credible provider can explain the process it owns and the uncertainty it cannot remove. It should not convert an unknown result into certainty merely to close the contract.

How should you reject a scope that cannot be counted or inspected?

Terms such as full service, daily management, engagement, and AI powered are not deliverables. The proposal should define unique post count, formats, connected profiles, research, source collection, design, captions, revisions, owner approval, publishing, failure monitoring, routine interaction support, sensitive handoff, reporting, and exclusions. It should also say what the business supplies and by when. If two people can read the same scope and expect different work, the ambiguity will become a dispute during the first busy month.

Ask to see one complete production cycle rather than a feature list. Follow a real offer from source facts through planning, finished creative, approval, scheduling, publication, customer response, and reporting. Clarify whether one idea resized for three channels counts once or three times, whether a carousel and simple video use different slots, and whether revisions change the delivery date. A provider that will not make the unit of work visible is difficult to compare and difficult to hold accountable.

How should you keep account ownership and recovery with the business?

A provider should request the smallest role that supports the agreed duties, not the broadest access available. Meta says people with full control can change settings, manage access, remove other people, or delete a Page, while task access can support narrower work in business tools. LinkedIn separates super admin, content admin, and analyst permissions. TikTok Business Center likewise separates full-control administrators from standard members and asset-level roles. These distinctions make shared primary passwords and automatic full-control requests unnecessary for many ordinary content assignments.

Keep the business as the owner of profiles, domains, analytics, billing relationships, source libraries, and recovery methods. Use named accounts and platform roles, enable the platform’s available security controls, and record who has access to which asset for what reason. A provider may need permission to publish, read eligible interactions, or review performance, but that does not automatically justify control over administrators, finance, unrelated ad accounts, lead exports, or deletion. Refusal to work within role-based access is a warning sign, not a convenience request.

How should you require current facts before creative production?

Generic intake creates generic content and makes factual mistakes more likely. The manager should identify a current source for services, prices, hours, locations, offer terms, availability, credentials, approved claims, testimonials, images, and CTA destinations. The workflow should distinguish durable facts from volatile details and assign an expiration or recheck owner to time-sensitive posts. If the provider proposes writing a month from an old website and a few vague themes, ask how it will prevent stale offers and unsupported details from entering the queue.

FTC advertising guidance applies to the complete customer impression, including express claims, implied claims, images, and material omissions. The business needs a reasonable basis for objective claims before the content runs. That means an approval request should present the visual, on-image text, caption, disclosure, CTA, destination, account, and scheduled context together. A manager who treats approval as a thumbs-up on a caption while hiding the final creative or link is transferring preventable risk back to the owner.

Why should you avoid accept fabricated proof or manipulative review tactics?

Customer proof can help a buyer decide, but a manager should preserve the original source, context, permission, and any material connection. The FTC’s Consumer Reviews and Testimonials Rule addresses fake or false reviews and testimonials, conditioned incentives, review suppression, and fake indicators of social media influence. The FTC also states that agencies, review brokers, and reputation-management companies are not automatically insulated from liability when they participate in prohibited conduct.

Reject offers to buy reviews, manufacture comments, hide negative feedback, present employees or relatives as independent customers, or turn a customer statement into a broader result than it supports. Ask how review excerpts are selected, whether meaning is preserved, how incentives or relationships are disclosed, and who approves public replies. A provider that treats trust signals as inventory to fabricate can damage the business long after a short-term metric looks better.

How should you demand reporting that leads to a business decision?

A monthly screenshot of followers, reach, and engagement is not enough to evaluate a management service. The report should first show what was planned, approved, published, delayed, corrected, or blocked. Then it should separate platform attention metrics from qualified actions such as calls, directions, website visits, quote requests, bookings, orders, applications, or tracked conversations. Google Business Profile, for example, exposes searches, views, clicks, and eligible customer interactions, while other platforms use their own definitions. The provider should not combine unlike metrics into one impressive number without explanation.

Ask for the reporting source, date range, definitions, attribution limits, and one explicit next decision: continue, stop, revise, or test. Google requires Business Profile third parties to provide accurate, accessible performance information and distinguish Business Profile data from other platforms. You should retain direct access to the underlying accounts and exports. If the provider owns the only dashboard, withholds source data, or reports attention without delivery and customer-action context, you cannot reliably judge the work or take the learning to another provider.

How should you inspect the exception and escalation rules?

Ordinary content is only part of social media operations. Ask what happens when an offer expires, a post fails, a customer disputes a charge, a complaint alleges harm, a message contains private information, a regulated question needs qualified review, or the owner misses an approval deadline. The provider should name which routine actions are authorized, which situations pause, who receives the alert, how quickly the business must respond, and what record is kept. Silence should not become approval, and automation should not turn an uncertain case into a confident public answer.

A useful service boundary protects both sides. The manager can own researched planning, finished creative, scheduled publishing, routine organization, and defined reporting while returning sensitive support, refunds, disputes, crisis communication, professional advice, negotiation, and sales closing to an authorized person. A red flag is not that a provider has exclusions. It is that the provider hides them, makes broad automation claims, or cannot explain the human handoff before the first exception occurs.

How should you confirm the exit before signing the agreement?

A clean offboarding clause should identify notice, final billing, scheduled content, open approvals, unfinished work, source files, licenses, brand assets, analytics, reports, platform roles, connected tools, customer conversations, and credential or token removal. Ask which files you receive, in what format, and when access will be relinquished. Google requires Business Profile third parties to provide a quick and easy way to discontinue service and, after notice, to let the client disassociate the management account and regain exclusive control within its stated period.

Do not wait for a dispute to discover that the provider controls the only administrator, recovery email, design source, tracking property, or content archive. Test the exit assumptions during onboarding: verify business-controlled ownership, export one report, identify the source library, and document the removal path. A reasonable cancellation term can protect planned capacity, but holding a profile hostage, threatening loss of access, or making the business pay merely to recover its own account is an immediate stop signal.

How should you run a paid pilot with real operating conditions?

References and examples help, but a limited paid pilot reveals how the provider handles your actual inputs, approvals, access, and deadlines. Choose one business goal, one or two active profiles, a small set of current source facts, one accountable approver, and a measurable CTA. Review the finished assets, factual corrections, response time, publishing reliability, reporting clarity, and the amount of work that remained with your team. Do not judge the pilot only by reach during a short period.

Expand only when the operating evidence is sound. The provider should deliver what it promised, surface missing facts instead of inventing them, respect the permission boundary, make revisions traceable, publish only approved work, and report what happened honestly. A strong pilot does not prove future sales. It proves that the business and provider can run a controlled system together, which is the foundation required before adding profiles, formats, interaction support, or a longer commitment.