Why a Campaign Report Is a Claim, Not a Conclusion
When an app marketing team reviews a performance report from an acquisition supplier, the document usually arrives looking authoritative: clean charts, familiar metrics, a confident narrative about momentum. Supplier due diligence when reporting campaign performance starts with a simple but uncomfortable recognition — that report was produced by a party with a commercial interest in how it reads. It is a claim about what happened, not a neutral record of it. Treating supplier reporting as evidence to be tested rather than a verdict to be accepted is the foundation of every other check that follows.
Part of the reason is structural. Mobile attribution is probabilistic by design. Last-click models, view-through windows, aggregated postback frameworks such as SKAdNetwork, modeled conversions, and privacy-driven signal loss all mean that even a scrupulous supplier’s numbers contain estimation. Diligence is not an accusation of dishonesty; it is the practice of knowing which figures were observed, which were modeled, and which were simply self-declared. A supplier that can walk you through those distinctions confidently and consistently is easier to work with than one that cannot.
The most useful first step is to separate delivery claims from outcome claims. “We served impressions across these placements” is a delivery claim that can be checked inside the supplier’s own ad system. “We produced retained, active users” is an outcome claim that requires matching against your first-party analytics or your measurement partner’s data. Many reporting packs blend the two without labeling the seam, so a strong impression figure sits next to a conversion figure as if both carried the same evidentiary weight. They do not. Asking a supplier to annotate which line items are delivery, which are attributed outcomes, and which are projections instantly raises the quality of the conversation.
Watch for proprietary composites as well. Terms like quality index, engagement score, or user intent rating can be genuinely useful internal tools, but they are not evidence unless the methodology behind them is disclosed and stable enough to audit. Request the formula, the inputs, and the update history. If the answer is that the score is confidential, that is a legitimate commercial position — but it means the score should carry no weight in your reconciliation.
Building an Evidence Hierarchy and Reconciling the Numbers
The practical way to run diligence is to rank the evidence you already control above the evidence a supplier provides. At the top sit platform-level and first-party data: installs and revenue reported by the app stores, in-app events from your own analytics, and subscription or transaction records from your own systems. Below that sit consent-based postbacks from a neutral measurement partner. At the bottom sits the supplier’s dashboard. This ordering does not make the supplier’s data useless — it usually explains why something happened, which raw install counts never can — but it sets the arbitration rule in advance, so disputes are resolved by method rather than by volume.
Reconciliation depends on a shared glossary. Before any report is accepted, agree on what counts as an install, whether re-installs and re-attributions are treated separately, how reinstalls after deletion are handled, which attribution window applies, which time zone governs the reporting period, and how invalid traffic is defined and removed. Persistent directional gaps between a supplier’s install figure and your attributed installs are the real signal; small variances are normal in any probabilistic system and should not be escalated into a crisis. The question worth asking is not “why is there a difference” but “does the supplier have a documented, consistent explanation for the direction and size of the difference.”
Ask for exports rather than screenshots. Event-level data, even in aggregated form, lets you test cohort retention, downstream activation, and purchase behavior — the measures that reveal whether acquired users are voluntary, real, and genuinely interested in the product. That is also where a supplier’s story either holds together or comes apart. If a partner claims credit for organic uplift, ask whether they can support that with a holdout or geo-split test, and accept a candid “we cannot measure that” as a better answer than a confident number with no design behind it. When shortlisting vendors, research directories and marketplace listings are a reasonable starting point for supplier discovery — for instance, teams comparing iOS acquisition options may begin from a listing such as purchase ios installs to identify candidates — but every listing should be treated as a research pointer, never as proof of performance or an endorsement.
Privacy belongs in this section, not in a legal annex. Confirm that consent signals travel with the data, that device-level identifiers are used only where policy and regulation permit, and that your measurement partner’s configuration matches what the supplier claims to be reporting against. A reporting methodology that quietly depends on identifiers you cannot lawfully collect is a methodology you cannot rely on.
A Practical Diligence Checklist and the Red Flags That Matter
A workable checklist fits on one page. Ask each supplier to document its attribution methodology in writing, name the data sources behind every reported metric, confirm that you can export raw reporting data on request, describe how consent and privacy signals are handled, and state plainly whether any traffic originates from device farms, incentivized engagement schemes, or coordinated install exchanges. Add contractual substance: audit rights, a clear invalid-traffic clause with remediation terms, defined data retention and deletion obligations, and an explicit agreement that your measurement partner — not the supplier’s dashboard — is the source of truth for attribution disputes. None of these requests are hostile. Suppliers who operate cleanly usually welcome them, because the same documentation protects them from being blamed for variances they did not cause.
The red flags are equally concrete. Guaranteed rankings, guaranteed retention levels, or a willingness to promise any target you name should end the conversation, because no legitimate acquisition method can control store ranking or user behavior. So should offers to manage ratings and reviews on your behalf, requests for App Store Connect or console credentials, and any suggestion of obscuring traffic sources or structuring campaigns to avoid platform review. A supplier who cannot or will not define invalid traffic, or who insists their dashboard must be accepted as authoritative, is asking you to give up the arbitration rule described earlier. That is the point at which diligence stops being a formality.
Consider a routine scenario. A team notices that supplier-reported installs run meaningfully ahead of attributed installs in its measurement partner, and that day-seven retention for the newly acquired cohort is softer than for older cohorts. The correct response is investigation before either acceptance or accusation: compare definitions, verify consent coverage in the partner configuration, break performance down by placement and creative, check whether re-attributions are being counted as new users, and ask the supplier to explain the gap using its own methodology. How a supplier responds to that request — with documentation, hypotheses, and a proposed test, or with deflection and pressure to renew — tells you more about long-term viability than any single month of metrics.
Finally, treat diligence as continuous rather than one-off. Re-run the same reconciliation each reporting cycle, keep a written record of which figures were verified against first-party systems and which remained supplier claims, and revisit the methodology whenever a supplier changes its measurement stack or expands into new inventory. The goal is not to catch anyone out; it is to ensure that the numbers guiding budget decisions are labeled honestly, sourced transparently, and open to challenge by the people paying for them.
