Review acquisition by source

For every form, integration, event, partner, and import, record new contacts, confirmation rate, time to confirm, complaints, unsubscribes, permanent failures, and quarantined provenance. Inspect the live signup wording, default checkbox state, purpose, frequency promise, and confirmation path. A clean aggregate can hide one abusive source.

Retire forms or integrations with no owner. Verify that bot controls do not create inaccessible barriers and that they fail without silently subscribing people.

Reconcile suppression end to end

Compare central suppressions with every provider and application. Sample unsubscribe, one-click, complaint, permanent failure, and account-deletion events. Measure propagation delay and failed updates. Test that long-running queued campaigns recheck eligibility before dispatch.

Investigate any address sent after an applicable suppression as an incident. Do not report a high synchronization percentage while ignoring the people in the missing fraction.

Review lifecycle cohorts

Segment engagement using more than opens. Identify aging cohorts, frequency drift, abandoned automations, and re-engagement series that exceeded their planned limit. Confirm that inactive data remains within the approved retention window and that deletion reaches exports/caches.

Review sender evidence

Track bounce classes, complaint definitions/rates, provider deferrals, authentication alignment, and inbox-placement observations by stream. Keep provider requirements dated and linked to official sources. A reputation issue can expose a list problem, but changing IPs does not fix permission.

Turn findings into owned work

For every exception, record impact, owner, due date, containment, durable correction, and verification method. Examples include a broken unsubscribe webhook, stale import source, duplicate reactivation, unsupported internationalized address, or provider suppression mismatch.

Publish a short review receipt: period, sources covered, exceptions, actions, approver, and next review. Avoid including raw addresses in the report.

Test the routine itself

Quarterly, introduce safe fixtures for unsubscribe, complaint, permanent bounce, provider retry, duplicate import, and expiry, then verify expected state. Review alert thresholds for noise and missed incidents.

The routine succeeds when fewer unwanted addresses enter, every removal is honored, and exceptions close with evidence. Deleting “unengaged” rows without understanding acquisition and consent is not hygiene; it is only data reduction.