Customer reviews quality checklist for retail teams

What to take away

A customer reviews quality checklist is a written set of tests run against every review a team collects, publishes or reuses. It stops quality depending on who is on shift.

Copy-and-use customer reviews checklist

Use one row per campaign, platform or moderation sample. Mark each check Pass or Fail, cite the evidence and name an owner; a blank is not a pass.

For each check, record the date, review or campaign reference, platform where relevant, evidence reference, Pass/Fail result, action required, owner and policy version.

Start with consent and the request itself

The checklist begins before a review exists. Decide who you may email, how often, and what happens when someone says no. The ICO's guidance on direct marketing using electronic mail sets out the consent and soft opt-in conditions that apply to review request campaigns. For email, apply the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR); separately, assess the lawful basis for personal-data processing under the UK GDPR and Data Protection Act 2018. A PECR permission to send and a UK GDPR lawful basis are separate checks. Build these conditions into the request template rather than the sign-off stage.

Record the source of every address you use. A request sent to a purchased list fails the checklist, however good the resulting review looks.

Keep the request short, state what you will do with the review, and give a working unsubscribe route. If nobody can trace an address in under a minute, the process has a gap.

Checks on the review content itself

Quality is not the same as positivity. A useful checklist tests accuracy and provenance instead.

Look for duplicates across email address, order number and device. Check whether any incentivised wording has gone undisclosed. Edits made after submission should be flagged, and the reviewer's original text kept on file.

Set a rule for translation and summarising, because a summary that changes meaning is a defect, not a convenience.

Where you import place or business review data from a platform, follow Google's best practices for using Places API web services, which cover caching and attribute handling. That keeps stale or duplicated records out of your own store.

UK review rules and platform records

Use the Competition and Markets Authority (CMA) guidance on online reviews alongside the Digital Markets, Competition and Consumers Act 2024, which bans practices involving fake reviews, including concealing that a review was incentivised. When a review is reused in an advert or other marketing communication, apply the Advertising Standards Authority's CAP Code rules on misleading claims and testimonials.

For each channel you use, record the platform and listing. Trustpilot, Google Reviews, Feefo and Reviews.io are examples of review platforms; they are not a required set. Include the relevant platform in the audit record so a decision can be traced to its source.

Moderation, records and the audit trail

Every rejection needs a reason code and a reviewer name. Reasons should map to a published policy, not to personal taste.

For example, a reason-code taxonomy could include DUPLICATE, INCENTIVE-NOT-DISCLOSED, PERSONAL-DATA, ABUSIVE-OR-ILLEGAL-CONTENT and PROVENANCE-UNVERIFIED. Record the action alongside the code; an unverified provenance flag should prompt investigation, not automatic rejection. Negative sentiment alone is not a reason to remove a review.

Store the decision, the date and the policy version. If a customer challenges a rejection a year later, that record is your defence.

Set a written retention period for consent records, and record the event it runs from and the review or deletion date. UK GDPR's storage-limitation principle requires personal data to be kept no longer than necessary; there is no single statutory period for every consent record. Put the period your organisation has justified in its retention schedule.

Separate moderation from marketing. The person who wants five stars on the homepage should not decide whether a two-star review stays.

Our commerce reviews operating workflow in England shows how those stages hand over between teams, worth reading before you assign moderation duty to one role.

Ownership and cadence

A checklist without an owner is a document rather than a control. Name one person for consent, one for moderation and one for reporting.

Run the full checklist monthly and a shorter version weekly. Log the result, even when nothing fails.

Training matters here. Customer experience training from CIM covers feedback handling and service quality, and it gives review teams a shared vocabulary when they argue about what counts as a defect.

Escalate any failure touching consent or disclosure immediately. Everything else can wait for the monthly review.

Decision table

The wider commerce reviews operations and delivery guide for 2027 shows how these checks fit into delivery planning, including the reporting cadence that keeps them alive.

Common questions

How often should the checklist be run in full?

Monthly is workable for most teams, with a weekly check on consent and duplicate handling. Increase the frequency if volume doubles or a new channel goes live.

Who should own review quality?

Operations should own the process, with a named moderation lead and a separate reporting owner. Marketing can request policy changes but should not decide individual moderation outcomes.

What counts as a failed check?

Any review published without a recorded consent basis, or removed without a reason code, is a failure. Treat both as reportable, even if no customer complains.

Do incentives always fail the checklist?

No. A disclosed incentive with a note in the record passes. An undisclosed one fails, because the reader cannot judge how much weight to give the review.