How to Investigate an Unexplained Ad Account Change Using Action History

A campaign's cost per result doubled overnight and the team chat is already three messages deep into denial. Do not run a meeting. Learning to investigate ad account changes is a mechanical process, and with a unified action history it takes about five minutes from "something is wrong" to "here is exactly what happened and who did it." This is the step-by-step.

The reason this is hard without a unified log is not that the information does not exist. It is that the information is scattered across each platform's separate change history, often collapsed under a shared login so nothing is attributed, and presented as a scroll-and-squint list rather than a filterable record. The method below assumes you have fixed that — a single action history across your accounts — because that is what turns a half-day investigation into a five-minute one.

Before you start: the one prerequisite

You cannot attribute a change to a person if everyone shares a password. The entire investigation method depends on each operator having a named seat, so that the log records "Maria paused this" rather than "the account owner paused this." If you are still on a shared login, that is the first fix, and it is covered in our guide to role-based seats and the setup steps for team roles. With named seats in place, every step below resolves to a person.

Step 1 — Pin the symptom to a time window

Start from the metric, not the log. Before you open the history, write down two things: which account or campaign moved, and roughly when. Look at the performance chart and find the inflection point — the day spend jumped, the hour conversions stopped, the point the line bent. You are converting a vague "performance is off" into a specific "the Acme account changed behavior sometime after Sunday evening." That window is the lens for everything that follows.

Step 2 — Filter the action history to the affected account

Open the unified action history and filter to the single account in question. This is where a cross-platform log earns its place: you are not deciding which platform to check, because all of them are in the same view. Filtering to one account immediately removes the noise from every other client and campaign you manage. If your symptom is platform-specific — a Meta campaign, say — you can narrow further, but starting at the account level catches changes you might not have predicted, like a budget edit on a sibling campaign that pulled spend.

Step 3 — Narrow to the time window and sort chronologically

Apply the window you pinned in Step 1. Sort by time so the changes read as a story: this happened, then this, then this. Most of the time the culprit is obvious the moment the list is short and ordered. The overnight budget edit, the accidental pause, the bid-strategy switch — they stand out because they are the only meaningful entries inside a tight window. You are no longer searching; you are reading a short, ordered list of facts.

Step 4 — Read the entry in full

Click into the change that matches the symptom. A useful log does not just say "budget changed" — it shows the old value, the new value, the actor, and the timestamp. "Daily budget raised from €60 to €180 by Maria at 22:40 Sunday" is a complete fact. You now know what changed, by how much, by whom, and exactly when. Cross-check that against the performance inflection: does the timing of the change line up with the timing of the metric move? If yes, you have your cause. If the timing is off, keep reading — there may be a second change, or the cause may be external rather than an edit.

Step 5 — Decide: keep or revert

The log gave you the fact. Now you make the judgment call, because the log never makes it for you. Three outcomes:

• Intentional and good — a buyer scaled a winner and it is working. Keep it, and note that the change should have been flagged.
• Intentional but wrong — someone changed a bid strategy that hurt performance. Revert it, and adjust your process so changes of that magnitude get a heads-up first.
• Accidental — a fat-finger extra zero on a budget. Revert immediately, and move on without drama because you have the timestamp and the actor; there is nothing to argue about.

This is the heart of the method: the software remembers, the human decides. The log makes the decision fast and well-informed; it does not replace it.

Step 6 — Close the loop with the named actor

Talk to the person the log named — not to assign blame, but to understand intent and prevent a repeat. "I saw you raised the Acme budget to €180 Sunday night; was that a scaling test?" is a calm, factual conversation because it starts from a record both of you can see. Contrast that with the no-log version, where the same conversation starts with an accusation and a denial and goes nowhere. The attributed entry turns a confrontation into a debrief.

Step 7 — Make it a weekly habit, not just an incident tool

The mistake most teams make is only opening the action history during a fire. The teams that get the most from it run a short proactive review — ten minutes a week — scanning the high-impact entries across accounts: budget changes above a threshold, pauses on top campaigns, and access events like new invites or role changes. This catches drift before it becomes an incident and, just as importantly, builds the reflex so that during a real fire, "check the log" is automatic rather than something someone has to remember.

A note on what to log before you ever investigate

The investigation method is only as good as the entries you have to work with, and that depends on which actions get recorded in the first place. The high-signal entries — the ones you will actually filter for during a fire — are predictable, so it helps to know what a complete action history captures:

• Status changes: every pause and resume on a campaign, ad set, or ad, with the actor and time. Most "where did my spend go" incidents resolve here.
• Budget and bid edits: the old value, the new value, and the named person. Most "why is spend so high" incidents resolve here.
• Creative and structural edits: who changed an ad's creative or renamed a campaign, which matters when a working ad suddenly underperforms.
• Access events: invites, role changes, and removals, which matter when the question is not "what changed" but "who suddenly had the ability to change it."

When all four categories live in one searchable timeline across Meta, Google, TikTok, Taboola, and Snapchat, the investigation steps below collapse to a filter and a glance. When they are scattered across five native histories, every step multiplies by the number of platforms involved. The whole reason a unified log makes investigation fast is that it front-loads this completeness — you are never wondering whether the change you are hunting for was even captured.

Worked example: the case of the dark winner

Put the steps together on a real-shaped incident. Monday, your best-performing TikTok campaign shows zero spend since Saturday. Step 1: the inflection is Saturday afternoon. Step 2: filter the action history to that ad account. Step 3: narrow to Friday-through-Sunday, sort by time. The list is four entries long. Step 4: read the relevant one — "Campaign paused by Tom at 15:20 Saturday." Step 5: this was clearly an error; the campaign was your winner and there was no reason to pause it. Resume it. Step 6: ask Tom — turns out he was pausing a different campaign and clicked the wrong row. Step 7: this is exactly the kind of change a weekly review would have caught Sunday instead of Monday, so it becomes a reason to keep the habit. Total time from symptom to resolved: under five minutes, most of it spent deciding rather than searching.

Why the connection underneath matters

The method only works if the log is accurate, and a log is only as accurate as the connection feeding it. Tools that reach the platforms through unofficial automation can record a local intention that never actually landed, or miss a structural change made directly in the platform. Wevion connects through the official platform APIs with OAuth and reconciles structural changes on a roughly fifteen-minute sync, so the action history reflects both what your team did in-app and what actually changed on the platform — including edits made outside the tool. We make the broader case for that foundation in our piece on the official Meta API advantages. For the conceptual case behind all of this, see why your ad accounts need a real audit log, and for the wider set of operational playbooks, the agency tools hub.

The whole method in one line

Pin the symptom to a time window, filter the action history to the account, narrow and sort by time, read the full entry, decide keep-or-revert, talk to the named actor, and review weekly. Seven steps, five minutes, zero meetings. The investigation that used to eat a morning becomes a routine lookup — and the spend that used to bleed while you reconstructed the timeline stays where it belongs. Pair the action-history habit with clean client reporting and you have an operation where nothing meaningful happens without a name and a timestamp attached to it.