UK online review governance in 2026: why a rating needs an audit trail

The rating is a consumer-information system, not a neutral service score

For many UK businesses, a rating is now encountered before the customer sees a price, enters a shop or speaks to a member of staff. Search results, maps, booking platforms, marketplaces and website widgets place star scores at the start of the buying journey. This matters particularly for SMEs, high-street operators and newer ventures, for which a visible reputation can partly substitute for an established brand.

The common management mistake is to treat the headline score as a direct read-out of service quality. It is more accurately understood as the public output of a consumer-information system. The underlying experience matters, but so do the rules governing the system: which customers are asked for feedback, when they are asked, which channel is used, whether a benefit is offered, how content is moderated and how branches, products or periods are combined. Customers see the resulting score; they do not ordinarily see those design choices.

This does not mean ratings are unhelpful. A 2024 meta-analysis finds that online reviews can affect purchase intention, while a systematic review of the literature identifies credibility as a central issue in how reviews are received ↗ ↗. Together, those findings support a measured conclusion: review information can influence decisions when it is relevant to the purchase and consumers have reason to regard it as credible. They do not justify a universal claim that a one-star increase delivers a predictable sales return, or that every weaker rating reflects poorer delivery.

That distinction has become more important in the UK. A rating may be used externally as evidence that a business is trusted and internally as evidence that a service-improvement programme has succeeded. Both uses can be legitimate, but only if leaders understand what the number captures, what it excludes and whether its presentation gives a fair overall impression.

Sanctuary’s interpretation is that review collection and display should be governed as consumer-information practices, not treated solely as marketing activity or a customer-service metric. The key question is not simply whether the average has risen. It is whether a prospective customer can reasonably understand what the rating represents and whether it is sufficiently connected to the experience they are likely to receive.

CMA scrutiny changes the governance question, but investigation is not guilt

The enforcement context raises the stakes for businesses that use ratings and testimonials to win custom. The CMA’s direct consumer enforcement guidance states that relevant infringements may attract penalties of up to £300,000 or, where higher, 10% of worldwide turnover ↗. That maximum is not a prediction for an individual business, and a weak review process is not automatically unlawful. Its practical implication is more basic: material consumer-facing claims require evidence, ownership and meaningful oversight.

The CMA’s 2026 announcement of investigations into five businesses illustrates the range of practices capable of attracting attention. The concerns included potentially inflated star ratings, the treatment of negative reviews, potentially staff-generated reviews and discounts offered for undisclosed five-star reviews ↗. Crucially, the announcement does not establish that any of those businesses breached consumer law. An investigation signals regulatory scrutiny and unresolved questions, not a finding of misconduct.

The analytical point is nevertheless significant. Review risk is not confined to entirely invented feedback. A review can be connected to a real customer experience while the overall public picture is distorted by selectively asking satisfied customers, making criticism less visible, or presenting an incentive-driven sample as wholly independent. The relevant governance question is therefore broader than whether a business can say that its reviews are “real”. It is whether the collection and display practices create a potentially misleadingly favourable impression.

The CMA’s first-year update on direct consumer enforcement suggests that consumer information is being treated as a substantive governance issue. It reported 14 investigations, two settlements, £760,000 ordered in consumer refunds, £4.7 million in fines, 157 advisory and warning letters, and 46 information notices ↗. These figures are not evidence of the prevalence of non-compliance in review markets or any particular sector. They do, however, make passivity a weaker management position.

For directors, franchise operators and owner-managers, the appropriate response is proportionate control rather than legalistic theatre. The business should be able to identify who controls requests for reviews, incentives, responses, public displays and activity carried out by agencies or platform partners. A smaller firm may need a simpler process, but it still needs to understand the consumer-facing outcome created in its name.

Treat a changing score as an attribution problem before calling it performance

Ratings look objective because they reduce many experiences to a single number. In practice, they report captured and displayed feedback, not every experience delivered. A score can improve because fulfilment, communication, reliability or complaint handling has improved. It can also improve because invitations are sent at a more favourable point in the journey, a low-performing location is excluded from an aggregate, an incentive changes the response pool, or a platform changes how prominently older reviews are displayed.

This does not make score movements meaningless. It changes the standard of proof required before management turns a movement into a performance claim. If a business introduces staff training and its rating rises, training may have improved the experience. But if it also changes the review request from a routine post-purchase message to a prompt issued after a visibly successful interaction, the evidence cannot isolate the cause without further analysis.

Coverage is especially important. Requesting feedback after a completed service is often sensible: customers have an experience to assess, and the responses can reveal operational problems. The risk arises when invitations are consistently concentrated among customers whose interactions appear to have gone well. The result may be a more positive respondent group without an equivalent improvement in the wider customer experience. Similarly, a group-wide score may provide a useful brand overview while hiding material variation between branches, products or service lines.

Moderation presents a related trade-off. Removing abusive, irrelevant or manipulated material can improve the usefulness of a review environment. Opaque or inconsistent removal can make the public record diverge from typical customer experience. Incentives may increase review volume and reduce volatility in small samples, but they can also affect how consumers judge the independence of the feedback. The CMA’s business guide addresses fake reviews, concealed incentivised reviews and false or misleading review information, and calls on businesses to take reasonable and proportionate action to prevent and remove problematic content ↗.

A sensible counterargument is that no review system can be perfectly representative. That is correct. Businesses cannot compel every customer to respond, and a perfectly controlled sample would often be unrealistic for a small operator. The standard should not be statistical perfection. It should be an honest understanding of material biases and a presentation that does not imply more breadth, independence or recency than the evidence supports.

Use credibility tests that management can actually operate

The academic evidence does not provide a single operational checklist for businesses, but it does support the importance of credibility ↗. Sanctuary recommends translating that principle into three management tests. These are practical governance tests, not a substitute for legal advice or a determination of compliance.

First, test authenticity. Is feedback connected to a genuine customer experience? Where incentives, employee involvement, affiliate relationships or other commercial connections are relevant, are they treated transparently? This test directs attention to provenance rather than merely to the wording of a review.

Second, test coverage. Do invitation and publication practices omit meaningful customer groups, locations, services or stages of the journey? A business may reasonably use more than one review channel, but it should understand whether one channel systematically presents a more favourable slice of its activity than another. A score based mainly on one product line should not be casually used as a claim about the whole business.

Third, test intelligibility. Can a reasonable customer understand what the rating covers, how current it is and whether materially different experiences have been combined? This is particularly important for multi-site firms, franchises and businesses that display third-party ratings in their own marketing. Convenience in aggregation can be useful, but convenience is not the same as clarity.

These tests move discussion beyond the inadequate binary of “real” or “fake”. They also create a more disciplined link between reputation data and management capability. If a score rises while cancellations, refunds, repeat purchasing, complaint-resolution times or complaint themes remain unchanged, managers should investigate the collection and display process before treating the score as evidence of better delivery. If operational data improves but the rating does not, the business may have a discovery, invitation or platform problem rather than a service-quality problem.

For smaller businesses, this is a productivity issue as well as a consumer-protection issue. Credible feedback can identify recurring failures that consume staff time, lead to refunds and undermine repeat custom. Poorly governed feedback can instead reward superficial score optimisation, diverting attention from the operational changes that create local economic value and more durable customer trust.

Build an explainable review estate, then review it monthly

The objective should not be a flawless profile or the suppression of negative feedback. It should be an explainable review estate: a mapped set of channels, rules, owners and records through which a business can account for the public claims it makes. The CMA guidance provides the regulatory starting point through its focus on reasonable and proportionate action in relation to fake, concealed incentivised, and false or misleading review information ↗. The following operating model is Sanctuary’s practical interpretation of that principle.

Start with a short inventory. List every review request, public rating, testimonial, incentive, platform account, QR code, website widget and agency relationship. For each material channel, record an accountable owner, the intended customer group, the invitation timing, the incentive position and what the published score is represented as covering. This does not require specialist reputation-management software. It prevents informal local practices or agency tactics from becoming company practice without senior understanding.

Next, establish usable rules on provenance and escalation. Managers should be able to state who can ask for reviews, when they can ask, what wording or channels are approved, whether any benefit is offered, and how suspected manipulation or removal requests are handled. Where an agency or platform partner executes activity, expectations and reporting should be explicit. Outsourcing execution does not remove the need to understand the impression created for consumers.

Finally, add integrity indicators to an existing monthly management meeting. Average rating and review volume remain useful, but they are incomplete. A proportionate dashboard can include invitation volume, response rate, rating distribution, timing of requests, active incentives, moderation outcomes and recurring complaint themes. Read these alongside operational evidence such as refunds, cancellations, repeat purchase and complaint-resolution time.

This approach avoids two unhelpful extremes. It does not assume that a higher score proves misconduct when operational evidence is flat; it prompts investigation. Nor does it assume that a lower score always proves poorer service; it may reflect broader collection, a changed platform environment, or both. What it does require is that businesses avoid presenting a better-managed score as though it were automatically better service.

A practical 30-day reset is achievable for many SMEs: inventory the review estate in week one; test the consumer-facing scope and disclosures in week two; issue short staff and partner guidance in week three; and introduce a monthly integrity review in week four. The result is not perfect measurement. It is a rating system whose provenance, coverage and limitations can be explained with confidence—giving customers more useful information and managers a stronger basis for service improvement.