Google Analytics Audit: A Scored GA4 Checklist for Agencies

A prospect sends you view access to their GA4 property "so you can take a look." Or you inherit a client whose last agency left in a hurry. Or it's simply been a year since anyone checked whether the numbers in the monthly report are still right.

In each case the job is the same: a GA4 audit. Done well, it's the most useful free thing an agency can hand a client. It shows them something real about their business before you ask for anything, and it makes every report you send afterward more believable.

This post is the standalone, scored version of that audit. If you're setting up a brand-new client, start with our GA4 client onboarding checklist. Its Phase 2 covers the baseline settings. This checklist goes further: it's built for prospects, inherited accounts, and quarterly health checks, and it ends with how to present what you find.

What a GA4 Audit Is (and When to Run One)

A Google Analytics audit is a structured review of a GA4 property that answers one question: can we trust these numbers enough to make decisions with them?

It is not a redesign of their tracking, and it's not a list of everything you'd do differently. It's a check of whether the data is complete, clean, and pointed at the things the business cares about.

Four moments call for one:

When	Why it matters
Before a pitch	A short, honest audit is a better opener than a deck. It shows you looked at their business, not just yours.
Inherited account	You're about to put your name on these numbers. Find the problems before your first report, not after.
Before a redesign or migration	Site changes break tracking more than anything else. Audit before, and again two weeks after launch.
Every quarter	Tags drift. Staff change. Someone adds a payment provider. A quarterly check catches it while it's still small.

How to Score What You Find

An audit that lists 40 issues with equal weight is hard for anyone to act on. Score each finding instead, by how much it distorts the numbers the client actually looks at.

Severity	What it means	Example
High	The headline numbers are wrong or missing	Key events (formerly "conversions") never fire, or fire twice per form fill
Medium	The numbers are right overall but misattributed or noisy	Checkout traffic shows up as a referral from the payment provider
Low	Housekeeping that will matter later	A former freelancer still has Editor access

Then apply one rule: fix the top three first. Most properties have a handful of high-severity issues and a long tail of small ones. Clearing the top three usually changes the story in the report more than everything else combined.

The GA4 Audit Checklist

1. Baseline settings (quick pass)

These are covered step by step in Phase 2 of the onboarding checklist, so here they're one line each. Confirm them, score anything that's off, and move on.

Check	What "good" looks like
Data retention	Set to 14 months (the longest option on a standard property; it's 2 months unless someone changed it). See Google's data retention help page
Key events	The few actions that matter are marked, and nothing trivial is
Internal traffic	Agency and client office traffic is defined and filtered
Channel groups	Little or no traffic sitting in Unassigned
Tag coverage	The Google tag fires on every page, including checkout and landing pages

For key-event setup itself, see GA4 conversion tracking for agencies.

2. Data quality

This is where most high-severity findings live.

Duplicate tags. Look for the GA4 tag installed twice: once hard-coded and once through Google Tag Manager, or by a plugin and a theme. Signs include page views that look roughly double, or events firing twice in DebugView.
Cross-domain measurement. If the client's journey crosses domains (a booking engine, a separate store), check that cross-domain measurement is configured. Without it, Google notes that one person visiting two domains is counted as two users and two sessions.
Unwanted referrals. Payment processors and login providers often show up as referral sources and take credit for sales they didn't drive. GA4 lets you list unwanted referrals so those domains stop being credited.
Self-referrals. If the client's own domain appears in the referral list, something is breaking sessions: usually a missing cross-domain setup or a subdomain that isn't tagged consistently.

3. Traffic hygiene

Spam and bot spikes. Scan the last 12 months for sudden spikes with near-zero engagement. Our guide to referral spam and bot traffic in GA4 covers how to spot and handle them.
Unassigned and "(not set)". A small amount is normal. A large share usually points to campaign tags that don't match GA4's channel rules. See UTM tracking for cleaner client reports.
Direct traffic share. An unusually high Direct share often means untagged email or app links, not people typing the URL.

4. Privacy basics

Personal data in URLs or event parameters. Google's policies prohibit sending personally identifiable information, such as email addresses, to Analytics. Page URLs and form query strings are the usual leak. Google's PII best practices explain what to look for and mention data redaction for web streams.
Consent mode. If the site uses a cookie banner, check whether consent mode is set up and passing the visitor's choice to Google tags. Flag it for the client and their developer. Whether they need it depends on where they operate, and that's their call (and possibly their lawyer's), not yours.

5. Linked products

Search Console. Linking it lets you show organic search queries next to on-site behavior. Google's steps: connect Search Console to Analytics.
Google Ads. If they run ads, confirm the account is linked, so ad clicks and costs appear alongside GA4 data.
BigQuery. Note whether an export exists. Most small clients won't need one, but it's worth knowing if they do.

6. Access hygiene

Check who has access at the account and property level. Former employees, old agencies, and one-off contractors often still have Admin rights years later. Score this low unless someone unexpected holds Admin, and then score it high. For a clean permissions setup, see GA4 team access management.

7. Reporting readiness

The last check isn't in GA4 at all: does the client's current report answer the questions they actually ask? If the owner wants to know "are we getting more leads from Google," and the report leads with sessions by browser, that's a finding too, even though nothing is technically broken.

Free Google Tools That Help

You can run this whole audit with free tools from Google:

DebugView in GA4, to watch events arrive as you click through the site.
Tag Assistant, to see which Google tags fire on a page and in what order.
Google Tag Manager Preview mode, if the site uses GTM, to check triggers before and after you change anything.
The Realtime report, for a quick check that data is arriving at all. Google notes that most standard reports can take 24 to 48 hours to process, so don't panic if yesterday's test isn't in them yet.

How to Present the Audit to a Client

The way you deliver the audit matters as much as what's in it.

Lead with what's working. Start with two or three things that are set up well. It's true more often than you'd think, and it tells the client you're being fair.

Don't make it about the last agency. "Your old agency broke this" might feel good to say, but it puts the client on the defensive. They hired that agency. Frame each issue as "here's what we found, and here's what we'll fix."

One page, then an appendix. The summary page has three things: what's working, the top three fixes with their severity, and what will change in the numbers once they're fixed. Everything else goes in the appendix for whoever wants detail.

Say what will change in the report. If fixing duplicate tags will roughly halve their page views, tell them before it happens. A sudden drop that you warned them about builds trust. A sudden drop you didn't mention looks like failure. Our guide on how to explain analytics to clients has more on framing these conversations.

Audit Template

Copy this into a sheet and fill one row per finding:

Area	Finding	Severity (H/M/L)	Effect on the numbers	Fix	Owner	Done
Data quality	GA4 tag installed twice	H	Page views roughly double	Remove the hard-coded tag	Developer	☐
Data quality	Payment provider showing as referral	M	Sales credited to Referral	Add to unwanted referrals	Agency	☐
Access	Former contractor still has Editor access	L	None today	Remove the user	Client	☐

The example rows show the format. Your findings will differ.

Frequently Asked Questions

How long does a GA4 audit take? It depends on the size of the site and whether you have tag-level access. A small business site with one data stream is a much shorter job than an ecommerce site with several domains. Time your first few audits and you'll quickly know what to quote.

How often should we re-audit a client's GA4? Quarterly is a good default, plus once before and once after any site redesign or migration. The quarterly version can be a quick pass over the high-severity items.

Should we charge for GA4 audits? Both approaches work. Many agencies offer a short version free as a pitch tool and charge for the full audit with fixes. If you do it free, keep it to the one-page summary.

What's the most common GA4 problem? It varies, but key events that are missing, duplicated, or marked on the wrong actions come up often, and they're usually the costliest because they distort the numbers clients care about most. That's why they score high.

Is a GA4 audit the same as onboarding? No. Onboarding sets a property up for a new client. An audit checks an existing property, whether that's a prospect's, an inherited one, or your own client's at the quarter mark. The onboarding checklist is the setup half. This is the check-up half.

An audit makes the data trustworthy. The monthly report is where the client sees it. Once a property is clean, Helpful Analytics gives your agency a simple, client-ready view of each GA4 property, with a 14-day free trial.

Related Articles