Google Analytics Audit: A Step-by-Step Framework

What a Google Analytics audit is

A Google Analytics audit is a structured check of one GA4 property: does it collect the right data, does it collect it correctly, and can you trust the reports it produces? It is not a redesign of your reports. It is a health check, and its output is a list of fixes in priority order.

Audit when the numbers stop making sense, after a site change, or once a year as routine maintenance. The framework below works for a small site and scales to a large one; skip the steps that do not apply to your setup, and note that you skipped them.

Step 1: Confirm the tag fires on every page

Open your site and check that the GA4 tag loads on the homepage, a blog post, a product page, the checkout or contact page, and any page built on a different template. Use Google's Tag Assistant or the real-time report in GA4: visit a page and watch for your own visit. A tag missing from one template is the most common audit finding, and it makes a whole section of the site invisible in every report.

Also check for duplicate tags. Two GA4 tags on the same page double-count pageviews. If your site uses Google Tag Manager, confirm the tag fires once per page load, and that no hard-coded tag sits beside the Tag Manager one.

Step 2: Check the property settings

In GA4 admin, confirm the property name, time zone and currency match the business. A wrong time zone shifts daily totals and makes day-to-day comparisons misleading. Set data retention to 14 months (the maximum) under Data Settings, because the default is 2 months and you cannot recover expired history. Turn on Google signals only if your privacy policy covers it, and note the choice in your audit record.

Step 3: Verify conversions against a second source

List every event marked as a conversion — form submissions, purchases, phone clicks, downloads — and check each one against the system that actually records the outcome: your CRM, your order system, your inbox. Pick the same 30-day range in both systems and compare totals. A gap under 10% is normal, caused by consent refusals and ad blockers. A gap over 20% means something is broken: a form that submits without firing the event, a thank-you page that is not tracked, or a conversion defined on the wrong trigger.

Fix the event first, then re-check. Never adjust the report to match the CRM; fix the tracking so both agree.

Step 4: Check traffic sources and campaign tagging

Open the traffic acquisition report and look for surprises. A large "unassigned" or "(not set)" slice means campaigns are untagged or the tag is missing on landing pages. Check that paid campaigns carry UTM parameters, that email links are tagged, and that social traffic is not arriving as direct because the links were shortened without parameters.

Also check the Search Console link. If GA4 and Search Console are linked, query data appears beside behaviour data; if the link is broken, that view disappears. The difference between the two tools is explained in Google Search Console vs Google Analytics.

Step 5: Filter internal traffic and spam

Internal traffic inflates your numbers and distorts conversion rates. In GA4 admin, define your office IP addresses as internal traffic and exclude them in the reporting identity settings. Then check the referral report for spam: domains you do not recognise, with high bounce and zero engagement, are usually referral spam. GA4 filters much of it automatically, but a new spam source can appear at any time, so check the referral list every audit.

Step 6: Check cross-domain and subdomain tracking

If a visitor moves from your main site to a checkout domain, a booking system or a subdomain, GA4 must treat that as one session. Check the cross-domain settings in the data stream and confirm the domains are listed. Test it yourself: click from the main site to the second domain and confirm the session continues in the real-time report instead of starting a new one. A broken cross-domain setup splits one visitor into two, inflates sessions and breaks the conversion path.

Step 7: Check ecommerce and events

For a store, open the ecommerce reports and confirm purchases, revenue and product views match your order system for the same period. Check that the purchase event carries the transaction ID, value and currency, and that refunds are recorded if your setup supports them. For a lead-generation site, confirm each form on the site fires its event, including forms in pop-ups and embedded widgets, which are the ones most often missed.

Step 8: Check consent handling

If your site shows a consent banner, confirm that GA4 respects the visitor's choice: no tracking before consent where the law requires it, and full tracking after consent is given. Check the consent settings in Tag Manager or your consent platform, and confirm the banner itself is not blocking the tag on pages where it should load. Consent errors usually show up as a sudden drop in traffic on the day the banner changed — check the timeline for that pattern.

Step 9: Check users, access and integrations

List who has access to the property and remove anyone who no longer works with you. Confirm the links to Google Ads, Search Console and BigQuery still work, and that the Ads link imports conversions you actually use. Check that no integration is sending data to a property nobody owns. Access hygiene is part of the audit because an old account with edit access can change tracking without anyone noticing.

Step 10: Write the findings and fix in order

Write every finding as one line: what is wrong, where, and what it affects. Then fix in this order: tag coverage, conversions, traffic sources, spam, then everything else. Tag and conversion fixes change the numbers, so fix them first and let a week of clean data accumulate before judging any trend. Record the date of each fix in the same document, so the next audit starts from a known state.

Worked example: a 40% traffic drop that was not a traffic drop

A small ecommerce site showed a 40% fall in sessions in GA4 over one month, while orders stayed flat. The audit found the cause in step 1: a redesign had moved the GA4 tag into a template that loaded only on product pages, so the homepage, blog and category pages stopped reporting. Orders were unaffected because the checkout pages kept the tag. The fix was one line in the template, and sessions recovered the next day — not because traffic returned, but because it had never left. The lesson: when a metric moves sharply and the business does not, suspect the tracking before you suspect the market.

Common mistakes in a Google Analytics audit

• Auditing reports before auditing the tag. A beautiful dashboard built on broken tracking is worse than no dashboard, because it looks trustworthy.
• Comparing GA4 with Universal Analytics totals. GA4 counts differently — sessions, users and conversions are all defined differently — so the old numbers will never match. Compare GA4 with itself over time.
• Fixing everything at once. Change one thing, note the date, and wait. If you change five things on the same day, you will never know which one fixed the problem.
• Forgetting data retention. The default 2-month retention means an audit a year later cannot see last year's data. Set 14 months at the first audit and never think about it again.
• Skipping the second source. A conversion rate is only as good as the conversion count. Check it against the CRM or order system every time.

Audit checklist

• [ ] Tag fires once on every page template
• [ ] Time zone, currency and retention (14 months) correct
• [ ] Every conversion verified against a second source
• [ ] Campaigns tagged; unassigned traffic explained
• [ ] Internal traffic excluded; referral spam checked
• [ ] Cross-domain and subdomain tracking tested
• [ ] Ecommerce or form events verified end to end
• [ ] Consent banner behaviour confirmed
• [ ] Access list cleaned; integrations linked
• [ ] Findings written up with dates, fixes prioritised

Glossary

• Event: any action GA4 records, such as a pageview, a click or a purchase. Everything in GA4 is an event.
• Conversion: an event you have marked as important, such as a form submission or a purchase.
• Session: a group of interactions by one visitor in a period of activity. GA4 starts a new session after 30 minutes of inactivity.
• Data retention: how long GA4 keeps event-level data before deleting it. The maximum is 14 months.
• Cross-domain tracking: treating visits across two domains, such as a site and its checkout, as one session.

If the audit shows your tracking needs rebuilding rather than patching, or you want the findings turned into a reporting setup you can use weekly, Adziq's analytics service covers GA4 setup and audits, and the how to monitor website traffic guide explains what to watch once the data is trustworthy.

Common questions

Sources

• Introducing the next generation of Google Analytics (Analytics Help)
• About Search Console (Google Search Console Help)

Adziq sells marketing services and does not accept payment for placement in its articles. See our editorial policy.