What a Marketing Tracking Audit Should Include: A Checklist

Most companies only question their tracking when two numbers refuse to agree. For example, imagine a month in which Google Ads reports 40 conversions, GA4 shows 25 and the sales team counts 9 real inquiries (illustrative figures, not client data). The monthly meeting turns into an argument about which screen is lying. Usually none of them is. They are counting different things, and somewhere in the setup at least one of them is also counting the wrong thing.

A tracking audit separates those two problems. It checks who owns and controls the measurement accounts, whether the data being collected is clean, whether conversions mean what the business thinks they mean, and whether the reports built on top can be trusted. This checklist is grouped by area so you can hand each section to the person who owns it. It deliberately stays inside measurement: for a review of positioning, channels and spend use the broader marketing audit checklist, and treat crawling and indexing issues as a separate technical SEO audit.

1. Access and ownership: who actually controls the data

Start here, because every later fix depends on someone having the right access to make it. Many audits stall on day one when it turns out the GA4 property was created under a former employee’s personal Gmail or a previous agency’s account.

• GA4: list every user and role on the account and property. Google Analytics separates Administrator, Editor, Marketer, Analyst and Viewer roles, and only Administrators can add or remove users. As good practice, the company should hold Administrator access through a company-controlled Google account, and outside partners should get the lowest role their work needs.
• Google Tag Manager: check account and container permissions. Tag Manager distinguishes No access, Read, Edit, Approve and Publish at container level, and Google recommends keeping at least two active administrators so one person leaving cannot lock the company out.
• Search Console: confirm there is a verified owner inside the company. Search Console distinguishes verified owners, delegated owners, full users and restricted users. When someone leaves, Google advises removing their verification token as well as their user entry, because a deleted owner can re-verify while the token remains.
• Google Ads: we recommend the ad account sits in the company’s name, with billing and admin access held by the company. Linking it to GA4 needs Editor or Administrator access in GA4 and administrative access in Google Ads, so the audit should confirm both exist on the company side.
• Record it: a practical habit is a one-page access register listing each account, its ID, the owning account and every user with their role. This is often the most useful page in the whole audit.

2. GA4 property and data stream settings

These settings are quick to check and easy to get wrong, and several of them cannot be corrected backwards once data has been collected.

• Data retention. For standard GA4 properties, user-level data and other event data can each be retained for 2 months or 14 months (Analytics 360 offers longer options for event data). Google states the setting only affects explorations and funnel reports, not standard aggregated reports. If anyone on the team builds explorations to compare this year with last year, a 2-month setting will defeat them. Check it and decide deliberately.
• Internal traffic. Staff, developers and agencies visiting the site inflate engagement and can trigger test form submissions. GA4 lets you define internal traffic rules by IP address on the web data stream and then exclude it with a data filter. Filters have Testing, Active and Inactive states; Google warns that once a filter is applied the effect is permanent and excluded data is never processed. Run the filter in Testing first, check it in Explore, then activate.
• Unwanted referrals. If visitors leave your site to pay or log in on another domain and return, that domain can appear as the traffic source. The unwanted referrals list stops chosen domains being credited as referrers. Treat it as a forward-looking fix: Google’s help page describes how new events are flagged and does not say past sessions are reclassified.
• Cross-domain measurement, only if needed. This is for journeys that genuinely cross separate domains, such as a corporate site that sends users to a booking or shop domain. Without it, Google notes that new cookies are created on each domain, so one person visiting two root domains is counted as two users and two sessions; with it, the identifiers are passed between domains in a _gl URL parameter when the visitor follows a link or submits a form. If every journey stays on one domain, there is nothing to configure. If you do need it, Google requires the tag on every page to use the same tag ID from the same web data stream, and warns that redirects or pages that do not accept extra query parameters can strip _gl, so test the journey after setup.
• Enhanced measurement. Check which automatic events are switched on. Enhanced measurement can collect scrolls, outbound clicks, site search, video engagement, file downloads and form interactions. Know which are on, because an automatic form_submit and a custom form event built in Tag Manager may both describe the same action.
• Personal data. The same help page states that site owners are required to ensure no personally identifiable information is collected. Check page URLs and event parameters for email addresses or phone numbers passed from forms.

3. Events and key events: names, duplicates and what counts

This is where most of the disagreement between screens begins. The audit should produce a simple event inventory: event name, what triggers it, where it is created (enhanced measurement, Tag Manager, or the site code), and whether it is marked as a key event.

• Names. GA4 event names are case sensitive, so generate_lead and Generate_Lead are two different events. Names must start with a letter, use only letters, numbers and underscores, and avoid reserved names such as page_view or session_start. Flag any near-duplicates and, as good practice, agree one naming convention.
• Duplicates. Look for the same action fired twice: a thank-you page view and a form event both marked as key events, a tag firing on every page load of a multi-step form, or a hard-coded snippet still running next to a Tag Manager tag.
• What counts. Google defines a key event as one that measures an action particularly important to the success of your business. A completed quotation form usually qualifies; a scroll or a file download usually does not. A WhatsApp or phone click is worth tracking, but it is an intent signal: it shows someone tapped the button, not that a conversation happened or a lead was qualified. Label it accordingly in reports.
• Test every key event. Submit each form, tap each contact button and confirm exactly one event arrives with the expected parameters.

For how to set up forms, calls and WhatsApp clicks properly, see tracking leads in GA4 as key events; the audit’s job is to check that what exists matches that standard.

4. Google Tag Manager container hygiene

A container that has passed through several agencies tends to collect paused tags, tags nobody can explain, and triggers firing on “All Pages” because that was quickest. The audit checks:

• One container, installed once. Confirm the container snippet appears on every page template, once, and that there is no second container or leftover hard-coded tag duplicating the same measurement.
• Every tag has a purpose and an owner. A useful test is whether each tag can be explained in one line. Tags for platforms the company no longer uses are usually better removed than left paused indefinitely.
• Trigger precision. Conversion tags are more reliable when they fire on the confirmed action (a successful submission or thank-you state), not on a button click that also fires when validation fails.
• Naming. This is a convention rather than a Google rule, but a consistent pattern for tags, triggers and variables, such as platform, type and action, makes the container readable to the next person.
• Versions and publishing. Tag Manager keeps a publish history showing when each version was live and who published it, and lets you set an older version as the latest to revert. Check that versions have meaningful names and descriptions, and consider limiting Publish rights to a small group.
• Testing discipline. Check changes in preview and debug mode, which shows which tags fired and what data they passed, before anything is published.

5. Google Ads linking and conversion actions

Campaign bidding learns from whatever you tell it is a conversion, so errors here cost money directly, not just reporting accuracy.

• Link and auto-tagging. Confirm GA4 and Google Ads are linked and auto-tagging is on. Google lists auto-tagging, which adds the GCLID click identifier to the URLs people click, as required to import key event data from Google Analytics into Google Ads and to bring Google Ads campaign and cost data into Analytics, and says that if the site uses redirects the GCLID must be passed to the final landing page.
• Primary versus secondary. Primary conversion actions appear in the Conversions column and are used for bidding (as long as their goal is used for bidding); secondary actions appear in All conversions for observation. Our recommendation: list every conversion action and keep as primary only the actions the business genuinely wants more of.
• Overlapping actions. Google states that conversion actions created from Analytics key events are set as secondary to prevent counting the same event twice for bidding. If the same lead is also tracked by a Google Ads conversion tag, check which of the two is primary and whether anyone has changed that setting, and record the reason for the choice.
• Count setting. Google recommends counting one conversion per ad click for leads and every conversion for sales. A lead action set to Every will inflate results when someone submits a form twice. Changes apply only to future reporting.
• Expected differences. Google Ads and GA4 will not show identical conversion numbers. Google notes that view-through conversions do not appear for conversions imported from Analytics, and attribution settings differ. The audit should document which differences are design and which are errors.

6. Campaign tagging, consent and Search Console

UTM rules

Untagged or inconsistently tagged links are why “Direct” and “(not set)” grow in reports. GA4 supports parameters including utm_source, utm_medium, utm_campaign, utm_term, utm_content and utm_id, and Google advises always using source, medium and campaign. Values are case sensitive, so “LinkedIn” and “linkedin” become two sources; Google recommends lowercase as standard. The audit should check a sample of live links from social posts, email signatures, newsletters and QR codes against a written naming sheet.

Consent setup

If the site uses a consent banner, check that it actually controls the tags. Google’s consent mode includes the consent types ad_storage, analytics_storage, ad_user_data and ad_personalization, alongside storage types for functionality, personalisation and security. In the basic implementation, Google tags do not load until the visitor interacts with the banner, and nothing is sent if they decline. In the advanced implementation, tags load straight away with consent denied by default (unless you set other defaults), send cookieless measurements while consent is denied, and send full measurement once consent is granted. Test both “accept” and “reject” paths and confirm tags behave as configured. Consent choices change what can be measured, so observed numbers will usually be lower on sites where many visitors decline. The regional side is covered in cookie consent and Consent Mode for GCC websites; this is not legal advice.

Search Console

• Verification. Confirm the property is verified and by which method. A Domain property can only be verified through DNS, and removing a verification file, tag or DNS record causes verification to be lost. Google suggests adding more than one verification method as a backup, for example in case a template change removes a tag.
• Sitemaps. Check that the current sitemap is submitted and that the Sitemaps report shows a successful status and a recent last-read date. Success means Google loaded and processed the file and queued its URLs; Google states there is no guarantee those URLs will be crawled or indexed.

7. Reporting checks, and what the audit report should contain

Finally, test the reports people actually use. Pick one recent month and trace a few numbers end to end: the key events in GA4, the conversions in Google Ads, and the inquiries logged by sales. Note where they differ and why. Check that dashboards exclude internal traffic, use the right date ranges, and label WhatsApp and call clicks as clicks rather than leads. If leadership relies on a summary view, compare it against the guidance in how to measure marketing effectiveness so nobody reads modelled or platform-attributed numbers as exact.

In our view, the deliverable should be an action list, not a screenshot collection, with the same fields for every finding:

RX has implemented analytics and tracking setups for multiple client websites, and offers a tracking audit that follows this structure, with every account staying in the client’s name. Whether you use an outside team or your own, the test of a good audit is simple: after the fixes, each number in the monthly report should come with a clear sentence explaining what it counts.