How to audit GA4 in a day (and why reading the interface is not auditing)

The most common way a GA4 audit goes wrong is that it is performed entirely inside GA4. Someone reviews the conversion list, checks the data streams, notes that everything is configured, and reports that measurement is fine.

Measurement problems do not throw errors. They report a number that is wrong by 30% and look completely normal doing it. The only way to find them is to perform real actions and follow them through every system they touch.

Step 1 — Inventory everything that collects (60–90 minutes)

Write down, in one document:

• Every GA4 property and data stream, and which sites feed which.
• Every tag, trigger and variable in every GTM container. All of them.
• Every ads platform with a conversion import.
• Every CRM field that is supposed to hold source, medium, campaign or landing page.

Two things fall out of this immediately in most accounts. First, tags nobody currently owns — often referencing properties that no longer exist. Second, more than one container or property doing overlapping work, usually a residue of a migration.

Step 2 — Classify every conversion (60 minutes)

For each conversion, answer two questions:

What real-world action does this represent? and could it fire when that action did not happen?

The classic failure is a conversion defined on a thank-you page view. It counts a page load, not a submission. It fires when someone refreshes, when someone shares the URL, when a bot crawls it, and when a routing change makes the page reachable without submitting. It also stops firing if the confirmation moves to an inline state — which happens in redesigns without anyone connecting the two events.

Classify each one as: correct, wrong, duplicate, or legacy.

If you find both a page-view conversion and an event-based conversion for the same action, you have found a double count. In our experience this is the single most common cause of a large GA4-versus-CRM gap.

Step 3 — Perform real actions (2–3 hours)

This is the step that cannot be skipped and cannot be replaced by reading configuration.

Do the actual thing: submit the real form, complete a real purchase or signup, click the phone link, book the appointment, start the download. For each one, trace it through:

Website → GTM → GA4 → ads platforms → CRM

At each boundary, confirm the record exists, exactly once, with the right values. Where it disappears or duplicates is your finding.

Do each of these twice — once with consent granted and once with consent denied. A consent implementation that drops tags rather than using consent mode's modelling will show up here and nowhere else. It is also a common reason reported traffic fell on a date that had nothing to do with marketing.

Four tests find most problems:

1. A form submission end to end.
2. A purchase or signup end to end.
3. The same submission with consent denied.
4. A journey that crosses a domain or subdomain boundary.

Step 4 — Check the boring configuration (60 minutes)

Now the things that quietly break attribution rather than counts:

• Cross-domain: is the linker configured for every domain and subdomain in a single journey? A missing linker turns one journey into two sessions and inflates both "direct" and self-referrals.
• UTM taxonomy: is there one, and is it enforced? Look at the share of sessions with (not set) or unassigned channels. Anything above a few percent is a governance problem.
• Internal traffic and bot filtering: are your own offices and your staging environment excluded?
• Data retention: set to the maximum available, unless there is a policy reason not to. The default costs you the ability to do year-over-year analysis later.

Step 5 — Reconcile against the CRM (60–90 minutes)

Take one month. Compare, in this order:

1. Server-side submission count (closest thing to ground truth).
2. GA4 conversions.
3. GA4 conversions after removing duplicates.
4. CRM records created.
5. CRM records with a resolvable source.

Then decompose the gap. Each step in that list is a system boundary where records get lost or duplicated, and each contributor is separately measurable.

The output of a good audit is not "GA4 is wrong by 38%". It is: 22 points from a duplicate conversion, 6 points from consent handling, 9 points from split sessions, a third of CRM records missing source because of an integration mapping, and 4 points unexplained.

Report the unexplained remainder. Some gap is always expected — blockers, offline paths, different definitions. Saying which part you cannot explain is what makes the rest credible.

Step 6 — Write the measurement plan before fixing anything

Define, in business terms and in writing:

• what counts as a lead
• what counts as a qualified lead
• what counts as a customer
• what each is worth

Without these, you are optimising a configuration rather than a business. With them, a surprising number of "should we track this?" questions answer themselves.

Then fix one thing at a time

Ship measurement fixes in separate releases with a gap between them. If you ship six changes at once, the reported numbers step and nobody can attribute which change did what — which is how the original problem was created.

What you cannot fix

Be honest about this in the report:

• Historical data cannot be recreated. You can repair collection going forward and document the break so comparisons across it are handled honestly.
• Consent regulation sets a hard floor. Work within it; there is no legitimate way around it.
• Perfect attribution does not exist. Aim for numbers reliable enough for the decisions you actually make, not for a complete picture.

A measurement setup that is honest about its limits is more useful than one that claims not to have any.