Google Analytics Audit Checklist for GA4

Last quarter I ran a google analytics audit for a mid-size SaaS company. They were spending around EUR 9,000 per month on Google Ads and making product decisions from GA4 dashboards. Their marketing lead told me the numbers "felt off" but could not point to where.

Within two hours I had the answer. Their consent banner was blocking GA4 for every visitor who declined cookies -- roughly 30 percent of traffic. Cross-domain tracking between their marketing site and app was broken, double-counting users. And a developer had pushed a dataLayer change three months earlier that silently broke half their custom events. None of this showed up as an error. GA4 kept reporting -- the reports just happened to be wrong.

This is the pattern I see on most engagements. The data is not missing dramatically. It is quietly incomplete, and people make budget decisions on it anyway. Below is the google analytics audit checklist I run through on every engagement -- ten areas, ordered by how often they cause real damage.

Google Analytics Audit: Start With What Hurts Most

Before opening any report, I establish a source of truth. That means comparing GA4 transaction or lead counts against a system that does not depend on browser JavaScript: your CRM, Shopify admin, Stripe dashboard, or backend database. In my experience, if the gap between GA4 and your source of truth is under 5 percent, your setup is probably solid. If it is 15 percent or more, something is broken and worth finding.

The checklist below is what I walk through when I audit a client's tracking setup. You can run most of it yourself.

The Google Analytics Audit Checklist: Ten Areas to Check

1. Tag firing and placement

Open Tag Assistant and load five to ten key pages: homepage, product page, pricing, checkout confirmation, a blog post.

Check for:

• GA4 config tag fires exactly once per page, on every page.
• No duplicate Measurement IDs. I have seen sites where a developer hardcoded gtag.js alongside GTM, resulting in every pageview counted twice.
• The tag fires after the consent decision, not before it (unless you run Consent Mode Advanced, which loads tags in a restricted state before consent).

2. Consent Mode configuration

This is the single most common source of data loss I find in European accounts. The cookie banner is live, but Consent Mode was never connected to it.

When consent mode is missing or misconfigured:

• Every visitor who declines cookies produces zero data -- no pings, no behavioral modeling, no conversion modeling.
• Google's behavioral modeling for GA4 requires Advanced mode and a minimum of 1,000 daily events with analytics_storage='denied' for at least 7 days before it activates.
• Without those modeled sessions, your traffic and conversion numbers only reflect the fraction of users who accepted cookies.

Quick test: deny cookies on your site, then check the Network tab for requests to analytics.google.com. If gcs=G100 appears in the payload, consent was granted. If you see no requests at all after denying, you are in Basic mode or consent mode is not implemented. For a deeper walkthrough, see my Consent Mode v2 implementation guide.

3. Cross-domain tracking and self-referrals

If your business uses more than one domain -- a marketing site, a separate checkout, an app subdomain -- check whether cross-domain tracking is configured in your GA4 data stream settings under Configure tag settings > Configure your domains.

Signs it is broken:

• Your own domain appears as a referral source in the Traffic Acquisition report.
• Session counts are inflated because each domain hop starts a new session.
• Conversion paths show your payment processor (Stripe, PayPal) as the referring source, stealing attribution from the actual campaign.

Also check the unwanted referrals list for payment gateways and third-party authentication providers. If Stripe or your OAuth provider shows up as a top referral source, add it there.

4. Event tracking and naming conventions

GA4 is event-based, which means everything that matters to your business should be an event. But "event-based" does not mean "event chaos."

Pull up your event list under Admin > Events. Look for:

• Duplicate events with inconsistent naming (e.g., generate_lead, GenerateLead, form_submit all tracking the same action).
• Events firing without required parameters. A purchase event without transaction_id or value is useless for revenue reporting.
• Recommended events that Google expects for your business type but that are missing or misconfigured.
• Custom events exceeding the 500 unique event names per property limit.

Lowercase, snake_case, verb-first. Stick to it and you save hours of cleanup later.

5. Key event (conversion) configuration

GA4 renamed "conversions" to "key events" in 2024 but the concept is the same: events that matter to your business and feed Google Ads bidding.

Verify:

• The right events are marked as key events. I regularly find properties where page_view is marked as a conversion or where the actual purchase event was never toggled on.
• Counting method is set correctly. For lead gen, "once per session" is usually right. For purchases, "once per event."
• Event parameters include value and currency so revenue data flows into reports and into Google Ads if you use value-based bidding.

6. Filters and data streams

Under Admin > Data Streams, check:

• Internal traffic filters. If your dev team or agency is not filtered out, their testing inflates pageviews and skews engagement metrics. Define internal traffic by IP under tag settings, then activate the filter under Admin > Data Settings > Data Filters. Filters default to "Testing" state -- switch them to "Active" or they do nothing.
• Only one web data stream per property. GA4 is not designed for multiple web streams for the same site. Having two creates duplicate data that is nearly impossible to untangle.

7. Attribution settings

GA4 defaults to data-driven attribution with a 90-day lookback window for acquisition events and a 30-day window for other key events. That is reasonable for most businesses, but worth verifying:

• If you changed to last-click attribution during a migration and forgot to switch back, your multi-touch channels (display, social, content marketing) will be systematically undervalued.
• If your sales cycle exceeds 90 days -- common in B2B -- you may need to extend the lookback window. For more on why standard attribution fails in long-cycle B2B, see my B2B conversion tracking guide.

Check these under Admin > Attribution Settings.

8. Data quality signals: thresholding, sampling, and cardinality

Three mechanisms quietly hide data in GA4 reports:

Issue	What happens	How to spot it
Thresholding	GA4 withholds rows to prevent identifying individual users, especially when demographic or audience data is included	Yellow icon in reports; rows disappear when you add a secondary dimension
Sampling	Free GA4 properties sample Explorations that query more than 10 million events	Green shield icon turns yellow; "Based on X% of data" label appears
Cardinality	When a dimension has too many unique values, GA4 groups the long tail into "(other)"	"(other)" row appears with a disproportionate share of traffic

If thresholding is hiding data, switch your reporting identity from "Blended" to "Observed" under Admin > Reporting Identity. This disables Google signals and usually removes the threshold -- but you lose cross-device modeling. For sampling, shorten the date range or use standard reports instead of Explorations.

9. Server-side tracking and ad-blocker resilience

Even a perfectly configured client-side setup loses data to ad blockers. Research suggests roughly 30 percent of desktop users run some form of ad-blocking tool, and many block Google Analytics requests alongside ads.

Server-side tracking via a server-side Google Tag Manager container on your own subdomain routes GA4 requests through your infrastructure. This makes requests indistinguishable from first-party traffic, so ad blockers and Safari's ITP cookie restrictions do not suppress them.

If you are running paid media at scale, server-side tracking is no longer optional. In my experience, capture rates go from roughly 60 percent to above 90 once an audit identifies the gaps and server-side tagging closes them.

10. Documentation and change management

This is the least technical check and the one most companies skip. I ask three:

• Is there a measurement plan that maps business goals to GA4 events and parameters?
• Is there a change log showing when tags or dataLayer structures were modified?
• Does your deployment process include a tracking QA step before code goes live?

If the answer to all three is no -- and it usually is -- any audit fix you apply today will quietly break the next time someone pushes a site update. A google analytics audit is only as durable as the process around it.

What a Google Analytics Audit Template Looks Like in Practice

I deliver every google analytics 4 audit as a spreadsheet with three columns: the check, its status (pass, fail, or warning), and the fix. Here is a simplified version:

Area	Status	Notes
Tag fires on all pages	Pass / Fail	List pages where tag is missing
Consent Mode connected	Pass / Fail	Specify Basic vs Advanced, note modeling eligibility
Cross-domain tracking	Pass / Fail / N/A	List domains, note self-referrals found
Event naming consistency	Pass / Warning	List duplicates or non-standard names
Key events configured	Pass / Fail	List events that should be marked
Internal traffic filtered	Pass / Fail	Note if filter is in Testing vs Active
Attribution model correct	Pass / Warning	Note current model and lookback window
Data quality issues	Pass / Warning	Note thresholding, sampling, or cardinality problems
Server-side tracking	In place / Not in place	Note estimated data loss without it
Documentation exists	Yes / No	Measurement plan, change log, QA process

If you want this run against your property with specific recommendations, that is what I deliver in a tracking audit engagement.

After the Audit: Prioritize by Revenue Impact

Not every finding needs to be fixed immediately. I rank issues by how much they distort the data you use to allocate budget:

1. Consent Mode gaps -- if 25-30 percent of your traffic is invisible (as I typically see in European properties), every downstream metric is wrong.
2. Broken event tracking -- if your key conversion events are not firing or are double-firing, your bidding signals are corrupted.
3. Self-referrals and session inflation -- these distort engagement metrics and multi-touch attribution.
4. Missing server-side tracking -- a slow bleed that matters most for businesses spending on paid media where conversion accuracy directly affects bidding.

Fix in that order and you will recover the most signal in the least time.

FAQ

Not sure your GA4 data is trustworthy? Book a tracking audit -- I will tell you exactly what is broken and how to fix it.