What Does a GA4 Audit Include?

Most GA4 problems are invisible. Dashboards still populate, reports still generate charts, and teams carry on making decisions — while the underlying data quietly misses form submissions, counts purchases twice, or credits the wrong channels. An audit surfaces these issues before they compound.

A thorough GA4 audit works through five distinct layers, each building on the last. Skipping to data validation without checking implementation first means treating symptoms rather than causes.

The Four Audit Layers

Each layer addresses a different failure mode. They are designed to be worked through in order.

The implementation layer forms the foundation. If tracking is broken here, no amount of configuration adjustment can correct the underlying data. This layer checks:

GA4 can be installed via direct gtag.js, Google Tag Manager, a CMS plugin, or a third-party tool. Each carries different risks. The first audit task is identifying which method is active and whether multiple methods are running simultaneously — the most common cause of duplicate tracking.

Opening GTM Preview Mode and navigating through key pages reveals whether tags fire in a logical sequence, whether the GA4 Config Tag fires before event tags, and whether the Measurement ID is correct for the environment.

Duplicate tracking inflates pageviews, sessions, and events — making all downstream analysis unreliable. The most common causes are Enhanced Measurement’s page view toggle firing alongside a GTM page_view tag, and a CMS plugin running alongside GTM. Detection involves the Network tab in Chrome DevTools, filtered to collect requests.

Every custom event — form submissions, button clicks, video plays, file downloads — is tested manually in GTM Preview Mode to confirm it fires exactly once per interaction, uses the correct snake_case naming convention, and sends all expected parameters with non-null values.

Correct tracking paired with misconfigured Admin settings still produces distorted data. Every section of GA4 Admin is reviewed in turn.

• Property timezone and currency — wrong settings cause date-boundary mismatches and incorrect revenue figures that cannot be backfilled
• Data retention — GA4 defaults to 2 months; the maximum for free GA4 is 14 months and must be set immediately after setup
• Internal traffic filter — office and developer IPs must be excluded to keep conversion data clean
• Referral exclusions — payment gateways (Stripe, PayPal, Razorpay) must be listed to prevent them overwriting acquisition attribution on return
• Cross-domain tracking — required whenever users move between domains (e.g. main site to a third-party checkout)
• Enhanced Measurement — each toggle is reviewed individually; enabling all by default causes duplicate tracking
• Custom definitions — event parameters only appear in reports and Explorations if registered here
• Channel groups — miscategorised traffic (email appearing as referral, paid social as organic) is investigated and fixed
• User permissions — former employees, old agency accounts, and personal Gmail accounts are removed

Consent Mode v2 is now required for EU/EEA traffic if you use Google Ads conversion modelling or remarketing. The audit verifies four things:

• The consent default state is declared in HTML before the GTM snippet loads — not after
• The CMP fires a gtag consent update call on both accept and decline — not just on accept
• All four consent parameters are included: analytics_storage, ad_storage, ad_user_data, and ad_personalization
• Advanced Consent Mode is in use — cookieless pings are visible in DevTools for denied users, enabling modelled data recovery

The final layer moves from settings into actual report data. The goal is to confirm that what arrives in GA4 is accurate, uncontaminated, and analytically usable.

• Traffic source accuracy — high Direct (above 40%) or Unassigned (above 5%) signals missing UTMs or broken channel rules
• Conversion events — verifying the right events are marked as conversions (purchase, generate_lead) rather than scroll or page_view
• Duplicate transactions — an Exploration on Transaction ID sorted by Conversions descending exposes any ID appearing more than once
• Revenue reconciliation — GA4 purchase revenue vs back-end orders; a discrepancy above 15% requires investigation
• Engagement metrics — engagement rate, average session duration, views per session, and sessions per user benchmarked against expected ranges
• Bot traffic — zero-engagement sessions, geographic spikes from markets with no marketing presence, and unusual browser strings are flagged
• Cardinality — page path and custom dimension reports checked for (other) rows caused by session IDs or high-cardinality parameters

• Immediately after a new GA4 implementation goes live
• After any website redesign, CMS migration, or platform change
• When unexplained anomalies appear — spikes, drops, or zero conversions
• After changes to your consent management platform
• When onboarding a new client or taking over an existing property
• Quarterly as a routine health check for active properties
• After significant GTM container changes or new tag deployments

A GA4 audit uses a small set of tools, most of which are free and already available to anyone with GA4 access: