GA4 Audit Checklist: 12 Checks Before You Trust the Data

GA4 Audit Checklist: 12 Checks Before You Trust the Data

A GA4 audit is a structured check that your property collects the right events once, flags the right ones as key events, links properly to Google Ads, respects privacy rules and matches the revenue in your CRM. Work through the 12 checks below in order. Most businesses we look at fail at least three of them, and the failures are usually the reason ad reports and bank balances disagree.

I’m Jesse, a senior paid media specialist at Senior Ad Managers. This checklist is the one we use before we touch a campaign, because spending more on top of broken tracking just buys more bad data.

TL;DR

• Audit in this order: property settings, events, key events, Google Ads link, duplicates, privacy, then CRM reconciliation.
• A GA4 key event is only useful if it represents a real business outcome, such as a booked appointment or a paid order, not a button click.
• Count each lead once. Double-firing tags and thank-you page reloads inflate conversions and teach Google Ads to chase junk.
• Privacy settings are part of the audit. The OAIC expects you to do due diligence on tracking tools and to avoid sending sensitive information through them.
• The final test is reconciliation: GA4 and Google Ads numbers against closed revenue in your CRM.

Table of Contents

• Before you start: what you need
• Part 1: Property and data collection
• Part 2: Events and key events
• Part 3: Google Ads and other connections
• Part 4: Privacy and reconciliation
• How to score your audit
• Our view: the platform tells a good story
• Get a second pair of eyes on your tracking
• FAQ
• Sources

Before you start: what you need

You need Editor or Administrator access to the GA4 property, access to Google Tag Manager (or whoever installed your tags), admin access to the Google Ads account, and a read-only export from your CRM or shop platform covering the last 90 days. Without the CRM export you can audit collection, but you can’t audit truth.

Set aside two to three hours for a small site. Take notes as you go, in a simple sheet with three columns: what you found, what it should be, and the dollar risk if it stays wrong.

Part 1: Property and data collection

1. Confirm the right property and data stream

Open Admin and check that the property has the right name, the Australian time zone (for most businesses, the one that matches your reporting day), and AUD as the currency. A wrong currency means revenue is wrong from day one, and it’s more common than it should be when a site was set up by an overseas developer.

Then check the web data stream. The measurement ID should match the one in the tag on your site. We regularly find two IDs live at once: an old one from a previous agency and a new one. Both collect data, and nobody knows which one the reports use.

2. Check the tag is firing on every page

Use Tag Assistant or the GA4 DebugView to load your home page, a service or product page, your contact page and your confirmation page. Each should send a page_view once. Check subdomains and booking tools too. If you send people to a third-party booking system or a separate checkout domain, sessions can break and your own site gets credit for traffic it didn’t earn. Cross-domain measurement needs to be configured for those hops.

If you run campaigns targeted at other markets, test from there as well. Tools that give you a real local IP, such as mobile carrier proxies for testing geo-targeted ads, let you confirm the same events collect correctly for visitors in the US cities you target.

3. Review data retention and internal traffic

In Data Settings, look at event data retention. GA4’s default is 14 months for user-level data, and that affects how far back year-on-year explorations can go. Set it to the longest option your privacy policy allows.

Then define internal traffic and apply the data filter. Your team, your agency and your developers clicking around the site should not count as leads or sessions. For a business getting 200 enquiries a month, a few staff test submissions can quietly become a meaningful share.

Part 2: Events and key events

4. List every event and remove the noise

Open Reports, then Engagement, then Events. Write down every event name. You’re looking for three problems:

• Events that fire on everything (a click event on every link, for example) and drown out the useful ones.
• Near-duplicate names such as form_submit, formSubmit and contact_form_sent, created by different people at different times.
• Missing events for actions you care about: phone taps, quote requests, booking confirmations, add to cart, purchase.

Decide on one naming convention, lowercase with underscores, and retire the rest.

5. Check that key events match real business outcomes

GA4 no longer uses Universal Analytics-style goals. You mark specific events as key events, and the purchase event is handled this way too. The audit question is simple: if this event fires, did the business win something?

Good key events: a submitted quote form, a booked consultation, a completed purchase, a qualified call. Weak ones: scroll depth, a click on a phone number in the footer that people hit by accident, a page view of the thank-you page that can be reloaded. If you have more than a handful of key events, ask which ones you’d happily pay for. Those are your primary conversions.

6. Validate ecommerce events and values

If you sell online, check the full funnel: view_item, add_to_cart, begin_checkout and purchase, each with item details, value and currency. Google documents the required ecommerce events and parameters, and the events need that extra context to be meaningful.

Then compare totals. Take ten recent orders from your shop platform and find them in GA4 by transaction ID. Look for missing orders, duplicated transaction IDs, shipping and GST handled differently from the shop’s own reports, and refunds that never reach GA4. Our post on GA4 ecommerce tracking and CRM reconciliation walks through the usual mismatches.

7. Count each lead once

This is the check most generic checklists skip. Submit a test enquiry and watch how many conversion events fire in DebugView. Then reload the thank-you page and see what happens.

Common causes of double counting:

• A GA4 tag in the site code and a second one in Tag Manager.
• A form plugin that fires an event on click and another on success.
• A thank-you page that counts every visit, including bookmarks and refreshes.
• Both a GA4 key event and a separate Google Ads tag counting the same lead, with both set to “every” conversion.

For lead generation, set the Google Ads conversion count to one per click, and make sure your CRM has a rule to merge duplicate contacts. Without this, a business that thinks it has 80 leads a month may have 50 people. Our guide to Google Ads conversion tracking covers the settings in detail.

Part 3: Google Ads and other connections

8. Check the Google Ads link and auto-tagging

In GA4 Admin, open Google Ads links and confirm the right Ads account is linked, with personalised advertising enabled if you plan to build audiences. In Google Ads, confirm that auto-tagging is on. It’s required to import key events and to bring cost data into GA4, and it’s the mechanism that attaches the click ID your CRM will need later.

Then check which conversions Google Ads actually optimises on. Open Goals, then Conversions, and look at the primary actions. We often find page views, scrolls or micro-events marked primary, so the bidding system happily buys cheap clicks that never become customers. Move those to secondary.

9. Check channel grouping and brand traffic

In the traffic acquisition report, look at the default channel groupings. Are paid search sessions landing in “Unassigned” or “Direct” because UTM tags are inconsistent? Are email and social campaigns tagged?

Next, separate brand from new demand. If someone searches your business name and clicks an ad, that’s not acquisition, it’s a tax on people who already knew you. In Google Ads, brand terms should sit in their own campaign, with brand exclusions applied to your acquisition campaigns. When they’re mixed together, blended ROAS looks excellent while new customer growth stalls. While you’re in there, review the search terms report: we use exact and phrase match with tight negatives, and we never use broad match, so the report should show queries that make sense for what you sell.

10. Check enhanced conversions and offline imports

If you run lead generation, GA4 form fills are only a proxy. What matters is which leads became paying customers. Check whether enhanced conversions for leads is set up and verified. Google publishes an implementation checklist for enhanced conversions for leads that you can run alongside this audit.

Then ask whether closed deals flow back to Google Ads. Google now recommends Data Manager for importing first-party data, and its notes say legacy API access is being blocked for accounts that haven’t sent requests in the stated window, so check how your current import is connected. Daily uploads are recommended. If your CRM is HubSpot, our page on offline conversion import explains the setup, and about offline conversion imports is Google’s own reference for confirming that enhanced conversions are working.

Part 4: Privacy and reconciliation

11. Audit privacy settings and what you pass to GA4

The Privacy Act 1988 doesn’t ban tracking pixels, but the OAIC says organisations should do appropriate due diligence on third-party tracking pixels and use them in a way that complies with the Act. In practice, audit these points:

• No names, emails, phone numbers or health details in page URLs, event parameters or page titles. Check form confirmation URLs, which sometimes carry query strings with personal details.
• Your privacy policy describes the analytics and advertising tools you use.
• Consent and opt-out mechanisms work, and tags respect them.
• For healthcare, legal and other sensitive services, no sensitive information is sent to analytics or ad platforms at all.

If you’re a telehealth provider, a law firm or a clinic, this is where the audit matters most, and your lawyer or privacy officer should review what the tags send. We cover the ad side in our pages for telehealth providers and family lawyers.

12. Reconcile GA4 and Google Ads to closed revenue

This is the check that tells you whether everything above worked. Take the last 90 days and build a simple table:

GA4 and the platforms will never match the CRM exactly, because of consent, ad blockers, attribution windows and cross-device behaviour. What you want is a gap you can explain and that stays stable. A gap that is large, growing or unexplained is where the wasted spend is hiding.

Capturing the click ID on each form and storing it in the CRM is what makes this table possible. Our post on closed-loop attribution with GCLID and fbclid explains how, including the privacy side.

How to score your audit

Give each check a red, amber or green status.

Any red in checks 5, 7, 8, 10 or 12 should stop budget increases. Scaling spend against a conversion that’s counted twice just scales the error. Fixing tracking first is also usually the cheapest improvement available, because it changes what the bidding system learns from.

Our view: the platform tells a good story

A GA4 audit is not a technical exercise for its own sake. The point is to find out whether the numbers you use to spend money are true.

We’ve seen accounts where Google Ads reports a healthy ROAS because brand searches, duplicate leads and soft conversions are all counted together, while the CRM shows far fewer paying customers. Nobody is lying. Each tool reports what it was told to measure, and the setup told it the wrong thing.

Our approach is the same every time. We fix conversion tracking first. We split brand searches from new demand. We count each lead once. We then cut the spend that isn’t producing real customers, and measure every campaign against closed revenue in the client’s CRM. It’s how we helped a DTC supplement brand grow from $15k to $90k a month in revenue on Meta Ads, and how a telehealth provider added 600+ new patients in 12 months through Google and Meta Ads. Those results came from clean measurement first, not luck, though no agency can guarantee a result for your business.

If an audit shows the tracking is sound and the campaigns are simply poor, we’ll say so. If we can’t help, we’ll tell you upfront.

— Jesse Lees

Get a second pair of eyes on your tracking

If you’d rather not spend an afternoon in DebugView, our $99 AUD Google Ads audit reviews your account structure, conversion setup and wasted spend. If the problem is deeper, our website tracking service covers GA4, Tag Manager and CRM-linked conversion setup, and the conversion tracking fix page explains how we repair broken Google Ads measurement.

FAQ

How often should I run a GA4 audit?

Run a full audit once a year, and a short version (checks 5, 7, 8 and 12) every quarter. Also audit after any website rebuild, new checkout or booking tool, form plugin change or agency handover. Those are the moments tracking tends to break.

Can I do a GA4 audit myself?

Yes, the first nine checks are within reach of most marketing managers with the right access. Checks 10 to 12 usually need someone who can work across GA4, Google Ads and the CRM at once. If you aren’t sure what a result means, get it reviewed before you change campaigns.

Why doesn’t GA4 match my Google Ads conversions?

They use different attribution models, conversion windows and counting rules, and each is affected differently by consent and blocked cookies. Some difference is normal. Check that the same event is used in both, that counting is set to one per click for leads, and that auto-tagging is on.

Does GA4 raise privacy issues in Australia?

It can, depending on what you send it. The Privacy Act doesn’t prohibit tracking pixels, but the OAIC expects due diligence, and you should never pass personal or sensitive information through URLs or event parameters. If you handle health or legal information, ask your privacy adviser to review the setup.

Sources

• Tracking pixels and privacy obligations, OAIC
• Conversions and key events in Google Analytics 4, Analytics Help
• Set up ecommerce events, Analytics Help
• About auto-tagging, Google Ads Help
• Enhanced conversions for leads implementation checklist, Google Ads Help
• How to upgrade offline imports, Google Ads Help
• About offline conversion imports, Google Ads Help
• Google Analytics 4 data retention, Usercentrics

Recommended

• GA4 Ecommerce Tracking: Reconcile CRM Before Scaling Ads in Australia
• Why Your Google Ads Reporting Is Probably Lying to You
• Fix Tracking First, Then Tools: Click Fraud Protection for Agencies
• Marketers: Capture GCLID & fbclid for closed-loop attribution, APP 7