The GA4 audit checklist: 12 checks before you trust a single number

GA4 rarely fails loudly. It fails politely — reports keep filling with numbers, dashboards keep updating, and nobody notices that half the conversions are counted twice or that "Direct" traffic is quietly swallowing the credit your ads earned. By the time someone asks "why doesn't this match?", months of budget decisions have been made on bad data.

A GA4 audit is simply the discipline of checking the pipes before believing the water meter. You don't need to be technical to understand what's being checked or why it matters — so here's our full checklist, in plain English.

Part one: are the basics wired correctly?

The first four checks catch the majority of problems we find:

• 1. One tag, once, on every page. Duplicate GA4 tags — often one hardcoded and one in Google Tag Manager — mean every pageview and conversion counts twice. It's the single most common fault we find.
• 2. Internal traffic filtered out. If your own team's visits aren't excluded, your busiest "customer" is you. Small sites can have 20–30% of traffic come from staff.
• 3. Cross-domain tracking where needed. If checkout, booking or payment happens on another domain, GA4 must be told — otherwise every buyer looks like a brand-new "Referral" visitor at the moment they matter most.
• 4. Data retention set to 14 months. GA4 defaults to keeping detailed data for only two months. It's a two-click fix, and almost nobody has clicked it.

Part two: do your conversions mean what you think they mean?

Conversions are where GA4 goes from "slightly off" to "actively misleading". These checks make sure the number your business runs on is real:

• 5. Every conversion maps to a real business outcome. An enquiry submitted, a call made, a sale completed. "Scrolled 90%" is not a conversion — it's a vanity metric wearing a costume.
• 6. Conversions fire once per action. Thank-you pages that users refresh, forms that fire on every keystroke, events attached to both the button and the page — all classic double-counting.
• 7. Key events are marked as key events. GA4 only feeds "key events" into Google Ads for optimisation. If your enquiry event isn't flagged, your ad budget is optimising toward the wrong thing.
• 8. Test traffic isn't polluting the totals. Staging sites, developers, and form tests all show up as conversions unless deliberately excluded.

Part three: can you trust where GA4 says people came from?

• 9. UTM discipline. Untagged email newsletters and social posts collapse into "Direct". If Direct is your biggest channel, that's usually a labelling failure, not a loyal audience.
• 10. Google Ads properly linked. The GA4↔Ads link must be live and auto-tagging enabled, or the two tools will report different realities forever.
• 11. Payment redirects excluded from referrals. Stripe, PayPal and bank gateways will steal conversion credit as "referrals" unless listed as unwanted referrals.
• 12. Consent handling isn't silently dropping data. If your cookie banner blocks GA4 before consent (as Australian privacy practice increasingly expects), you need to know roughly how much traffic is invisible — otherwise every "drop" in the charts looks like a business problem.

What a good audit hands you at the end

The output shouldn't be a 40-page PDF of screenshots. It should be a short, prioritised fix list in plain English: what's wrong, what it's costing you in decision quality, and what fixing it involves. Most GA4 properties need 5–10 fixes; most of those take under an hour each.

You can absolutely run this checklist yourself — everything above is visible in the GA4 and Tag Manager interfaces. Where an outside pair of eyes earns its keep is in the judgment calls: which events should exist for your business, which numbers are safe to compare year-on-year after fixes, and how your setup should support the SEO, paid media and web work that sits on top of it.