This GA4 audit checklist covers 25 checks in five groups, from property settings to reconciling key events with your CRM. Work through them in order and you will know which numbers to trust and what to fix first.
By Kristijan GjorgjioskiIndependent SEO consultantPublished 18 October 2026 · 10 min read
Most GA4 properties look fine on the surface.
Numbers arrive. Charts move. Nobody questions them until a board meeting where GA4 and the CRM disagree.
I audit GA4 properties as part of my Google Analytics consulting, and the same faults show up again and again.
This checklist covers the 25 checks I run first. They are grouped by the question each group answers, so you can stop at any gate that fails.
You do not need to run all 25 checks in one sitting.
Start with the group that matches your symptom:
For each check, write down pass, fail or not applicable, plus a one-line note.
That note becomes your fix list. If you want the background on why some gaps are normal, read why GA4 data does not match your other tools before you start.
These six checks cover settings that quietly shape every report.
Most take under a minute each.
Check who holds the Administrator role at account level.
If it is an agency you no longer use, or a former employee's personal Gmail, you risk losing the property entirely.
Pass: at least two people at your company hold admin access through company logins. Agencies sit below that, as users you can remove.
While you are in access management, read the full user list.
Remove anyone who has left, and downgrade anyone who has more access than their job needs.
Pass: every user is a current person or partner, at the lowest role that lets them do their work.
GA4 reports days in the property's time zone. If it differs from your accounting system, daily totals will never line up.
The same goes for currency on revenue.
Pass: time zone and currency match the system your finance team reports from.
Retention decides how far back explorations and funnel reports can reach. Standard reports are not affected.
On a standard property the options are two months or 14 months. Many properties are still on two.
Pass: event data retention is set to 14 months under Data Settings.
Defining internal traffic by IP is only half the job. The data filter also has to be switched on.
GA4 filters have three states: Testing, Active and Inactive. A filter in Testing only labels matching data, so staff visits still land in your reports.
Pass: the internal traffic filter shows as Active. Google's data filter guide explains each state.
By default, a GA4 session ends after 30 minutes of inactivity.
That suits most sites. If your buyers routinely leave a long quote form open, sessions may split and inflate counts.
Pass: the timeout setting in the web stream's tag settings has been reviewed, and any change from 30 minutes has a written reason.
The next five checks catch the faults that make numbers too high or too low across the whole property.
The classic: GA4 added once by a CMS plugin and again through Tag Manager.
Every page view and every key event gets counted twice.
Open your site with Tag Assistant and watch how many page_view events fire on a single load. Then check your theme, plugins and container.
Pass: one page_view per page load, from one source. If your container needs a wider tidy-up, see these Google Tag Manager best practices.
Landing pages built in a separate tool, thank-you pages, booking steps and checkout pages often miss the tag.
When the tag is missing, the journey breaks and the next page credits the wrong source.
Pass: you have checked one URL of every template type, including off-theme landing pages, and each one sends a page view.
Enhanced measurement can record scrolls, outbound clicks, site search, video engagement, file downloads and form interactions.
Form interactions cause the most trouble. The form_submit event can fire on newsletter boxes, search bars and forms that failed validation.
Pass: each enhanced measurement option is either useful and checked, or switched off.
GA4 event names are case sensitive, so sign_up and Sign_Up become two separate events.
Export your event list and look for duplicates, test events and names from agencies past.
Pass: one name per action, all lower case with underscores, and no test events still firing on the live site.
Some form tools add names or email addresses to the thank-you page URL. GA4 then stores them as page location.
GA4's data redaction setting can strip email addresses and named query parameters on web streams. Google's data redaction guide says it is on by default only for newer properties.
Pass: no personal data appears in page paths or parameters, and redaction is switched on as a safety net.
This is where most of the damage hides.
A wrong key event does not just skew a report. It can feed bad signals to ad bidding and budget decisions.
Standard properties allow up to 30 key events. That is a ceiling, not a target.
For each key event, ask: would the business celebrate if this number doubled?
If the answer is no, it should be a normal event.
Pass: each key event maps to a commercial outcome you can name. My guide on how to set up key events in GA4 covers how to choose them.
Submit each form. Complete a test booking. Place a test order if you can.
Watch DebugView as you do it, then try again with a deliberate error, such as a missing required field.
Pass: the key event fires once on success and does not fire when the form fails. For tag-level debugging, follow these steps to debug Google Tag Manager.
Each key event counts either once per event or once per session.
Google labels once per event as recommended and once per session as legacy. Key events migrated from old Universal Analytics goals often still use the legacy setting.
Pass: you know which method each key event uses, and it suits what you want to count. Google's counting method page explains how to change it.
Marking page_view as a key event counts every page view on the site as a success.
To count a thank-you page, create a separate event based on page_view and the confirmation URL, then mark that one.
Pass: page_view is not starred, and each thank-you page key event has its own event name.
For stores, revenue in GA4 should come with every purchase, including PayPal, buy-now-pay-later and other payment methods that leave your site.
The value parameter needs a currency parameter next to it.
Pass: a test purchase on each payment method shows once in GA4 with the right value and currency.
GA4 marks purchase as a key event by default. According to Google's key events help page, linking Google Ads with ads personalisation switched on adds more defaults, such as add_to_cart and session_start.
Those can make your key event totals look much bigger than your real leads or sales.
Pass: you know which key events are defaults, and your reports and team understand what each total includes.
These five checks stop sales from losing their real origin.
When a buyer pays on a payment provider's domain and comes back to your thank-you page, that provider can take the credit.
Add those domains to the unwanted referrals list in the web stream's tag settings.
Pass: no payment provider, booking tool or password-reset service appears among your referral sources.
If your booking widget, shop or client portal lives on another domain you own, you need cross-domain measurement.
Click from your main site to the other domain and check the destination URL. You should see a _gl parameter.
Pass: the parameter appears, both domains use the same Google tag ID, and the session keeps its source across the hop.
Inconsistent campaign tags push email, social and partner visits into the Unassigned channel.
Look at how much traffic lands there, then check the source and medium values behind it.
Pass: Unassigned is small, and there is a written UTM convention your team actually follows. A measurement plan is the natural home for it.
Without auto-tagging, paid clicks can show up as organic or referral traffic.
Pass: Google Ads is linked under product links, and auto-tagging is switched on in the Ads account.
The Search Console link gives you query and organic landing page data inside GA4.
The reports also need to be published in the report library, or nobody will find them.
Pass: the link is active and the Search Console reports are visible in the left-hand menu. If organic traffic is under review, pair this with a full SEO audit.
The last three checks test whether the numbers mean what people think they mean.
Attribution settings decide which channel gets credit for each key event.
Check the reporting attribution model, the channels that can receive credit and the key event lookback window. The model change applies to past data too, so note when anyone changed it.
Pass: the settings are recorded, and the people reading reports know which model they are looking at.
Custom dimensions only collect data from the day they are registered. Standard properties also cap how many you can create.
High-cardinality values, such as unique IDs, can push useful rows into (other).
Pass: every parameter you report on is registered, and no key report is dominated by an (other) row.
This is the check that matters most.
Export a month of enquiries, bookings or orders from your own system. Line them up against GA4 key events for the same month and time zone.
Pass: the gap is stable from month to month and you can explain it. A sudden change in the gap means something broke.
Not every failed check is urgent.
I rank findings by how much they distort decisions, not by how technical they sound. It is the same logic I use when reading an SEO audit report:
| Priority | What belongs here | Examples from this checklist |
|---|---|---|
| 1. Fix now | Wrong numbers feeding money decisions | Duplicate tags (7), key events on the wrong action (13), lost account ownership (1) |
| 2. Fix this month | Data you are losing every day | Two-month retention (4), filter in Testing (5), personal data in URLs (11) |
| 3. Fix when convenient | Credit going to the wrong channel | Unwanted referrals (18), UTM drift (20) |
| 4. Nice to have | Cleaner reporting | Event name tidy-up (10), unused custom dimensions (24) |
If you track ROI on SEO or ads, fix priority 1 items before you run any numbers through an SEO ROI calculator. Bad inputs give confident-looking wrong answers.
Start with check 25.
Reconciling GA4 against your own records tells you how big your problem is before you spend time on the other 24.
Then work through the group that matches your symptom, fix the priority 1 items and write down the date of every change.
If the property is beyond repair, a clean rebuild from a written GA4 measurement plan is often cheaper than patching. That is what a GA4 setup project covers.
If you would rather hand it over, my GA4 audit service runs these checks and more, tests every key journey in the browser and ranks the fixes for you. Many findings trace back to the container, which is where Google Tag Manager work picks up.
Prefer to compare notes first? See how I approach a Google Analytics audit and decide which checks you want to run yourself.
Run a full GA4 audit once a year and after any redesign, platform move, new consent banner or change of agency. In between, a quick monthly look at key event counts against your CRM catches most breakages early. Tracking usually fails silently, so a scheduled check is the only reliable way to spot it.
Mostly, yes. Viewer access lets you review settings, reports and DebugView for most checks. You need read access to Google Tag Manager too, because many GA4 faults start in the container. You only need Editor or Marketer access when you start fixing things, such as activating a filter or changing a counting method.
No. GA4 does not reprocess data it has already collected, so fixes apply from the day they go live. Changing the reporting attribution model is one exception, because it applies to historical data as well. For everything else, note the fix date so anyone reading old reports knows which figures to treat with caution.
In my audits it is a key event that fires on the wrong action, usually a button click instead of a successful form submission. The second most common is GA4 installed twice, once through a plugin and once through Tag Manager, which doubles page views and key events.
About the author
Kristijan Gjorgjioski
Independent SEO consultant · 6+ years in SEO · 60+ client websites worked on
I'm an independent SEO consultant with 6+ years in SEO. I run audits, migrations and content programmes for businesses in Europe, the UK and the USA, and I build the automation behind my own research.
Book a free 30-minute call. I look at your site first and tell you plainly what I would fix, and in what order.