GA4 Audit Checklist: Make Sure Your Data Can Be Trusted

Most Google Analytics 4 properties are not broken in an obvious way. Reports load, charts move, and the monthly deck gets made. The problems hide in the details: a form submission counted twice because both a hard-coded tag and Google Tag Manager fire it, a payment gateway stealing credit for every sale, office traffic inflating engagement, a data retention setting that quietly deletes the history you need for a year-on-year exploration.

Those problems cost real money. Smart Bidding in Google Ads learns from the key events you import. Budget decisions follow the channel report. If the data is wrong, every decision downstream is confidently wrong too.

This checklist is the audit we run before we trust any GA4 property. It is organised as six passes, from property settings to integrations, with what to check, where to find it and what a healthy result looks like. It finishes with a worked example and an audit log template so the fixes stick.

Why a GA4 property can look healthy while the data is wrong

GA4 rarely shows an error message for bad data. It processes whatever it receives. If two tags send the same purchase event, GA4 dutifully records two purchases. If your checkout passes through a third-party payment domain, GA4 starts a new session with that domain as the source. Nothing turns red.

Three things make this worse than it was in Universal Analytics:

• Event-based flexibility. Any developer, plugin or marketer can create events, and many do. Six months later nobody knows which generate_lead event is the real one.
• Settings spread across several screens. Internal traffic is defined in the data stream but excluded in data filters. Referral exclusions sit under tag settings. Key events live in a different admin area again.
• Short default retention. Event-level data in explorations is kept for only two months unless someone changes it, so a problem you discover late may be impossible to investigate.

The audit below is designed to find each of these failure types in a fixed order, so nothing depends on the auditor remembering where every setting lives.

Pass 1: property and data stream settings that silently skew reports

Start in Admin. These settings take minutes to check but affect every report. Record what you find before you change anything.

Setting	Where to find it	What healthy looks like	What goes wrong if it is off
Reporting time zone and currency	Admin > Property details	Matches the business and your ad accounts	Daily totals do not match Google Ads or the store; revenue converted at the wrong currency
Data retention	Admin > Data collection and modification > Data retention	14 months for standard properties	Explorations cannot look back more than two months
Data streams	Admin > Data streams	One web stream per website (plus app streams if needed); no orphaned test streams	Traffic split across streams; test data in production
Enhanced measurement	Data stream > Enhanced measurement	Only the events you actually want switched on	Duplicate form or scroll events alongside custom ones
Session timeout and engaged session timer	Data stream > Configure tag settings > Adjust session timeout	Defaults (30 minutes, 10 seconds) unless there is a documented reason	Engagement rate not comparable with earlier periods
Reporting identity	Admin > Data display > Reporting identity	A deliberate choice, noted in the audit log	User counts change when someone toggles it
Google signals	Admin > Data collection	On or off deliberately, with consent implications understood	More reports hit data thresholds

Two of these deserve a closer look. Data retention is not retroactive, so the sooner it is set to 14 months the better. And if you see a lot of withheld rows in reports after enabling Google signals, read our guide to GA4 data thresholds before you decide what to switch off.

Pass 2: counting your tags, not trusting them

Duplicate tracking is the most common serious fault we find. It usually happens when a site has been touched by several people: a theme or plugin adds the Google tag, a developer hard-codes it into the header, and later someone installs it again through Google Tag Manager. Each copy sends a page_view, so sessions look normal while pageviews per session double.

Use this sequence on your five most important templates (home, a category or service page, a blog post, a form page and the thank-you or order confirmation page):

1. Open the page with Google Tag Assistant connected and list every tag ID that fires. You should see your GA4 measurement ID once.
2. View the page source and search for G- and GTM-. Note every hard-coded snippet and which plugin or template outputs it.
3. Open DebugView in GA4 and load the same page. Count the page_view events. Two within a second of each other means a duplicate.
4. Submit a test form and complete a test purchase if you can. Check that each key event appears exactly once.
5. Look for foreign measurement IDs: an old agency's property, a developer's test property or a Universal Analytics ID that no longer collects anything.
6. Check the hostname dimension in a free-form exploration. Any hostname that is not yours, a staging domain or localhost means the tag is firing somewhere it should not.

A quick numeric test helps too. In the Pages and screens report, compare views per session with what you would expect. A content site that suddenly shows exactly twice its historical views per session, from one specific date, almost always has a second tag from that date.

Unknown hostnames can also be a sign of spam hits rather than a duplicate tag. If that is what you see, our guide to bot traffic in analytics covers hostname filters and measurement protocol spam in detail.

Pass 3: key events that should mean money

In March 2024 Google renamed "conversions" in GA4 to key events, and "conversions" now refers to what is imported into Google Ads. The audit question is simple: does every key event represent a business outcome, and is each counted once?

Export the list from Admin > Data display > Key events and score each row:

Check	Pass	Fail and what to do
Represents an outcome you would pay for	Lead submitted, purchase, booked call, trial started	Scrolls, page views or button clicks marked as key events: demote them to ordinary events
Fires only on success	Fires on the thank-you page or after a server confirmation	Fires on button click, even when validation fails: move the trigger
One definition per outcome	A single generate_lead	form_submit, contact_form and generate_lead all marked: keep one
Counting method	Once per session for leads where repeat submissions are noise; once per event for purchases	Leads counted every time a user resubmits: change the counting method
Carries value where it matters	Purchases send value and currency; leads send an agreed value if you bid on value	No value: revenue reports and value-based bidding are blind
Reconciles with the source of truth	Within a stable, explainable gap of CRM or store orders	GA4 above the CRM, or the gap jumps: investigate duplicates or broken triggers

Enhanced measurement's form interaction setting is a frequent culprit here. It sends form_start and form_submit automatically, and on many sites form_submit fires when the browser submits, not when the lead is accepted. If you already track forms properly, as described in our guide to tracking form submissions in GA4 and GTM, switch the automatic form interactions off. For deciding which outcomes deserve key event status in the first place, see GA4 key events.

Pass 4: traffic that should never be counted

This pass covers four separate settings, each solving a different problem. Mixing them up is common, so it helps to see them side by side.

Problem	Setting	Where	Applies to past data?
Staff and agency visits	Define internal traffic rule, then an Internal traffic data filter	Data stream tag settings; Admin > Data filters	No
Developers testing with debug mode	Developer traffic data filter	Admin > Data filters	No
Payment gateways and login providers taking credit	List unwanted referrals	Data stream > Configure tag settings	No
Known bots and spiders	Automatic exclusion (cannot be switched off)	Built in	Applied at collection

For internal traffic, check three things: that the IP rules cover every office and the VPN people actually use; that the data filter is Active rather than left in Testing; and that someone has confirmed the filter works by comparing the traffic_type results while it was in testing mode. Our step-by-step guide to excluding internal traffic in GA4 walks through each screen.

Unwanted referrals deserve extra care because they directly corrupt attribution. GA4 lets you list up to 50 unwanted referrals per web data stream, and each matching domain is told to stop counting as a source. Google's documentation explains the mechanism:

“appends the ignore_referrer parameter with a value of true to every event that matches the conditions.”

— Google Analytics Help, [GA4] Identify unwanted referrals

To find candidates, open Traffic acquisition, set the primary dimension to Session source / medium and filter for referral. Any payment provider (PayPal, Stripe checkout pages, Klarna and similar), single sign-on service or booking engine that appears with a high key event rate is almost certainly stealing credit from the channel that really drove the visit. The same report is covered in more depth in our guide to referral traffic in GA4.

One subtlety catches auditors out: adding a referral exclusion does not immediately clear the domain from your reports. Returning users can still be credited to it because of how GA4 attributes sessions. Google notes:

“The key event lookback window you choose also applies to session attribution.”

— Google Analytics Help, [GA4] Identify unwanted referrals

So judge the fix after a full lookback window, not after a day.

Pass 5: channel and campaign hygiene

Even with clean tags, attribution falls apart if campaign links are inconsistent. GA4 treats parameter values as case sensitive, so utm_source=Facebook and utm_source=facebook become two sources, and odd mediums end up in the Unassigned channel.

Check these in the Traffic acquisition report for the last 90 days:

• Unassigned sessions. More than a few percent usually means non-standard utm_medium values. Our guide to why GA4 shows (Unassigned) traffic lists the values each default channel expects.
• Duplicate sources with different capitalisation such as newsletter, Newsletter and email for the same send.
• Paid traffic in organic channels. If Google Ads auto-tagging is off or GCLIDs are stripped by a redirect, paid clicks show up as organic or direct.
• Self-referrals between your own domains. If you run a separate checkout or booking domain, it needs cross-domain tracking, not a referral exclusion alone.
• AI referrals. Since May 2026 GA4 has a default AI Assistant channel. Check that visits from AI tools land there rather than in Referral, and note the change date in your audit log because it breaks year-on-year channel comparisons.

The fix for messy UTMs is not in GA4 at all. It is a shared naming sheet with allowed values for source and medium, used by everyone who builds links. Capture the same values in your forms as well, so the CRM agrees with GA4; our guide to capturing UTM and source data in your CRM shows how.

Pass 6: integrations, consent and exports

The last pass checks what flows in and out of the property. Each integration can silently fail after a permissions change or a staff departure.

• Google Ads link. Confirm the link is active, auto-tagging is on in Google Ads, and that the key events used for bidding are imported once (not imported from GA4 and also tracked by a separate Google Ads tag, unless you have chosen one as primary and the other as secondary).
• Search Console link. Linked to the correct web stream, so the Search Console reports in GA4 actually populate.
• BigQuery export. If you rely on raw data, check the export is still running and look at the newest table date. Our GA4 BigQuery export guide covers the daily and streaming options.
• Consent mode. If you use a consent banner, test that tags behave correctly before and after consent in each region you serve. A banner that blocks the tag completely until consent removes modelled data; one that never updates consent state may send nothing useful.
• User access. Remove former staff and agencies. Make sure at least two people in the business have Administrator access so the property cannot be orphaned.
• Dashboards. Dashboards in Data Studio (the tool renamed from Looker Studio in April 2026) often reference old event names. List any that use renamed or deleted events.

A worked GA4 audit on a lead-generation site

Example: a hypothetical professional services firm, illustrative numbers.

The firm's GA4 property showed 412 generate_lead key events in March. The CRM recorded 238 genuine enquiries and 31 spam submissions in the same month. Google Ads, bidding on imported key events, reported a cost per lead of £58 against a target of £75, so the account looked comfortably profitable.

The audit found three problems:

1. Duplicate lead events. A form plugin pushed its own event to the data layer, and GTM also fired a generate_lead tag on the thank-you page. About 140 of the 412 events were duplicates.
2. Enhanced measurement form submits. Automatic form_submit was also marked as a key event, adding a further layer of noise to reports that included it.
3. Payment referral. A small paid consultation product sent users through a payment page, and that provider appeared as a referral source with the highest conversion rate in the account.

After removing the plugin push, demoting form_submit, adding the payment domain as an unwanted referral and adding spam protection, April showed 261 generate_lead events against 244 CRM enquiries, a gap of about 7%. The real cost per lead turned out to be roughly £97, not £58. That was not good news, but it explained why the sales team had been complaining about lead volume for months, and it changed how the bidding targets were set.

The lesson is general: when GA4 counts more leads than the CRM, assume a tracking fault until proven otherwise.

Turning the GA4 audit into a living change log

An audit that only lives in someone's head expires when that person leaves. Keep a simple log, either in a shared sheet or the property's annotations, with one row per change:

Date	Change	Reason	Expected effect on reports	Owner
2 April	Removed duplicate generate_lead push from form plugin	Leads double counted vs CRM	Key events fall by about a third	Analytics lead
2 April	Data retention set to 14 months	Explorations limited to 2 months	None on standard reports	Analytics lead
3 April	Payment provider added to unwanted referrals	Referral stealing purchase credit	Referral key events fall; paid and organic rise	Analytics lead
5 April	Internal traffic filter moved from Testing to Active	Office visits inflating engagement	Sessions fall slightly	Web developer

Alongside the log, keep a one-page measurement plan: the list of key events, what each means, how it is triggered and who approves new ones. If your tracking is built on a data layer, document the events there too; our data layer guide explains a clean structure.

Questions teams ask before trusting their GA4 numbers again

How often should a GA4 property be audited?

Run a full audit once a year and after any site migration, redesign, new consent banner, CMS change or tag manager rebuild. In between, a 15-minute monthly check of key event counts against your CRM or store catches most breakages before they ruin a quarter of data.

Can an audit fix data that GA4 has already collected?

Mostly no. Data filters, referral exclusions and key event changes apply from the moment they are saved. You can correct historical reporting with segments, comparisons or the BigQuery export, but you cannot rewrite what the standard reports already processed. That is why the audit log matters: it tells future readers which dates to distrust.

Is a difference between GA4 and my CRM always a tracking error?

No. Consent choices, ad blockers, browsers that limit storage, duplicate or spam submissions in the CRM and different attribution rules all create gaps. A stable gap of 10 to 25% that moves in step with the CRM is usually acceptable. A gap that suddenly widens, or GA4 counting more leads than the CRM, points to a tagging problem.

Should the data retention setting be changed during an audit?

For most standard properties, yes: switch event data retention from the default 2 months to 14 months so explorations can look back over a full year. It only affects explorations and event-level analysis, not the aggregated standard reports, and it is not retroactive.

Who should own GA4 after the audit?

One named person, even in a small business. They approve new key events, keep the UTM naming sheet, review the change log and check the monthly reconciliation. Without an owner, properties drift back into the state you just fixed.

Your first 90 minutes with this GA4 audit

If you only have one session this week, spend 20 minutes on Pass 1 (set retention to 14 months today), 30 minutes on Pass 2 counting tags on your thank-you pages, and 40 minutes reconciling last month's key events against your CRM or order system. Those three steps catch most of the costly errors.

If the reconciliation shows a large or unexplained gap, or your ad platforms are bidding on numbers you no longer trust, our conversion optimization team audits GA4 and tag implementations as part of every engagement. Get a quote for a GA4 data quality review.

Further reading on GA4 audit checklist

• Bot Traffic in Analytics: How to Spot and Filter It
• Email Open Rates After Apple Mail Privacy: What to Measure Instead
• Google Sheets for Marketers: Formulas and Templates That Save Hours
• Newsletter Sponsorships: Buying Ads in Other People's Newsletters

Sources for this GA4 audit checklist

1. Google Analytics Help: [GA4] Identify unwanted referrals
2. Google Analytics Help: [GA4] Exclude internal traffic (define internal traffic and data filters)
3. Google Analytics Help: [GA4] Set up cross-domain measurement
4. Google Analytics Help: [GA4] URL builders: Collect campaign data with custom URLs
5. Google Analytics Help: [GA4] Data filters
6. Google Analytics Help: [GA4] Known bot-traffic exclusion
7. Google Analytics Help: [GA4] Enhanced event measurement
8. Google Analytics Help: [GA4] Data retention