GA4 Audit: 10-Point Checklist for Accurate Analytics in 2026

A GA4 audit verifies that every event, conversion, and attribution signal in your Google Analytics 4 property reflects reality. Without one, you are optimizing ad spend against contaminated data, usually for months before anyone notices.

I have audited over 120 containers across Europe since 2014. Most of them were not broken on day one. They drifted. A CMS update rewrites the DOM, a consent setting changes, a plugin updates, and suddenly half your conversions are either missing or double-counted. The business keeps making decisions from the reports. The reports are wrong.

This is the 10-point checklist I run on every new client container.

• A GA4 audit checks 10 things: property settings, data streams, events, conversions, custom definitions, audiences, attribution, Consent Mode v2 signals, data retention, and BigQuery export parity.
• The biggest silent killer is attribution drift. A setting changes, conversions shift channels, and nobody notices for months.
• Run a full GA4 audit quarterly at minimum. Monthly if you spend 5,000 EUR or more per month on ads.
• Most broken GA4 properties I audit are not broken on day one. They drift after CMS updates, consent changes, or platform migrations.
• DIY audit = one focused day of a senior analyst's time, once per quarter. Monthly retainer = 150 EUR and no focused work.

What a GA4 audit actually is (and what it is not)

A GA4 audit is a structured verification that the data in your Google Analytics 4 property matches what actually happened on your site. It checks that every event fired, every conversion counted, and every channel attribution reflects real user behaviour, not broken configuration.

It is not a Google Analytics certification review. It is not a pretty slide deck from your agency. And it is not "I clicked around GA4 for 30 minutes and nothing looked off". A real audit cross-references the GA4 interface against raw data (BigQuery export, GTM debug output, ad platform reports) and flags every mismatch.

Scope matters. A proper GA4 audit covers the full data flow: browser to GTM to GA4 property to reports to downstream tools (Google Ads, Looker Studio, BigQuery). Every hop is a chance for silent failure.

Why GA4 data drifts silently (even when nothing "changed")

The hardest part of GA4 is that nothing obvious has to happen for the data to break. A property that was audited clean three months ago can be silently wrong today. Five common causes:

1. CMS updates rewrite the DOM. A WordPress theme update changes the checkout button from <button class="buy"> to <button class="buy-now">. Your GTM click trigger stops firing. Purchase events vanish from GA4 but nothing in the interface shouts about it.
2. Consent Mode v2 thresholds Google adjusts. Modeling only activates above a specific EU daily traffic threshold. If your traffic dips, denied-consent traffic stops being modeled and just disappears from reports.
3. New ad campaigns create new channels. GA4 auto-buckets sources into default channel groups. A new TikTok campaign with a specific utm_source often lands in "Unassigned" instead of "Paid Social", contaminating channel performance views.
4. Plugin updates change the ecommerce schema. WooCommerce, Shoper, and PrestaShop plugins routinely rename data layer properties across major versions. item_id becomes product_id, and suddenly your product-level reports collapse.
5. Platform migrations reset integrations. Migrating from Hostinger to MyDevil, or from Shopify to WooCommerce, forces a reinstall of the GA4 and GTM setup. Something always gets missed.

None of these trigger an alert. None of them flag themselves in GA4. The only way to catch them is to look, on a cadence.

The 10-point GA4 audit checklist

This is the exact checklist I run on every new client GA4 property. It takes about 4 to 6 hours end to end when everything is accessible. Work through it in order, because later steps depend on earlier ones being clean.

1. Property settings

Open Admin to Property Details. Verify:

• Timezone matches the primary market. A property set to America/Los_Angeles on a Polish ecommerce site will shift session boundaries, causing artificial daily patterns.
• Currency matches what the site actually charges. If you accept EUR but the property is set to USD, your purchase event revenue is converted at Google's internal rate, not your actual prices.
• Industry category is set. It feeds GA4's automated insights and benchmarking.
• Data retention is 14 months, not the default 2 months. This is a one-click fix with huge downstream impact. Under Admin to Data Retention, change it now if it is still at the default.

2. Data streams

Admin to Data Streams. For each stream:

• Enhanced measurement flags: check which auto-events are on. scrolls, outbound clicks, site search, video engagement, file downloads. Every one of these fires automatically, and any misconfigured flag quietly pollutes your conversion counts.
• Stream ID and measurement ID match your GTM tag. Paste-mismatch between GTM and GA4 is one of the most common audit findings.
• Cross-domain linking is set up if you run multiple domains. Missing cross-domain config is why some attribution models show the checkout domain as the "source".

3. Event tracking integrity

This is the longest part of the audit. For each key event (purchase, generate_lead, sign_up, form_submit, whatever matters to the business):

• Fire the event live on the site with GA4 DebugView open.
• Verify the event appears in DebugView with all expected parameters.
• Cross-check the event count in the Realtime report.
• Query BigQuery for the same event (if export is enabled) and verify parity with the GA4 UI within 24 hours.

If an event fires but parameters are missing, it still counts as "working" in GA4's UI. The failure only becomes visible when you try to build a report that uses those parameters.

4. Conversion goals

Admin to Events to Conversions. Verify:

• Every conversion marked as such is actually a conversion (not a proxy event like scroll accidentally flagged).
• Counting method is set correctly: "Once per event" for most purchases, "Once per session" for lead generation. Default is "Once per event" and it is usually what you want.
• Conversion value is populated. If purchase conversions have no value parameter, your ROAS reports are useless.

5. Custom dimensions and metrics

Admin to Custom Definitions. Audit each:

• Scope (event, user, item) matches the intent. A dimension scoped at "event" cannot be used in user-level audiences.
• Parameter name is registered exactly as GTM sends it. Case matters. userType and user_type are two different parameters.
• Registration has happened. Unregistered custom parameters still fire but do not appear in reports.

A common finding: custom dimensions are created in the GA4 UI but never actually populated by GTM, because the parameter name on the GTM side is different.

6. Audiences

Admin to Audiences. Review:

• Membership duration matches the use case. A 30-day remarketing audience on a 90-day sales cycle is too short.
• Definitions still match business logic. Audiences created for a campaign 18 months ago are often stale.
• Overlap with other audiences. Two audiences with 95% overlap serve no incremental purpose and just clutter the integration into Google Ads.

7. Attribution model

Admin to Attribution Settings. This is where the silent killer usually lives.

• Current reporting attribution model. Google flipped the default to "data-driven" for most accounts in late 2023. See Google's official attribution model documentation for specifics. Many businesses never reviewed the impact.
• Lookback window for acquisition and conversion events. Default is 30 days for acquisition, 90 days for other conversions. Shorter windows undercount assisted conversions.
• Conversion paths report is available in Advertising to Attribution. Review it. If one channel has suddenly dominated or vanished over the last 90 days, something changed.

8. Consent Mode v2 signals

Admin to Data Streams to select stream to "Configure tag settings" to Consent settings. Plus cross-check with GTM:

• ad_storage, ad_user_data, ad_personalization, analytics_storage signals are all being sent. Google's Consent Mode v2 documentation is the source of truth for what each signal controls.
• Default consent state is "denied" for advertising signals (granted for functionality/security). If defaults are "granted", your EU consent setup is leaking denied-consent data as if it were consented.
• Consent updates fire on the user choice. The easiest way to verify: open GTM Preview, accept the cookie banner, and check that a consent update event fires immediately after.
• Modeling threshold. Google only activates modeling above specific daily thresholds. Below them, denied-consent traffic simply does not appear in reports. For more on this, see my Consent Mode v2 implementation guide.

If you are using a cookie banner that was installed before 2024, this section almost certainly has findings.

9. Data retention and sampling

Admin to Data Retention. Verify:

• Event data retention is 14 months, not 2.
• Reset user data on new activity is enabled (extends retention as long as a user keeps engaging).

Sampling is harder to audit from the UI. The tell is when a report shows a yellow warning about sampled data. If sampling is hitting you regularly, the fix is BigQuery: query the raw export and bypass GA4's sampling entirely.

10. BigQuery export parity

This is the most powerful audit step and the one most internal teams skip.

• BigQuery export is enabled for the property. Admin to BigQuery Links. If it is not, enable it today. The free tier covers most SMBs at zero cost.
• For one key event (usually purchase), count the events in both the GA4 interface and BigQuery for the same 7-day window.
• The numbers should match within 1% to 2%. If they differ by more than 5%, something in the pipeline is broken, and the UI number is the suspect one, not the BigQuery number.

If BigQuery export is new to you, start with my GA4 + BigQuery setup guide. The full audit flow assumes you are doing this step.

The silent killers: three audit findings that cost real money

Beyond the checklist, three specific patterns show up often enough that they deserve their own section. Each one has cost clients I worked with five figures before they were caught.

Attribution drift (the "conversions up, revenue flat" paradox)

A client running around 20,000 EUR per month in Google Ads saw "conversions up 15%" in both GA4 and Google Ads reports for Q4 2024. They scaled the winning campaign's budget by 30% based on that number.

Quarterly audit revealed the cause: Google's October 2023 attribution model change was double-counting assisted conversions for one specific brand campaign. The campaign name contained the same keyword as a custom dimension used in GA4's attribution logic. Real incremental conversions were up 4%, not 15%. The budget scale-up was unjustified.

This is not a unique story. Any time GA4 numbers deviate significantly from the CRM or Stripe dashboard, suspect attribution first.

Enhanced measurement false positives

Enhanced measurement fires events automatically for scrolls, outbound clicks, file downloads, and form interactions. Well-intentioned. In practice, I have seen:

• A newsletter signup flagged as a conversion because the form selector also matched the unsubscribe form.
• 80% scroll events firing on infinite-scroll category pages, inflating engagement metrics to meaningless levels.
• Outbound clicks from a support widget being counted as partner referral conversions.

The fix is to audit which automatic events are actually firing, disable the ones you do not need, and exclude misleading selectors from the ones you keep.

Consent Mode v2 misfire

The most expensive finding I make, because the impact is invisible.

A client in Germany had Consent Mode v2 "installed" by their agency in March 2024. The setup was broken: default consent state was "granted", which meant denied-consent users were treated as consented. GDPR-wise, this was the kind of setup that gets flagged by the German DPA and contradicts EDPB guidance on consent.

Worse for the business: when the agency "fixed" the defaults (to "denied"), they did not wire up the modeling signals. Overnight, 40% of the German traffic disappeared from GA4, because modeling was not active. The marketing team thought traffic had collapsed. Spend was cut. It took six weeks to diagnose.

This is why I audit the consent section of every GA4 container, every time.

How often should you audit GA4?

Three tiers, based on how much rides on the numbers:

• Annually: the absolute minimum. Anything less and you will go more than a year operating on broken data. Appropriate if GA4 is a low-stakes reference for an early-stage business.
• Quarterly: recommended for any business that makes significant marketing or product decisions from GA4. Catches most drift before it compounds.
• Monthly: required for businesses spending 5,000 EUR or more per month on paid ads through GA4. At that spend level, one quarter of wrong conversion data costs more than a year of monthly monitoring.

The point is cadence, not perfection. A short monthly check that catches drift in its first week is worth more than an exhaustive annual review that confirms the last nine months of data were wrong.

DIY audit versus monthly retainer: the honest trade-off

I am going to be direct about this, because nobody else in the top 10 search results will.

DIY cost: 4 to 6 focused hours of a senior analyst or marketing engineer, once per quarter. That is 16 to 24 hours per year. At a typical senior marketer's fully loaded cost (60 to 90 EUR per hour in Western Europe), that is 1,000 to 2,000 EUR per year of internal time.

Retainer cost: GA4 Monitoring & Config is 150 EUR per month. That is 1,800 EUR per year, plus one hour of config changes included each month.

Read that again. The all-in cost is nearly identical. The difference is where the work lands.

DIY wins when: you have a senior analyst on staff with at least four focused hours per week, who genuinely enjoys audit work and will not get pulled onto something else mid-checklist. You also keep trusting your own conclusions when something looks wrong.

Retainer wins when: your senior analyst's time is worth more spent on strategy, not settings. Or you do not have a senior analyst. Or you are an agency that wants to subcontract the audit layer to a neutral third party. Or you just want the answer in your inbox once a month without scheduling it yourself.

There is also a middle path: do the DIY audit annually to build the muscle, and pay for monthly monitoring in between. That is genuinely the best value if you can afford both.

Your marketing agency cannot audit your GA4 and give you an unbiased answer. They run the campaigns the GA4 reports measure. That is the definition of a conflict of interest, and no serious internal auditor would sign off on it. If you currently get your GA4 audit from the same agency that manages your ad spend, that is the first thing to fix. Independent agency oversight exists specifically for this.

Frequently asked questions

Is a GA4 audit the same as a Google Analytics audit?

Yes, in current usage. Universal Analytics was sunset in July 2023, so "Google Analytics audit" almost always means GA4 today. If anyone quotes you a "Google Analytics audit" in 2026 and the deliverable mentions Universal Analytics, walk away.

Do I need a GA4 audit if I already have Google Tag Assistant?

No. Tag Assistant verifies that tags fire. A GA4 audit verifies that the fired tags are producing accurate, correctly-attributed data in reports. Tag Assistant is a 10% subset of a real audit.

Can my marketing agency audit my GA4?

They can, but they will not give you an unbiased result. The agency that runs your campaigns has every incentive to not find problems, because problems usually trace back to setup choices made by the agency. Hire independently, or do it in-house.

How long does a GA4 audit take?

Four to six hours for a standard ecommerce or SaaS property, if all access is ready. Longer if BigQuery export is not already wired up. The 10-point checklist above is the structure I work through.

What is the cheapest way to audit GA4?

Do it yourself, using this checklist. The only tools you need are GA4 DebugView (free), GTM Preview (free), and BigQuery (free tier covers most SMBs). Budget a focused day.

Do you offer a free GA4 audit?

Not directly, but I do offer a free automated GTM audit that covers the GTM-side of the pipeline in 10 minutes. For a full GA4 audit, the paid GA4 Monitoring retainer starts at 150 EUR per month and includes it.

Next step: start with the free GTM scan, then decide

If you are not sure where your tracking stands, start with the free automated GTM audit. It is a 30-second submission, 10-minute results, zero signup. It scans the GTM side of the pipeline (tags, triggers, consent setup) and gives you a concrete starting point.

If you already know your GA4 needs a full review, the GA4 Monitoring & Config retainer is 150 EUR per month. Month one includes a full GA4 audit. Every month after catches drift before it compounds. Written report, no calls.

If you spend 5,000 EUR or more per month on paid ads, consider Full Monitoring at 400 EUR per month: GTM + GA4 + independent agency oversight. Across those three, the amount of broken tracking one of them catches is what makes the math work.

Either way, do not keep optimizing against contaminated data. Every month without a GA4 audit is another month of decisions made against numbers nobody verified. The longer it drifts, the more expensive the eventual fix.