Google Analytics Audit: How to Audit GA4 Step by Step (2026).

You launch a big campaign. Traffic spikes, you feel good about it — then a week later GA4 shows the conversions never recorded. One broken tag quietly torched weeks of budget, and now you can't tell which half of your spend actually worked.

This isn't hypothetical. It happens constantly. In most real-world GA4 setups we see, at least one critical misconfiguration is silently corrupting the data — and GA4 never warns you. It just keeps collecting wrong numbers with total confidence.

Bad data stays invisible until it's expensive. GA4 is powerful but hard to configure correctly out of the box, and small mistakes compound. Leave data retention at the default 2 months instead of 14 and you lose historical insight for good. A duplicate tag doubles your reported revenue. A missing consent banner becomes GDPR fines across the EU.

A GA4 audit — sometimes just called a Google Analytics audit — catches those mistakes before they cost you. It protects your marketing spend, your attribution model, and your ability to trust what the reports say.

What is a GA4 Audit (And Why Does It Matter)?

A GA4 audit is a systematic review of how your Google Analytics 4 property collects, processes, and stores data — and whether the numbers in your reports actually reflect what your users did. It goes past "yes, traffic is recording" to check the configuration underneath: the admin settings, the tags, and the events that decide whether your data is trustworthy.

A proper GA4 audit tool must interface with Google Tag Manager (GTM) to verify the implementation side. If your GTM container is firing duplicate tags, GA4 will record double the revenue. If your event naming is inconsistent, your audience segments will be meaningless. If your conversion scopes are misaligned, your ROAS calculations will be wildly off.

Often, teams conflate a basic Google Analytics 4 check with a true audit. A real audit covers three layers:

• Configuration layer — Admin settings, data retention, data filters, user permissions
• Implementation layer — GTM tags, events, triggers, and their firing conditions
• Data integrity layer — Are the numbers consistent? Are conversions firing correctly? Does sampled data match raw data?

The 3 Most Common GA4 Configuration Errors

Across real-world GA4 setups, a few failure points show up over and over. These three account for the majority of silent data corruption we see:

1. The Data Retention Trap

By default, Google Analytics 4 only stores user-level data for 2 months and event-level data for 14 months. If you don't manually change the user-level retention to 14 months in the Admin panel under "Data Settings > Data Retention," you lose the ability to do any lookback analysis on user journeys that exceed 60 days.

This matters most for businesses with long sales cycles — B2B, high-ticket e-commerce, SaaS. If your average time from first touch to conversion is 45 days, and a user visits on day 1 but converts on day 70, you'll never see that conversion attributed correctly without extended data retention.

Fix: GA4 Admin → Data Settings → Data Retention → set to 14 months. Do this before launching any paid campaign.

2. Missing Cross-Domain Measurement

Do your users move from your main site to a separate checkout portal (like Shopify, WooCommerce, or Stripe)? Without explicit cross-domain tracking setup, one user looks like two separate people in GA4 — completely breaking your attribution model and making funnel analysis useless.

Cross-domain tracking needs to be configured in two places: the GA4 configuration tag (under "Configure your domain" in settings) and any GTM triggers that reference the destination domain. If you're using a subdomain for a cart or login, that's also a cross-domain scenario that needs explicit configuration.

Fix: GA4 Admin → Data Streams → Select your web stream → Configure tag settings → Configure your domains. Add all domains that share user sessions (e.g., yourstore.com and checkout.yourstore.com). In GTM, ensure your pageview trigger fires on all relevant domains.

3. Unwanted Referrals Breaking Your Sessions

If payment gateways like paypal.com, stripe.com, or braintree.com show up as your top referring traffic sources, your sessions are breaking during checkout. Here's what happens: a user lands on your site, clicks "Checkout," gets redirected to Stripe, and then — because Stripe isn't in your referral exclusion list — GA4 starts a new session. Now one purchase appears as two sessions from two different sources.

This inflates your session count, makes your traffic sources look wrong, and corrupts any source/medium analysis you do.

Fix: GA4 Admin → Data Streams → Configure tag settings → List Unwanted Referrals. Add paypal.com, stripe.com, braintree.com, and any other payment processor domains you use.

The Complete GA4 Audit Checklist (Step by Step)

If you're doing this manually, here's the full sequence. Each step corresponds to a configuration area that, if broken, silently corrupts your data. For a printable version you can work through property by property, use the GA4 audit checklist:

Step 1: Verify Your Data Streams

Check that you only have one web data stream per domain. Multiple GA4 tags firing on the same page (from duplicate GTM container copies, hardcoded tags, or CMS plugins) will double-count everything. Go to GA4 Admin → Data Streams and review each stream's tag setup instruction. Cross-reference with GTM to ensure only one container is firing.

Step 2: Check Your Event Naming Consistency

GA4's strength is its event-based model, but only if your events are named consistently. Audit your top 10 events in the GA4 Realtime report and the Events dashboard. Look for: typos in event names (e.g., "page_view" and "pageview" coexisting), events with the same name but different parameter structures, and deprecated events still firing. Inconsistent naming means your audiences, conversion events, and custom reports are built on sand.

Step 3: Validate Your Conversion Events

Go to GA4 Admin → Events and mark the events that represent true conversions (purchase, lead, signup, form_submit). For each one, check: Is the scope correct (is it firing on the right page)? Is it deduplicated (you don't want two purchase events per order)? Is the value populated correctly? A common mistake is marking a "view_item" event as a conversion instead of "purchase" — this makes your conversion rate look 10x higher than it actually is.

Step 4: Audit User Permissions

GA4 Admin → Account Settings → Account Access Management. Look for: accounts with Edit access that shouldn't have it (ex-employees, agency accounts on personal emails), missing Read & Analyze access for your data team, and any accounts you don't recognize. Orphaned access is a security risk and a data privacy liability under GDPR.

Step 5: Check Data Filters

GA4 Admin → Data Settings → Data Filters. If you have any active filters, understand exactly what they do. Internal traffic filters (filtering out your company's IP or domain) are common and fine — but a misconfigured filter that strips out organic traffic will make your SEO look dead. Review any "Exclude" or "Modify" filters carefully before they process data, not after.

Step 6: Verify Attribution Settings

GA4 Admin → Attribution Settings. GA4 defaults to data-driven attribution, which is good — but verify your conversion windows are set correctly for your business cycle. If you're in B2B with a 90-day cycle, the default 28-day window will misattribute a significant portion of conversions. Also check which events are included in your attribution model (not all events should be treated equally as conversions).

Step 7: Check Consent Mode V2 Compliance

If you're operating in the EU or targeting EU users, you need Google Consent Mode V2 configured. This means your GTM tags must fire based on consent state signals from your cookie banner. A GA4 audit tool should check whether Consent Mode is implemented and whether the "ad_storage" and "analytics_storage" parameters are being set correctly. Without this, you're either violating GDPR or getting incomplete data — or both.

Step 8: Cross-Domain and Subdomain Tracking

As covered above, but double-check: GA4 Admin → Data Streams → Configure tag settings → Configure your domains. List every domain and subdomain where a user session should remain continuous. Then verify in your GTM that your pageview trigger fires on all those domains — not just your primary domain.

The Faster Way: Using an Automated GA4 Audit Tool

You can spend four hours digging through Admin settings, DebugView, and Tag Assistant for every item above. Or you can accelerate the process.

Using a dedicated GA4 Audit Tool like NiceLookingData transforms a grueling manual process into a 60-second checkup. Our free auditor scans 61 vital configuration signals — from Content Security Policy headers that block the GA4 tag entirely, to cross-domain configuration gaps, to missing referral exclusions — and delivers a plain-English severity score for each issue found.

The audit itself is read-only — we never modify your configuration during a scan. We just read what's there and surface what needs attention. If you later apply one of the GTM fixes, it always lands in a shadow workspace + version for your review; the live container only changes when you publish. Run the audit before any major campaign launch, quarterly as a health check, or after any significant GTM or website changes.

Stop guessing about your web analytics data. Your reporting is only as good as the foundation it's built on. A 60-second automated audit is far cheaper than a week of decisions made on broken data.

When Should You Run a GA4 Audit?

There is no bad time to audit GA4 — but there are five moments when running one is especially important. Miss these windows and you will likely discover the data problem weeks later, after it has already shaped decisions.

Before Any Major Campaign Launch

The worst time to discover your conversion tracking is broken is three days into a paid media push. Audit before you switch on spend. Verify conversion events fire correctly, referral exclusions cover your payment providers, and your attribution window matches your business cycle. An hour of pre-launch checks protects the entire campaign budget.

After Any GTM Change

Every GTM publish is a potential regression. A new tag, a modified trigger, a container migration — any of these can accidentally introduce duplicate event firing or break existing conversion events. Run a post-publish audit as a matter of routine. It does not need to be exhaustive; a focused check on event counts and conversion behavior catches most regressions within minutes.

Quarterly as a Routine Health Check

GA4 properties drift. User permissions accumulate. Data filters get added and forgotten. Attribution settings go stale as sales cycles evolve. A quarterly audit keeps the property honest. Even if nothing broke, the exercise surfaces gradual configuration creep before it hardens into structural data problems.

After Switching Payment Providers or Checkout Platforms

Migrating from Stripe to Adyen, or switching from a native checkout to Shopify — both introduce new redirect domains that break session continuity unless you update your referral exclusion list and cross-domain tracking configuration. The change itself is simple; forgetting to make it means every transaction will look like it came from the payment provider rather than your actual traffic sources.

After GA4 Admin Changes

Someone resets the data retention to 2 months. An agency adds a new data filter with inverted logic. A user inherits Admin access after a team change. GA4 does not notify you when these things happen. If more than one person has Edit-level access to your property, audit the admin configuration regularly — the silent changes are the ones that compound.

Frequently Asked Questions

What is included in a GA4 audit?

A thorough GA4 audit covers three layers: configuration (admin settings, data retention, user permissions, data filters, attribution windows), implementation (GTM tags, event naming, conversion scopes, consent mode setup), and data integrity (duplicate events, referral exclusions, cross-domain tracking). Enterprise-grade tools like NiceLookingData check all three layers automatically, surfacing issues by severity so you know what to fix first.

How long does a GA4 audit take?

Manually, a comprehensive audit of a single GA4 property takes two to four hours — longer if GTM needs checking too. An automated GA4 audit tool completes the same checks in under 60 seconds by reading your configuration via the Google Analytics Admin API and GTM API directly. The human time cost shifts from the audit itself to reviewing findings and prioritizing fixes.

Is GA4 audit free?

NiceLookingData offers a free GA4 audit that covers the core configuration and implementation checks. The free audit does not require a credit card. More advanced features — AI-generated action plans, GTM 1-click fixes, audit history, and scheduled monitoring — are available on paid tiers. For most teams running a one-off check, the free audit is sufficient to identify the critical issues.

What is the difference between a GA4 audit and a GA4 health check?

The terms are often used interchangeably, but there is a useful distinction. A health check tends to be a surface-level pass — is the tag firing, are events recording, are conversions showing up? An audit goes deeper into the configuration underneath: are settings correctly calibrated, are there security or governance issues, does the implementation reflect how the business actually works? NiceLookingData is built for the audit definition — it checks configuration correctness, not just presence.

How often should you audit GA4?

At minimum, quarterly. In practice: before major campaigns, after any GTM publish, and after any admin change that affects filters, attribution, or user permissions. Teams running paid media benefit from monthly audits — the cost of catching a broken conversion tag on day 30 rather than day 1 is measured in wasted ad spend.

What are the most common GA4 issues?

The common GA4 misconfigurations that appear most consistently across real-world properties are: data retention left at the default 2-month setting; missing referral exclusions for payment processors causing session breaks; duplicate GA4 tags firing from both GTM and a hardcoded snippet; cross-domain tracking not configured for checkout subdomains; Consent Mode V2 not implemented despite EU traffic; and conversion events scoped incorrectly so they fire on the wrong page or fire multiple times per transaction.

Can I audit GA4 without GTM access?

Yes. The GA4 Admin API gives access to configuration, events, user permissions, data filters, and attribution settings independently of GTM. NiceLookingData can audit a GA4 property without a paired GTM container. However, implementation-layer checks — duplicate tag detection, consent mode tag verification, trigger-level event validation — require GTM access. Connecting both gives you the full picture; GA4-only still surfaces most critical configuration issues.

What does a GA4 score mean?

NiceLookingData calculates a weighted score across five audit chapters: Foundation, Accuracy, Measurement, Compliance, and Optimization. Each chapter has a weight reflecting how severely misconfiguration affects data quality. A score above 80 indicates a well-configured property. Between 50 and 80, there are meaningful issues that should be addressed. Below 50, the property has critical misconfigurations that are actively corrupting data or creating legal exposure. The score is a diagnostic starting point, not a grade — the check details tell you exactly what to fix and in what order.