The essentials
- Why: a badly configured GA4 property produces figures that are wrong but plausible. You only notice by holding them up against reality.
- Four parts: basic configuration, collection quality, conversions, access and security.
- Fifteen checks, each with an alert threshold and a fix.
- Frequency: when taking over an account, after every redesign, then once a year.
A GA4 audit answers a simple question: can these figures be trusted? It comes before any budget decision, any presentation to a leadership team and any start of work with an agency. Unlike an SEO audit, it requires no paid tool: everything happens in the admin interface and the Realtime report. Here are the fifteen checks we run, part by part.
Part 1: the basic configuration (checks 1 to 4)
| # | Control | Where to check | Alert if… |
|---|---|---|---|
| 1 | Time zone and currency | Admin > Property details | Anything other than your own zone and currency |
| 2 | Data retention | Data collection and modification > Retention | 2 months instead of 14 |
| 3 | Data streams | Data streams | Several web streams for the same site, or a stream from an old domain |
| 4 | Account ownership | Account access management | No administrator on a company address |
Part 2: the quality of collection (checks 5 to 9)
5. Double tagging
Open a page of the site with the Tag Assistant extension or the browser's Network tab: exactly one collect call to GA4 per pageview. Two calls mean the tag is installed both by the CMS and by Tag Manager: sessions and pageviews are doubled.
6. Internal traffic
Data filters : an "Internal traffic" filter should exist and be active (not just "testing"), with the office IP addresses defined in the stream settings. Check by browsing the site from the office and watching Realtime.
7. Excluded referrers
In Stream settings > Configure tag settings > List unwanted referrals : the payment domains (Stripe, PayPal, and the like) and your own domains. The symptom of an omission: "paypal.com" or "stripe.com" in your traffic sources.
8. Enhanced measurement
Turned on, with the options suited to the site. Alert if form_submit fires hundreds of times a day on a site receiving ten enquiries: the internal search engine is probably being counted as a form.
9. The share of "(not set)" and direct traffic
In Traffic acquisition, more than 10% of sessions showing "(not set)" for the landing page, or more than 40% direct traffic, indicates a problem: a tag loading late, untagged campaigns, consent badly handled. See tagging your campaigns.
Part 3: conversions (checks 10 to 12)
10. The existence and relevance of key events
Admin > Key events : between 1 and 10 marked events, all corresponding to business actions. Alert if the list is empty, or if page_view, scroll or session_start appear in it (an artificial conversion rate). Our guide to conversion tracking explains how to define them.
11. A real-conditions test
Complete each conversion yourself in a private window and check in DebugView that exactly one event fires, with the right parameters (value, currency). For an e-commerce site, compare the number of purchase over the last 30 days with the number of orders in the back office: a gap above 15% signals missing or duplicated transactions (see GA4 and e-commerce).
12. The Google Ads link and conversion import
If you advertise, the property should be linked to Google Ads and your key events imported as conversions. Alert if Google Ads is still optimising on a "click on the site" conversion or on an obsolete UA tag. Guide: connecting GA4 to Google Ads.
Part 4: access, consent, exports (checks 13 to 15)
13. Access management
List the users: former suppliers, ex-employees, personal addresses. Remove anything no longer needed. Two internal administrators at minimum.
14. Consent and Consent Mode
Open the site, refuse cookies, reload: no GA4 call should fire (except the cookieless calls of advanced Consent Mode). In Admin > Consent settings, GA4 should say the consent signals are being received. Details in GA4 and GDPR.
15. The BigQuery export
Optional but recommended: the BigQuery link, free up to a high volume, keeps your raw data beyond the 14 months. Alert if it doesn't exist on a site that relies on its history.
The audit report: what it should contain
A useful audit fits on one page: for each check, the status (compliant, to be fixed, critical), the fix to apply, who owns it and by when. The critical fixes (double tagging, missing conversions, retention set to 2 months) are dealt with within the week; the rest within the month. If you hand this audit to a supplier, insist on that format rather than a thirty-page document; our advice on choosing one is in choosing a GA4 consultant.
How GreenRed helps
Rather than juggling several tools, GreenRed's Traffic module brings these metrics together in a single dashboard, compares them over time and tells you which actions come first. You can try it free, with no card, from the Pricing.
Frequently asked questions
How long does a GA4 audit take?
An hour for the 15 checks on a brochure site, two to three hours for an e-commerce site with transaction verification, half a day if the audit includes Google Tag Manager and consent. Writing the report adds an hour.
What are the most frequent problems in a GA4 account?
In order: data retention left at 2 months, no key events or irrelevant ones, internal traffic not excluded, double tagging after a migration, and access retained by former suppliers. All five are fixed in under an hour.
Do you need a paid tool to audit GA4?
No. The admin interface, the Realtime report, DebugView and the free Tag Assistant extension are enough. Paid tools mainly add continuous monitoring and automatic alerts, useful once the initial audit is done.
How often should you audit a GA4 account?
A full audit when taking over the account, after every site redesign or CMS change, then once a year. Between audits, a monthly check of three metrics (sessions, key events, share of direct traffic) catches most of the drift.