An afternoon is all you need to run a meaningful Google Analytics 4 audit, provided you go in with a clear checklist and a focused plan. GA4’s event-driven architecture, freeform data model, and migration from Universal Analytics left many teams with incomplete setups, stray events, misconfigured conversions, and reports that simply cannot be trusted for decision-making. This guide walks through every major area of a GA4 audit in the order a real practitioner would tackle them, from property-level settings through to the quality of your reports and the integrity of your data streams. By the time you close the final browser tab, you will know exactly what is working, what is broken, and what needs fixing before you make your next strategic call.

At We Define Net, we run GA4 audits as a standard part of our search engine optimization onboarding and analytics setup engagements. We have seen every flavour of misconfiguration, from duplicate data streams to events firing with blank parameter values to conversion goals that never actually recorded a single completion. The checklist below is drawn from those real-world experiences and designed to be actionable without requiring a paid tool or a developer sitting beside you.

Why a GA4 audit is not optional

GA4 replaced Universal Analytics with a fundamentally different data model. Where UA counted sessions and pageviews as its core currency, GA4 counts events and user properties. That shift is powerful, but it also means that configurations that were straightforward in UA, setting up goals, building funnels, understanding traffic sources, now require deliberate setup and ongoing verification. A GA4 property that was never properly audited after migration will be accumulating inaccurate data, and by the time you notice the discrepancy, the damage to your reporting and your decisions is already done.

Common symptoms of an unaudited GA4 property include traffic spikes that make no sense, bounce rates that sit at unusual values, conversions that appear in reports but not in your CRM, events that fire on every single page load instead of only where intended, and referral traffic from your own domain appearing as a separate channel. Each of these issues is solvable, but none of them solves itself. A structured afternoon audit catches them early.

Before you start: audit prep and access checklist

Audit preparation matters more than most people realise. You cannot properly evaluate a GA4 property without the right level of access, and scrambling for permissions halfway through the audit wastes the kind of time you are trying to save. Before opening a single report, confirm that you have Editor or Administrator role at the property level. Viewer access is enough to read reports but not enough to check configuration, fix settings, or verify data stream details. If you are auditing a client property or a property managed by another team, request the appropriate access a day in advance.

Open a blank document or a project management board and create a running list of findings. Label each item by severity, critical, moderate, or low, so that when you finish the audit you can hand off a prioritised action list rather than an undifferentiated wall of issues. This list becomes the working output of your afternoon and the foundation for whatever comes next, whether that is a self-service fix, a conversation with your development team, or a brief to an agency like ours for a deeper implementation review.

Property and account settings

Start at the top of the GA4 hierarchy. Navigate to Admin and work through the settings in order. Verify that the property name and time zone are correct, a property set to the wrong time zone will shift the timestamps on every report and break day-over-day comparisons. Check that the currency setting matches your primary transaction currency if you have e-commerce tracking enabled, because an incorrect currency setting will produce misleading revenue figures without raising any obvious error.

Scroll down to Data Streams and confirm that every expected stream is present and active. Most properties should have at least a web data stream, and many also have an iOS or Android app stream. If you are auditing a web-only property and see an app stream, that may be a leftover from development or from a previous team member’s setup. Conversely, if your site is responsive and you expected a mobile web stream but only see a desktop one, that discrepancy warrants investigation. Each stream should show a recent measurement protocol hit count, which confirms the stream is actively receiving data. If a stream shows zero hits over a meaningful period, either the tag is not installed or it is installed on pages that receive no traffic.

Within each data stream, open the Configuration section and review the enhanced measurement settings. Enhanced measurement automatically tracks page views, scrolls, outbound clicks, site search, video engagement, and file downloads. This is convenient, but it can also produce duplicate events if you have a Google Tag Manager container that fires the same events manually. Check whether your team has custom event tags in GTM that overlap with enhanced measurement events. If they do, disable enhanced measurement for those specific event types to avoid double-counting.

Events and conversions

Events are the atomic unit of GA4 data, and this section of the audit demands the most hands-on verification. Start in Admin under Events, where you will see a list of all events currently recorded for the property. Review the list for events that should not exist, automated events like session_start or first_visit are normal, but you may also find events fired by third-party scripts, leftover test events from development, or events with names that suggest a misconfiguration such as a generic “click” event instead of a descriptive “download_whitepaper_click.”

For each event you expect to see, open the Event card and examine the parameter list. GA4 allows up to 25 custom parameters per event, and well-configured events carry useful parameters that enrich analysis. A “form_submit” event should include a form_name parameter. A “product_add_to_cart” event should include item_id and value. If your events carry no custom parameters beyond the default ones, they are technically working but they are leaving analytical value on the table.

Conversions are events that GA4 counts as goals. Every conversion event should represent a genuine business outcome, a purchase, a lead form submission, a phone call, a content download. In Admin under Events, toggle each event’s Mark as conversion switch on and off while thinking carefully about whether it truly represents a completed conversion. A common mistake is marking “view_item” or “add_to_cart” as conversions because they indicate commercial intent, but counting every product view as a conversion inflates your conversion count and distorts your conversion rate calculations. True conversions should require a clear, final action from the user.

Verify that your conversion events are actually firing by checking the Events report in the Reports section over the last 30 days. If you have a “contact_form_submit” conversion marked as active but the event shows zero occurrences, either the event is broken or the conversion label was applied to the wrong event. Cross-reference with Google Tag Manager preview mode or the DebugView report in GA4 to confirm real-time firing behaviour.

Traffic acquisition and source attribution

GA4’s traffic acquisition report uses a different dimension structure from UA. Where UA had Channel Grouping as a default dimension, GA4 uses Session default channel grouping, which categorises traffic into organic search, paid search, organic social, paid social, email, direct, referral, and other buckets. Open the Traffic acquisition report and scan for anomalies. Direct traffic that is consistently higher than you expect often indicates untagged email campaigns, improperly tagged paid social posts, or traffic from apps that do not pass referrer data.

Referral traffic from your own domain is a well-known GA4 issue. If sessions from your own website appear as a referral source, it usually means that cross-domain tracking is not configured between properties or subdomains that should be treated as a single site. Check whether your property has a primary domain and one or more additional domains listed in the Admin under Data Streams, then Web Stream, then More tagging settings, then Configure your domains. If you operate multiple domains that should be treated as one user journey, add them here.

UTM parameter hygiene is another area that deteriorates silently over time. Search for common UTM mistakes in your traffic acquisition report: inconsistent casing in campaign names (which GA4 treats as separate campaigns), spaces in place of dashes in campaign names, missing utm_source values, and paid traffic that has fallen into the organic channel because the UTM parameters were not applied. A quick scan of your top campaigns over the last 90 days will reveal the most obvious tagging problems.

User behaviour and engagement metrics

GA4 measures engagement differently from UA. In GA4, an engaged session lasts longer than 10 seconds, has at least one conversion event, or has at least two page views or screen views. This means that engagement metrics are directly tied to your event setup. If your events are not firing correctly, your engaged session rate will be misleading.

Open the Pages and screens report in the Reports section. Look for pages that should exist but do not appear, which can indicate a tracking code issue on those specific templates. Look for pages with suspiciously high engagement times, if a static contact page is showing average engagement times of 15 minutes, that usually signals a timer-based event that is not being reset properly when users leave the page.

The Events report gives you a ranked list of all events by total count. Scan this list for events that are firing far more often than expected. A “file_download” event that fires on every page view instead of only on file links is a classic symptom of an overly broad click trigger in GTM. Similarly, a “scroll” event that fires once per page is normal, but one that fires dozens of times per session suggests the trigger is firing on every scroll tick rather than on the 90-percent-depth threshold.

Cross-reference your behaviour reports with your server logs or CMS analytics if available. Discrepancies between GA4 pageview counts and your actual server request logs are normal to a small degree, but a gap of more than 10 to 15 percent is worth investigating. Large discrepancies often point to ad blockers, consent mode configurations that suppress tracking for users who decline cookies, or pages where the GA4 tag is not firing at all.

Audiences and user segmentation

GA4 audiences are conditions-based groups of users that you build in the Admin section under Configure, then Audiences. They are used for remarketing in Google Ads, for segmentation in exploration reports, and as the basis for targeted analysis. During your audit, review every audience definition for logical errors.

A common issue is audiences that use conditions that are too broad. An audience defined as “users who viewed any page” is technically valid but functionally useless for segmentation. More problematic are audiences that use mutually exclusive conditions, such as “users who purchased” combined with “users who did not purchase,” which creates an audience that can never contain any members. Check each audience’s estimated member count in the Audiences overview. Audiences with unexpectedly large or zero member counts warrant closer inspection.

If you have connected GA4 audiences to Google Ads for remarketing campaigns, verify that the audience list names in GA4 match the audience names you are targeting in Google Ads. A mismatch between the two platforms is a frequent cause of campaigns running with zero reach because the audience ID in Google Ads points to a different audience definition than the one you intended to use. If you need a more strong integration between your analytics, advertising, and website development stack, that is an area where our team routinely supports clients.

Reports and explorations

The Reports section in GA4 comes with a default set of reports under Life cycle and User, and you may have added custom reports or explorations. Review each default report to confirm that the metrics and dimensions make sense for your business. The Life cycle, Monetisation reports are essential for e-commerce properties. The Life cycle, Acquisition reports are essential for content properties. If you run a lead-generation business and the default reports are emphasising e-commerce metrics that are irrelevant to your model, consider whether your reports need customisation.

Explorations are GA4’s equivalent of UA’s custom reports and advanced segments. Open each exploration you or your team has created and verify that the date range, dimensions, and filters are configured correctly. A frequent mistake in explorations is applying a filter on a dimension that does not exist for the selected metric, which causes GA4 to silently drop rows and produce incomplete results. Check the row counts at the bottom of the exploration table. If the row count is lower than you expect, examine your filters carefully.

Google Ads and advertising platform connections

If your GA4 property is linked to Google Ads, open the Admin section under Product Links, then Google Ads links, and review each linked account. Confirm that the linking was performed by an authorised user and that the Google Ads account is the correct one, it is surprisingly common for properties to be linked to a test or personal Google Ads account rather than the main business account. When the wrong account is linked, advertising data flows into the wrong campaign reports and your attribution modelling becomes unreliable.

Check whether auto-tagging is enabled in the linked Google Ads accounts. Auto-tagging appends a gclid parameter to every ad click, which GA4 uses to attribute sessions to Google Ads campaigns automatically. Without auto-tagging, GA4 relies on manual UTM tagging, and any ad clicks that arrive without UTM parameters will be misattributed. If auto-tagging is not enabled in Google Ads, enable it and verify that the gclid parameter is being captured in your sessions.

If you run advertising on platforms other than Google, Meta, LinkedIn, TikTok, or others, confirm that each platform has appropriate UTM tagging applied to its campaign URLs. GA4 does not automatically import data from non-Google ad platforms, so the quality of your cross-channel attribution depends entirely on consistent UTM tagging. Use the Traffic acquisition report with Session source / medium as the primary dimension to verify that campaigns from each platform are arriving with the expected source and medium values.

Consent mode and privacy compliance

Consent mode is GA4’s framework for adjusting tracking behaviour based on a user’s cookie consent choices. It is relevant if you operate in a jurisdiction covered by the GDPR, the ePrivacy Directive, or similar privacy regulations, or if you simply want to offer users a consent choice regardless of legal requirement. Open your site in an incognito window, decline all cookies in the consent banner, and then check DebugView in GA4 to see whether any hits are being sent. If hits continue to fire after consent is declined, your consent mode implementation is either absent or misconfigured.

Proper consent mode implementation requires that you set the consent parameters, ad_storage, analytics_storage, and optionally functionality_storage and security_storage, before the GA4 configuration tag fires. If your consent banner loads after the GA4 tag has already executed, the tag will fire with default consent granted regardless of the user’s actual choice, which defeats the purpose of the consent banner. Review your tag sequencing in Google Tag Manager or in your site’s source code to confirm that consent parameters are set before any GA4 hits are dispatched.

If you operate a blog or content site that relies on organic traffic from the European Union, consent mode configuration is particularly important because a broken implementation can result in significant data loss from a large user segment. Even for sites without a strict legal obligation, implementing consent mode correctly signals to users and regulators that you take privacy seriously.

Technical configuration and data quality

Data quality in GA4 is influenced by several technical factors. Start with the data filters in Admin under Data Settings, then Data Filters. Review each filter and confirm that it is doing what you expect. The internal traffic filter should be active if you have correctly configured internal traffic rules under Data Streams, then Web Stream, then Configure tag settings, then Define internal traffic. Test filters should be active during development but inactive for production data. If your test filter is active in production, you may be excluding legitimate test transactions that are actually real user activity from analytics agencies or quality assurance teams.

Bot filtering in GA4 is enabled at the property level under Data Settings, then Data Filters, then Bot Filtering. Unlike UA, where bot filtering was a simple toggle, GA4’s bot filtering relies on the IAB International Spiders and Bots list. Enable this filter unless you have a specific reason not to, because bot traffic inflates session counts, distorts engagement metrics, and pollutes your conversion data.

Session timeout settings affect how GA4 groups events into sessions. The default timeout is 30 minutes of inactivity, but this can be adjusted under Admin, then Data Streams, then Web Stream, then More tagging settings. If your property has a custom session timeout that does not match how users actually behave on your site, your session counts will be inaccurate. A site with long-form content where users spend 45 minutes reading a single article will undercount sessions if the timeout is set to 30 minutes. A site with rapid navigation between short pages will overcount sessions if the timeout is set to an unusually high value.

Cross-domain measurement, as mentioned earlier, should be configured for every property that operates across multiple domains. Without it, a user who arrives on domain-a.com and then navigates to domain-b.com to complete a purchase will be counted as two separate users in GA4, which understates your conversion rate and overstates your user count. Verify cross-domain measurement in the same Configure your domains area mentioned in the traffic acquisition section above.

Sample GA4 audit checklist

The following table summarises the key checks covered in this guide. Use it as a one-page reference during your audit session and tick each item as you verify it.

What to do with your audit findings

A GA4 audit produces a list of findings, but the value of the audit depends entirely on what happens next. Critical issues, such as a data stream not receiving hits, conversion events that are not firing, or cross-domain tracking that is absent, should be escalated immediately because they compromise the integrity of your data. Moderate issues, such as missing custom parameters on events or inconsistent UTM tagging, should be added to your team’s implementation backlog with clear descriptions and prioritisation. Low-priority items, such as unused audiences or legacy events from a previous tracking setup, can be addressed during a quarterly maintenance cycle.

If your audit reveals gaps that your in-house team does not have the bandwidth or technical expertise to resolve, that is exactly where a specialist partner can help. Our content writing team can help you document your analytics requirements, and our broader analytics and implementation practice can close the technical gaps the audit surfaces. The goal is not a perfect audit score on paper, it is a tracking setup that produces data you can trust for the decisions that follow.

Building a repeatable audit rhythm

One afternoon audit will bring your GA4 property to a healthy state, but GA4 is not a set-it-and-forget-it platform. New marketing campaigns, website redesigns, tag management changes, and app updates all carry the risk of breaking tracking. Schedule a light-touch GA4 review every quarter. A quarterly review does not need to be as thorough as the initial audit. Focus on whether new events are being captured correctly, whether new campaigns are tagged properly, and whether the reports you rely on are still producing sensible numbers. Catching small drift early prevents it from compounding into the kind of data quality problem that requires a full re-implementation to fix.

If you are working with a website development team on a site rebuild or migration, build a GA4 pre-launch checklist into your project plan. The checklist should include verification that the GA4 tag is present on every page template, that custom events fire correctly on the new page structures, that enhanced measurement settings are appropriate for the new design, and that e-commerce or lead-tracking events are connected to the correct forms and checkout flows. A website that launches without a verified tracking setup launches with one hand tied behind its analytics.

Frequently asked questions

How long does a GA4 audit actually take?

A thorough audit of a standard business website with a web data stream, a handful of custom events, and Google Ads integration can be completed in an afternoon by someone who is familiar with the GA4 interface. Properties with multiple data streams, complex e-commerce tracking, or custom dimensions and metrics will take longer. Plan for two to three hours for a typical B2B or e-commerce property and four hours or more for a property with multi-domain tracking, app streams, and extensive custom event configurations. The time investment pays for itself quickly by preventing decisions based on flawed data.

What is the difference between DebugView and real-time reports for checking event firing?

DebugView in GA4 shows you events as they fire in real time, with full parameter details, when you have the DebugView enabled through Google Tag Manager preview mode or the GA4 Debugger Chrome extension. The real-time reports in the Reports section show a simplified, delayed view of active users and events over the last 30 minutes. DebugView is the right tool for verifying that a specific event fires with the correct parameters when you trigger it, while the real-time reports are useful for confirming that traffic is arriving and that the property is generally healthy. Use DebugView for the detailed event verification work and real-time reports as a quick sanity check.

Can I audit GA4 without Google Tag Manager access?

You can audit most of the GA4 property configuration, event definitions, conversions, audiences, data filters, and reports without GTM access. Those areas live entirely within the GA4 interface and are accessible to anyone with Editor or Admin role on the property. However, you cannot verify whether your GTM container has duplicate or conflicting tags, whether trigger configurations match your intended event setup, or whether the GA4 configuration tag itself has the correct settings without accessing GTM. If GTM is your tag management solution, request at least Read access to the container alongside your GA4 property access for a complete audit.

My GA4 property shows far more users than my old Universal Analytics property. Is this normal?

Yes, this is one of the most common observations after migrating from UA to GA4, and it is normal. GA4 counts users using a different methodology from UA. Where UA primarily counted sessions and de-duplicated users based on cookies with a 30-minute timeout, GA4 uses a combination of cookie-based user IDs and modelling to estimate unique users across devices and browsers. GA4’s user count is often higher because it can identify returning users that UA treated as new sessions. If the gap between your GA4 and UA user counts is extremely large, many times higher rather than moderately higher, it is worth checking whether the GA4 configuration tag is firing on pages where it should not, which would inflate the user count artificially.

How do I know if my conversion tracking is accurate?

The simplest verification method is to trigger a conversion yourself and watch for it in DebugView. Navigate to the page where the conversion event is supposed to fire, complete the action, submit a test form, click a test download link, complete a test transaction, and confirm that the corresponding event appears in DebugView with the correct parameters. Then check the Conversions report for the same day to confirm that the event is being counted. A more rigorous approach is to compare your GA4 conversion count against your CRM or e-commerce platform’s recorded completions over the same period. If the numbers are in the same ballpark, your conversion tracking is likely accurate enough for decision-making. A persistent gap of more than a small percentage warrants investigation into whether the event is failing to fire on certain user paths or browser configurations.

Should I bring in outside help for my GA4 audit?

An internal team member who is comfortable navigating GA4 and has access to both the analytics property and the tag management system can conduct a solid audit independently. Outside help becomes valuable when your property has complex multi-domain tracking, extensive custom dimensions and metrics, e-commerce implementations with enhanced measurement and product-level events, or when your team lacks someone with dedicated analytics experience. At We Define Net, we regularly support businesses through initial GA4 audits and the implementation work that follows. An outside pair of eyes also brings perspective from across industries, which often reveals issues that internal teams, working close to the setup, have stopped noticing.

At We Define Net, we specialise in analytics audits, tracking implementation, and the broader digital marketing stack, search engine optimization, paid advertising, social media marketing, website development, content, design, and brand strategy. If your GA4 audit has surfaced gaps you want a second pair of eyes on, or if you need help turning audit findings into a working implementation, reach out to us at info@wedefinenet.com or call +91 63824 32453 / +91 63816 32453. We would be glad to talk through where your analytics setup stands and what a realistic path forward looks like.