How to Audit Google Analytics 4: A Step-by-Step Walkthrough

Quick answer: A GA4 audit is a four-phase process — prep, configuration review, data review, and reporting. Most teams skip the prep and reporting phases, which is why their audits don't actually lead to fixes. This walkthrough covers each phase in order, with the specific screens to open and the questions to answer at each step.

If you want a checklist of what to look at, see our 25-point GA4 audit checklist. This post is about how to actually run the audit — the workflow, the tools, and how to turn findings into a fix plan.

Phase 1: Prep

The most common reason a GA4 audit ends up sitting in a doc nobody reads: it wasn't scoped properly at the start. Spend 30 minutes on prep — it's the highest-ROI part of the audit.

Get the right access

You need at least Viewer access on the GA4 property, but for a full audit you want Editor (so you can read admin settings, custom definitions, and product links). If you only have Viewer, half the audit items below will be invisible to you.

For GTM, you need Read on the container at minimum, Edit to inspect variable values and triggers safely. Confirm access on day one — chasing permissions mid-audit kills momentum.

Scope the audit

Decide upfront whether you're auditing:

• A single property — the most common case. Allow 4–8 hours of work.
• A multi-property setup — e.g. one property per brand or region. Each adds 2–4 hours.
• The full measurement stack — GA4 + GTM + CMP + Search Console + Google Ads. Allow 1–2 days.

Write the scope down. When the third stakeholder asks "did you check our Looker dashboards too?" you have a documented answer.

Gather context

Ask the team three questions before you open GA4:

• What decisions does this data drive? If it drives bidding, you care about conversion fidelity more than engagement. If it drives content strategy, the inverse.
• Have there been recent changes? A site redesign, CMS migration, new CMP, or GTM container deployment in the last 90 days is almost always implicated in any audit findings.
• Are there known issues? "Numbers don't match Google Ads" or "purchases look doubled" are clues — start by confirming or refuting the suspected cause.

Phase 2: Configuration review

This phase is all in the GA4 admin. Allow 60–90 minutes for a single property.

Property-level settings

Open Admin → Property Settings. Verify time zone and currency match the business. Look at the property creation date — anything younger than 14 months means historical comparisons aren't possible.

Next, Admin → Data Settings → Data Retention. If it says 2 months (the default), flag it. See our deep dive on GA4 data retention for why this single setting breaks most year-over-year analysis.

Admin → Reporting Identity. Note which option is selected — Blended, Observed, or Device-only. Each counts unique users differently; our guide to reporting identity covers when to use which.

Data streams

Admin → Data Streams. Open each stream. Check:

• Measurement ID matches what's deployed on the site (compare with the gtag snippet or GTM tag).
• Enhanced Measurement toggles — confirm each enabled event isn't also being fired manually via GTM.
• Configure Tag Settings → Configure your domains — list every domain involved in the user journey. Missing domains kill cross-domain tracking. See the cross-domain audit for the failure modes.
• Configure Tag Settings → Define Internal Traffic — IP ranges for office and VPN.

Events and conversions

Admin → Events. Look for:

• Duplicate event names caused by case mismatches (Purchase vs purchase).
• Events with very low counts — often custom events that fire only on a forgotten template.

Admin → Key Events. Every entry should be a transactional event (purchase, sign_up, generate_lead), not a page_view. Conversions tied to page_view on a thank-you URL break the moment the URL changes.

Custom definitions and integrations

Admin → Custom Definitions. Cross-reference registered dimensions/metrics against what your events actually send. Common finding: events sending a parameter (plan_tier, account_id) that nobody can break out in reports because it was never registered.

Admin → Product Links. Confirm Google Ads, Search Console, and BigQuery (if used) are all linked and active.

Phase 3: Data review

Configuration tells you what the property should be doing. Data tells you what it actually does.

DebugView walkthrough

Install the GA4 Debugger Chrome extension or add ?debug_mode=1 to your URL. Then open Admin → DebugView. Walk through every major template on the site (home, category, product, cart, checkout, confirmation, blog, search). For each template, verify:

• The page_view event fires exactly once.
• The event includes the expected parameters (page_location, page_title, etc.).
• Any template-specific events fire correctly (view_item on product pages, begin_checkout on checkout, etc.).

If you see two page_view events on the same page, you've found a tracking bug — typically the GA4 config tag and an auto-fired page_view in GTM both firing.

Realtime sanity check

Reports → Realtime. With your DebugView session running, confirm events flow into Realtime within ~30 seconds. If they don't, you have either a tag deployment issue or a consent signal blocking the data.

Conversion fidelity check

Reports → Engagement → Conversions. Pick the previous full day. Compare conversion counts to the source of truth (your order management system, CRM, or payment processor).

Acceptable variance is typically < 5% for ecommerce; anything larger usually traces to either consent loss, double-counting (especially on Shopify), or a conversion mismatch between GA4 and Google Ads.

Channel and attribution check

Reports → Acquisition → Traffic Acquisition. Look for an oversized "Unassigned" or "(direct) / (none)" bucket — both are signs UTM tagging is broken or referrer setup is off. See how to fix unassigned traffic in GA4 for the systematic fix.

Data quality check

Reports → Tech → Country. The distribution should match your business mix. Disproportionate volume from countries you don't serve usually means bot traffic — see the 3-layer fix for bot traffic from China and Singapore.

Also check Reports → Tech → Browser and Device. Anything suspiciously concentrated (e.g. 60% of traffic from a single browser version on a single OS version) is worth investigating.

Phase 4: Reporting & prioritization

An audit isn't useful until findings are documented, prioritized, and assigned. This phase is where most audits fall apart — don't skip it.

Document findings consistently

For each finding, capture:

• What's wrong — one sentence describing the issue.
• Evidence — screenshot, URL, or query that demonstrates it.
• Impact — what data is affected and how.
• Fix — the specific action to take.
• Owner — who should fix it (engineering, marketing, agency).
• Estimated effort — minutes, hours, or days.

A finding without an owner and an effort estimate is a finding that won't get fixed.

Prioritize by impact, not by ease

It's tempting to fix the easy stuff first. Don't. Use a simple impact-vs-effort matrix:

• High impact, low effort → fix this week.
• High impact, high effort → plan into the next sprint.
• Low impact, low effort → batch into a cleanup PR.
• Low impact, high effort → document and revisit in 6 months.

"High impact" means the finding distorts a number that drives a real decision (bidding, budget allocation, product direction). Fix those first.

Re-audit in 90 days

Schedule a follow-up. Tracking issues tend to recur — sites change, containers get updated, new pages get launched without measurement. A quarterly cadence catches regressions before they compound.

Tools you'll need

• GA4 admin access — at least Editor for a full audit.
• GTM access — Read minimum, Edit preferred.
• Tag Assistant Companion Chrome extension — for verifying tag firing.
• GA4 DebugView — Admin → DebugView, paired with ?debug_mode=1 on the page URL.
• Consent Mode debugger — also in Tag Assistant Companion.
• BigQuery (optional but powerful) — for querying raw events when GA4's UI thresholding obscures data. See our thresholding guide.
• Snifflytics — runs most of this checklist automatically in five minutes, with a prioritized fix list at the end.

Frequently asked questions

How long does a full GA4 audit take?

For a single property with no prior audit history, plan on 4–8 hours of focused work plus a couple hours of follow-up to write up findings. Each additional property adds 2–4 hours. The Snifflytics audit covers most of the configuration and data checks in five minutes; the reporting and prioritization phase still needs human judgment.

Should I audit GA4 myself or hire a consultant?

If you have at least one team member who knows GA4, an internal audit is fine for the first pass. Bring in a consultant when (a) you've never done one before and want a benchmark, (b) the property is part of a regulated industry where compliance is non-negotiable, or (c) you suspect a serious data quality issue affecting revenue reporting.

What's the difference between auditing GA4 and auditing GTM?

A GA4 audit looks at what data the property is collecting and how it's configured. A GTM audit looks at the implementation layer — which tags fire, which triggers control them, which variables they read. A complete measurement audit covers both, plus the CMP and any server-side container. Our server-side GTM audit covers the server piece.

Can I audit GA4 without admin access?

Partially. With Viewer access you can verify event volumes, report structures, and data quality. You can't see admin settings (data streams, retention, custom definitions, product links), which means roughly half the audit items are blind to you. Get at least Editor access before starting.

What's the most common audit finding?

Duplicate page_view events caused by both the GA4 config tag and a separate page_view tag firing on the same page load. It inflates session metrics, engagement, and pages-per-session — and almost every GTM-heavy property has it somewhere.

Run the audit automatically

The walkthrough above is the human version. Run a free Snifflytics audit to cover most of phase 2 and phase 3 automatically in about five minutes — you'll get a prioritized list of findings with fix suggestions, so you can spend your time on phase 4 (which a tool can't do for you).