How the audit runs, day by day

Day 0: access

Access is the only thing that gates the clock. You get a checklist immediately after booking, and most teams complete it in about 10 minutes, because every item on it is a read-only grant.

The checklist in full:

• GA4. Viewer or Analyst on the property, plus the property ID.
• Google Tag Manager. Read access on the web container. If a server container exists, read access on that too, along with where it is hosted. Publish access is optional and covered below.
• Google Ads. Read-only access on the account, or on the manager account that owns it.
• Meta. View-level access in Events Manager to the pixel or dataset that records your conversions, and view access on the ad account using it.
• The site. Your production URL, and staging if you have one.
• A way to test a conversion end to end. For ecommerce: a full discount code, a test payment method, or a sandbox order path. For lead generation: the form path and a way to identify test submissions downstream.
• Names of anything else that injects tags. Your consent platform, A/B testing tool, heatmaps, chat widget, affiliate or call tracking.
• One contact for developer questions, plus your release cadence, so fixes do not collide with a deploy.

Nothing on that list allows changes to your accounts. The five day clock starts when access lands, not when you book, so a delay here costs you days and nothing else.

Days 1 to 3: the teardown

Three days across four systems. Every pass is a comparison: what actually happened on the site against what each system recorded.

GA4. Event and parameter integrity, key event definitions and whether they count the right thing at the right scope, ecommerce parameter completeness, duplicate and self-referral traffic, cross-domain measurement, internal traffic and bot filtering, attribution and session settings, data retention, and any gap between GA4 revenue and your backend for the same window.

Google Tag Manager. A full inventory of tags, triggers and variables, and what fires each one against what should. Firing order and race conditions, tags that fire twice on a confirmation page refresh, dataLayer structure and timing versus what the tags expect, hardcoded tags living outside the container, orphaned tags left by previous vendors, and version history for changes that line up with the week your reporting broke.

Ad platform signals. In Google Ads: which conversion actions are primary, which count every conversion versus one per click, duplicate imports arriving from both GA4 and a page tag, enhanced conversions coverage, and conversion windows. In Meta: pixel and Conversions API coverage, deduplication by event ID, event match quality and which user parameters are actually being sent, and whether value and currency are accurate.

Consent. Whether Consent Mode v2 is implemented and whether the signals actually move: analytics_storage, ad_storage, ad_user_data and ad_personalization. Default states versus updates, the timing between a consent decision and the first tag firing, whether the banner blocks what it should and permits what it should, and whether rejected traffic produces modeled data or a hole in the reports. This is a measurement review, not legal advice.

Findings enter the report as they are found, each with a severity, the mechanism, reproduction steps, and the reporting or bidding consequence.

Days 4 and 5: the fixes

The top 10 issues by severity get repaired, not just described. Each fix is built, tested against live page behavior, and validated with evidence: the event arriving with the right parameters, once, in the platform that needs it.

What a GTM workspace is, and why fixes are built in one

A Google Tag Manager container has versions. A workspace is a private draft of that container: changes made inside it are invisible to your website until someone publishes them as a new version. Multiple workspaces can exist side by side.

Every audit fix is built in a workspace created for the audit and named for it. That keeps three things true. Your live container is untouched while the work happens. Your team can keep working in the default workspace without colliding with us. And every change in the audit is grouped in one place, so approving it, publishing it, or reversing it is a single decision rather than a hunt through a changelog.

Validation happens in preview mode against real page behavior and a real test conversion, then in the destination systems: the event appearing correctly in GA4 debug and realtime views, in the Google Ads conversion diagnostics, and in Meta Events Manager with deduplication intact.

Approval and publishing

Nothing goes live without your sign-off. You receive the list of changes, what each one repairs, what will move in the numbers afterwards, and the before and after evidence.

From there you have two options. Publish the workspace yourself, which takes one click once you have reviewed it. Or grant publish access on the container and we publish at a time you choose, which is usually not on top of a release. Publish access is the only non-read permission in the whole engagement, it is requested last rather than first, and you can withdraw it the moment the audit ends.

Rollback

Each published version in GTM is a numbered snapshot of the entire container. Reverting means publishing the previous version, which takes about a minute and requires no code deploy from your team.

Because the audit workspace contains only audit changes, a revert removes those and nothing else. Fixes that require a change in your own codebase are the exception: they are written up as instructions rather than made quietly, and they move through your normal deployment process, under your normal controls.

Day 5: the report

Delivery is the Missing Conversions Report, with every gap logged by severity, its cost, and its fix. With it: before and after proof for what shipped, a recorded walkthrough in plain language for whoever owns the budget, and a prioritized backlog for everything outside the top 10, sized so any developer can take it on.

What you have to do

Very little, deliberately. Grant read access on Day 0. Answer occasional questions about intent, of the form “is this form supposed to count as a lead” or “should this SKU be excluded from revenue.” Approve the fixes. Watch a recording at whatever time suits you.

Across the whole week that is usually under an hour of your time, and almost none of it is a scheduled meeting. The audit is designed to run without a standing call, because the point is to fix your measurement, not occupy your calendar.

After delivery, follow-up questions are included for two weeks. Most of them arrive when someone on your team looks at a report a week later and wants to know why a number moved.