How to Audit a GA4 Property in 10 Minutes

An analytics audit has a bad reputation, mostly because the deliverable is usually a 40-page PDF that nobody acts on. The useful version is shorter and much more specific: a prioritised list of things that are wrong, what each one costs you, and the exact click that fixes it.

This is the order we run it in. It takes about ten minutes on a property you know, twenty on one you have just been handed. The sequencing matters — each pass depends on the one before it, and auditing in the wrong order produces findings that turn out to be symptoms of something you have not looked at yet.

The order: collection → configuration → quality → governance

Run the four passes in this order every time.

Collection asks whether hits arrive correctly. Configuration asks whether the arriving data is usable. Quality asks whether the reports are believable. Governance asks whether any of this will still be true next quarter.

Auditing quality before configuration is the classic mistake. You find (not set) everywhere, spend an hour investigating it, and discover the parameter was never registered as a custom dimension — a configuration finding you would have caught in pass two.

Pass 1 — Collection (3 minutes)

You are looking for hits that are missing, duplicated, or malformed.

Check the data stream. One web stream per site. Multiple streams for the same site split your data in ways that are painful to unwind.

Check for duplicate configuration. In the GA4 realtime report, load a single page and watch the user count. If one visit registers as two users, or page_view count is double the visit count, you have two configuration tags. This usually means a hard-coded gtag.js snippet is still on the page alongside the GTM tag.

Check the last 48 hours in realtime and in the Events report. An event with zero occurrences in the last 30 days either never worked or stopped working. Both need explaining.

Check Enhanced Measurement toggles against your GTM tags. Every overlap is a double-count. scroll, click (outbound), file_download, view_search_results, and video_* all commonly exist twice.

Check the event volume trend. A step change on a specific date is a deployment, not a business event, until proven otherwise.

Pass 2 — Configuration (4 minutes)

This is where the findings that matter live.

Custom definitions. Open Admin → Custom definitions and compare the list against the parameters your tags actually send. You are looking for two failures in opposite directions:

• A parameter is sent but never registered. It is collected, it is stored, and it is invisible in every report and exploration. This is the most expensive silent failure in GA4.
• A dimension is registered but nothing populates it. Every report shows (not set), and someone will eventually build a segment on it.

Doing this comparison by hand across a container with forty tags is tedious enough that it gets skipped. The GA4 sync checker does exactly this comparison automatically, in both directions. Custom dimensions vs event parameters explains why the gap exists in the first place.

Key events. Are the right events marked? Is the counting method deliberate — once per event, or once per session? Are you under the 30 cap? Does each key event have a value and currency if revenue matters?

Data retention. Admin → Data settings → Data retention. The default is 2 months. It should almost always be 14. This setting is not retroactive: data older than the retention window is deleted permanently, and switching to 14 months today does not bring back what was dropped yesterday.

Timezone and currency. Wrong values here shift every daily report and every revenue figure.

Product links. Google Ads, Search Console, BigQuery, Merchant Center. The BigQuery export in particular cannot be backfilled — every day it is not linked is a day of raw data you will never have.

Attribution settings. Model and lookback window. Not because one is right, but because it should be a decision somebody made.

Pass 3 — Data quality (2 minutes)

Now that configuration is understood, the quality symptoms will make sense.

Unassigned traffic. Open the Traffic acquisition report and look at the channel group. "Unassigned" means a source/medium pair matched no channel rule — usually a utm_medium typo, a case mismatch, or a custom medium nobody added to the channel group.

Self-referrals. Your own domain appearing in the referral report means cross-domain tracking is broken or a referral exclusion is missing. Every self-referral is a session that started over and lost its original source.

(not set) at scale. In a single dimension, this is usually the registration gap from pass two. Across many dimensions, it usually means events are firing before the values exist in the dataLayer.

Internal traffic filter state. Admin → Data settings → Data filters. A filter in Testing mode does nothing at all. It is extremely common to find one that has sat in Testing since the property was created, which means every developer session is in your numbers.

Bot traffic. Automatic filtering catches known bots. It does not catch your own uptime monitors, your own synthetic tests, or a scraper with a real user agent.

Pass 4 — Governance (1 minute)

Who has access? Property Admin is a lot of power. Count the people who have it and ask whether each still needs it — former agencies and departed staff are the usual finding. Running an access audit covers this properly across GA4 and GTM together.

Is anything monitoring this? If the answer is "we look at the dashboard sometimes," the next breakage will be found by whoever notices a number looks odd, which is typically three to six weeks late.

When is the next review? Put it in the calendar before you close the tab.

The six findings that appear in almost every account

If you audit enough properties, the same things come up. In rough order of frequency:

1. Data retention still at 2 months. Trivial to fix, impossible to undo.
2. Parameters sent but never registered as custom dimensions. Weeks of collected data that no report can reach.
3. An internal traffic filter stuck in Testing. Configured, visible in the UI, doing nothing.
4. Duplicate page_view events from Enhanced Measurement plus a manual SPA tag.
5. No BigQuery link. Free, five minutes, and every day without it is gone.
6. Stale access. An agency that finished in 2023 still has Editor.

None of these are exotic. All of them are invisible unless you go looking.

Turning the audit into a document people act on

The audit is worth nothing if it ends as a list of observations. Three things make it actionable:

Severity, honestly assigned. Data retention at 2 months is critical. A missing Search Console link is not. Marking everything critical is the same as marking nothing.

The cost, in the client's language. "Six event parameters are unregistered" means nothing. "Six weeks of checkout behaviour data exists but cannot be reported on, and there is no way to recover the reporting for that period" gets a decision.

The exact fix. Not "review custom definitions" but "Admin → Custom definitions → Create custom dimension, event-scoped, parameter name checkout_step."

Then re-run the same audit next quarter and diff it. The second audit is much faster than the first, and the delta is a better report than either audit alone.

How Tagfire helps

Tagfire's GA4 audit tool runs this process automatically. It connects with read-only Google scopes, runs 18+ checks across the four passes above — data collection, event data, key events, ecommerce, user tracking, attribution, data quality, traffic sources, privacy, integrations, audience and device settings, and property configuration — and returns a scored report where each finding carries its severity and the specific remediation step.

Two things it does that a manual pass does not:

• The sync comparison. The GA4 sync checker reads your GTM container and your GA4 custom definitions and names the exact parameters on each side of the registration gap. This is pass two's highest-value check, done in seconds instead of an afternoon.
• The diff. Reports are saved, so re-running next quarter shows you what changed rather than starting over.

Audits are free on every plan and there is no limit worth worrying about. If you manage several accounts, the access audit and GTM audit cover the container and governance side of the same review.

The documentation walks through reading a report and acting on the findings.