The analytics audit when numbers look off

If a client sends you an email saying the website reports do not match their CRM, you have probably asked: how do I audit my Google Analytics setup? Staring at the standard GA4 charts and guessing what went wrong is a waste of time. When numbers look off, you need a systematic, step-by-step audit process to isolate the leak and fix it.

Whether you are seeing a massive spike in direct traffic, a drop in conversion tracking, or duplicate transaction reporting, the cause is always structural.

Here is the exact diagnostic checklist I run whenever a client or team member reports that our web analytics metrics do not align with reality.

Step 1: Code and container integrity check

Before you look at filters or attribution models, you must verify that the tracking script is installed correctly and is loading on every single page.

1. Verify container presence: Open your website, right-click, and select View Page Source. Search for GTM- (Google Tag Manager) or G- (GA4 Measurement ID) to confirm the container exists in the head element of the page.
2. Check for duplicates: A common error is container duplication. This occurs when a developer adds the GTM script directly to the HTML template, but also activates a native CMS integration (like a Shopify app or Webflow site integration) that deploys the same container ID.
3. Use Google Tag Assistant: Run the website through Tag Assistant in preview mode. Look at the summary timeline. If you see the GA4 configuration tag firing twice on a single page view, your traffic and pageview metrics are double-counted.

Ensure your staging site or dev subdomains are either sending data to a separate test GA4 property or are completely blocked from firing tags. You do not want developer clicks polluting your production reports.

Step 2: Conversion event trigger logic

If your conversion numbers do not match your backend sales or CRM leads, your trigger logic is likely broken.

1. Verify success pages: If your conversion is based on page views (like a thank-you page), check if the tag fires when a user refreshes the page. If it does, you will record duplicate conversions. The trigger should ideally fire on a custom dataLayer event sent by the server only when the database commits the transaction.
2. Check validation triggers: For lead forms, test the submit button with blank fields. If GTM triggers the conversion event even when the browser displays a "Please enter a valid email" warning, your trigger is set to fire on click instead of successful validation.
3. Audit parameter values: If you track e-commerce purchases, open DebugView and run a test purchase. Expand the purchase event and verify that the items array, currency, and value parameters are filled with correct, unrounded numbers. If these variables are empty, your dataLayer mapping is broken.

Step 3: Referral exclusions and self-referrals

If you look at your acquisition reports and see your own domain or payment processors (like Stripe or PayPal) listed as major traffic sources, your attribution is broken.

1. Navigate to your GA4 Traffic Acquisition report.
2. Search for your own domain in the table.
3. If it appears, you have a self-referral problem, which terminates user sessions and erases their original traffic source (like Google Ads or organic search).

To resolve this, go to your GA4 stream settings, click Configure Tag Settings, and edit the List of Unwanted Referrals. Add your own domain, your subdomains, and the domains of any external booking tools, checkout software, or payment gateways you use.

This tells GA4 to treat visits returning from these domains as a continuation of the original session instead of starting a new referral session.

Step 4: Ad platform linking and auto-tagging

If your paid traffic shows up as organic search or direct, the data link between your ads and analytics is broken.

1. Go to GA4 Admin, select Product Links, and verify that Google Ads is linked.
2. Open your Google Ads account, go to account settings, and confirm that Auto-Tagging is set to active. Auto-tagging appends the unique gclid parameter to your destination URLs, allowing GA4 to pull campaign metrics.
3. Verify that Google Search Console is linked. This populates the Search Console reports in GA4, allowing you to compare queries and landing pages.

Step 5: External validation against backend databases

Web analytics will never match your bank account or database exactly. Ad blockers, VPNs, cookie consent rejection, and browser privacy features block client-side scripts, causing a natural underreporting rate of 10-15%.

However, the trend should be consistent:

• If your backend database reports 100 sales, GA4 should show between 85 and 90 purchases.
• If GA4 shows 50 purchases but your database only has 30, you have duplicate tracking tags firing.
• If GA4 shows 10 purchases but your database has 100, your tracking tag is broken, or a specific browser/payment method is failing to fire the tag.

Compare your Google Search Console click trends against your GA4 organic landing page sessions. If the GSC click line is steady but the GA4 sessions line is dropping, your GA4 landing page tags are broken on your highest-traffic pages.

Run this audit sequence every quarter or after any major site deployment. Keeping your tracking clean is the only way to make decisions with confidence. If you need help tracing duplicate events or setting up a clean dataLayer integration, a systematic analytics audit and repair project can identify the specific line of code that is distorting your reports. Validate your inputs, clean your filters, and trust your data again.