Methodology
The 42-point inspection behind every audit
Published in full, because rigor you can't inspect is just marketing. This is the exact standard every Layer Analytics engagement is held to — judge it before you spend a dollar.
Every audit works through six pillars — GA4 configuration, GTM architecture, Consent Mode v2, conversion integrity, attribution, and the BigQuery export — 42 checks in total. Each check below states what we verify and why it matters, because most measurement failures aren't exotic: they're ordinary settings quietly wrong in expensive ways.
Want to see what the output looks like? Read a sample teardown. Want the automated subset run on your site right now? The free instant audit takes about 20 seconds.
Pillar 1 of 6
GA4 property configuration
The unglamorous settings that silently shape every report downstream.
1.1Timezone and currency match the business's platform of record
When GA4 and your store or CRM disagree on the day boundary or currency, every cross-tool comparison skews — and nobody can say which number is right.
1.2Data retention raised from the 2-month default to 14 months
The default quietly truncates Explorations to two months of history; most teams discover this the day they need last year's data.
1.3Internal and developer traffic rules exist AND the data filter is Active
A rule in 'Testing' mode still lets your own team pollute production numbers — the filter state matters as much as the rule.
1.4Payment and SSO domains are listed as unwanted referrals
A checkout that bounces through Stripe or PayPal comes back as a 'referral' that takes last-click credit for the purchase — handing your revenue's credit to a payment processor.
1.5Reporting identity and Google signals settings are a deliberate choice
These change user counts and can trigger data thresholding — fine if you chose the trade-off, dangerous if it happened by default.
1.6Session timeout and engaged-session thresholds reviewed
Defaults fit most sites but not all — long-form content and embedded apps can misclassify engagement without anyone noticing.
1.7Property access follows least privilege
Former agencies and ex-employees with admin access are one of the most common — and least monitored — measurement risks we find.
Pillar 2 of 6
GTM & tagging architecture
Where most double-counting and silent data loss is born.
2.1Exactly one tagging path — no gtag snippet and GTM tag firing the same events
Running a hardcoded snippet alongside GTM (or a platform's native integration alongside a container) is the single most common cause of inflated counts.
2.2The Google tag loads once, before any event tag
Events that fire before measurement initializes can be dropped or mis-attributed — load order is a correctness issue, not a style preference.
2.3Data layer pushes match the GA4 ecommerce schema exactly, including the items array
Event names and parameters are case-sensitive; a near-miss like addToCart doesn't error — it just silently never becomes ecommerce data.
2.4The ecommerce object is reset (ecommerce: null) before every push
Without the reset, item data bleeds from one event into the next and corrupts product-level reporting in ways that look plausible.
2.5Triggers are audited for multi-fire on SPA route changes and form re-submissions
Single-page apps re-fire history events; a trigger that doesn't account for that can double or triple engagement events.
2.6Container hygiene: no orphaned tags, paused experiments, or unnamed variables
Hygiene predicts correctness — containers nobody can read are containers nobody has QA'd.
2.7Version history shows disciplined, documented publishes
When every publish is 'quick fix' by whoever had access, the container's current behavior is archaeology, not architecture.
Pillar 3 of 6
Consent Mode v2 & privacy
Compliance and data quality live or die on ordering and completeness.
3.1Consent defaults fire before any Google tag, on every page
Defaults set after the first tag are too late — the first hit already left without consent state, which is both a data and a compliance problem.
3.2All four v2 signals are set: ad_storage, analytics_storage, ad_user_data, ad_personalization
The two v2 signals (ad_user_data, ad_personalization) are required for EEA ads features — a v1-era setup silently degrades your Google Ads measurement.
3.3The CMP's accept AND reject paths actually update consent state
We verify both paths in preview mode — a banner that looks compliant but never sends the update call is worse than no banner.
3.4Region-specific defaults are a documented business decision
Denying everything globally versus only where required changes your data volume materially — it should be chosen, not inherited.
3.5Denied-consent behavior is known: basic vs advanced consent mode
Advanced mode sends cookieless pings that enable conversion modeling; basic mode sends nothing. Most teams can't say which they run — and the numbers differ.
3.6No PII in URLs, page paths, or event parameters
Emails and phone numbers in query strings violate Google's policies and can poison a property — redaction settings are checked, not assumed.
3.7Data redaction and URL passthrough are deliberate settings
Passthrough preserves click IDs under denied consent; redaction strips accidental PII — both should match your legal posture.
Pillar 4 of 6
Conversions & event integrity
Key events are the numbers leadership sees — they must be right.
4.1Every key event maps to a real business outcome
A key event chosen for convenience (any form, any click) inflates 'conversions' until the number stops meaning anything in the boardroom.
4.2Counting method (once per event vs once per session) matches each outcome
A lead form counted per event turns one enthusiastic visitor into five conversions; a purchase counted per session hides bulk orders.
4.3purchase carries transaction_id, value, currency, and a complete items array
Deduplication, revenue reporting, and product analysis all hang off these parameters — a purchase event without them is a counter, not a record.
4.4Duplicate transactions are measured, not assumed away
GA4's transaction_id deduplication is best-effort, not guaranteed — we count repeated IDs directly because inflated revenue is the most expensive lie a dashboard can tell.
4.5The full funnel fires: view_item → add_to_cart → begin_checkout → purchase
One missing step doesn't just lose an event — it breaks every funnel report built across the sequence.
4.6Custom dimensions are registered for the parameters reports rely on
Unregistered parameters collect invisibly; registered-but-high-cardinality ones burn quota and collapse reports into the '(other)' row.
4.7Event names follow GA4's recommended-event vocabulary exactly
Recommended names (purchase, generate_lead, sign_up) unlock built-in reporting; near-duplicates fragment your data across spellings.
Pillar 5 of 6
Attribution & channel integrity
Why GA4 disagrees with your ad platforms — and which gaps are fixable.
5.1GA4 vs ad-platform conversion gaps are quantified and explained
Different attribution models and windows guarantee some divergence — the audit separates expected disagreement from broken tracking.
5.2Unassigned and (not set) traffic share is measured with root causes
Rising Unassigned traffic is attribution quietly leaking — usually stripped parameters, misconfigured UTMs, or consent-related signal loss.
5.3UTM taxonomy is consistent — and absent from internal links
UTMs on internal links overwrite the visitor's true source mid-session, hijacking attribution for everything that follows; inconsistent naming fragments channels in every report.
5.4Google Ads auto-tagging is on and the gclid survives redirects
Redirect chains and consent walls can strip the click ID, downgrading precise ad attribution to guesswork.
5.5Referral exclusions match the real checkout and login flows
Every domain the user legitimately passes through mid-journey must be excluded, or it claims credit for the conversion.
5.6Cross-domain tracking is configured where journeys span domains
Without the _gl linker, a visitor crossing domains becomes two unrelated users — and the landing domain steals the conversion.
5.7Attribution model and lookback windows are reviewed against the sales cycle
A 30-day window on a 90-day B2B cycle systematically undercounts the channels that start relationships.
Pillar 6 of 6
BigQuery export & data quality
The raw-data foundation everything defensible is built on.
6.1The BigQuery export is enabled — before you need it
It's the only unsampled, unthresholded record of your data, and it cannot be backfilled: every day without it is history you'll never get back.
6.2Export volume is checked against the 1M events/day daily cap
Standard properties over the cap get warning emails, then a paused daily export — teams often notice only when an analysis doesn't add up.
6.3Queries handle events_ vs events_intraday_ tables correctly
Mixing the two double-counts the current day; ignoring intraday makes 'today' invisible. Both errors look like working SQL.
6.4GA4 revenue reconciles to the platform of record within a documented tolerance
GA4 will never match Stripe or Shopify to the cent — but the gap should be measured, explained, and stable, not unknown.
6.5Data-quality monitors run on a schedule, not once
Duplicate transactions and event-volume anomalies recur as sites change; a one-time audit decays without monitoring.
6.6Query costs are bounded by date-range discipline (_TABLE_SUFFIX filters)
Unbounded scans over years of date-sharded event tables turn a free export into a surprise invoice — cost control is part of correctness.
6.7Dataset region and access are deliberate day-one choices
BigQuery dataset location is immutable after creation, and export access is production access — both deserve intention.
Go deeper
Fixes we publish for free
The most common failures this inspection finds, with full write-ups.
FAQ
About the methodology
See how your setup scores against this standard
The instant audit runs the automatable checks on your site in about 20 seconds — free, no account. Or have a senior practitioner run all 42 points inside your accounts.