The number you see in GA4 is not a measurement. It is a heavily filtered estimate of the visitors whose browsers cooperated with your tracking, whose ad blockers stood down, whose consent banners got accepted, and whose UTMs survived your redirect chain. Once a quarter, somebody on your team needs to find out how filtered the estimate has become.
When This Audit Pays for Itself
Every B2B SaaS marketing site I audit needs this run at least once. The trigger is almost always one of four events: a consent banner was installed during a compliance push, a theme or site rebuild went live, GSC and GA4 quietly drifted apart by more than 30%, or the team is about to reallocate a meaningful budget based on a GA4 channel report. The 30 minutes you spend running the audit is the cheapest insurance you have against six months of compounding bad decisions.
Most teams audit GA4 only when something breaks loudly. A campaign report shows zero conversions. A board member asks why traffic is down. A new CMO opens the dashboard for the first time. By the time the gap is loud enough to notice, three quarters of decisions have already been made on broken data.
Quarterly cadence reverses the dynamic. You run the diagnostic before you need it. If everything is healthy, the audit takes 30 minutes and you move on. If something is broken, you find it before it shapes a campaign or a renewal conversation. The cost is the same. The protection is enormous.
Before You Start: 15-Minute Prep
You need four things in front of you before you open GA4. Without them, the audit fragments into a series of “I’ll check that later” notes.
First: admin or editor access on the GA4 property and at least Full access on the Search Console property. Viewer access works for the diagnostic but not for the fixes. If you only have Viewer, run the diagnostic alone and queue the fixes for someone with edit rights.
Second: a complete list of every conversion event the property is supposed to track. Form submits. Calendly bookings. Demo requests. Trial signups. Pricing page CTAs. Live chat opens. Pull this from your measurement plan if you have one. If you do not have one, write it down now. The list IS your measurement plan from this audit forward.
Third: a list of every channel that drives meaningful campaign traffic. Paid search. Paid social. Organic. Content. Partnerships. Newsletter. Referrals from named publications. Each one needs to show up correctly in the channel report when you check attribution.
Fourth: a screenshot or export of the GA4 channel report and the GSC performance report for the last 30 days. You will compare them in Check 1.
The Five Checks That Catch 80% of Failures
Check 1: Reconcile GA4 Organic Search with GSC Clicks
Open GSC and GA4 side by side for the last 30 days. In GSC, note total clicks. In GA4, navigate to Reports → Traffic acquisition, filter to Organic Search, note total sessions. The two numbers will not match exactly. They are not supposed to.
Within 30% of each other: normal. Consent rejection, ad blockers, and the different things they count explain the gap. Within 50%: worth investigating but not urgent. More than 50% lower in GA4: a collection layer problem. Almost certainly consent-related in 2026 if your site has a banner. Investigate Check 2 first.
Document the gap percentage. Track it quarterly. If it widens, something changed.
Check 2: Verify Google Consent Mode v2 Is Wired Correctly
This is the single highest-leverage check in the entire audit. Open your consent management platform’s settings. Confirm that Google Consent Mode v2 integration is enabled[1]. Most CMPs have this as a toggle.
Then test it. Open your site in an incognito window, reject all cookies in the banner, navigate to two or three pages. Open GA4 → Reports → Realtime and look for your session. With Consent Mode v2 wired correctly, you should see traffic showing up as anonymous, cookieless pings even after rejection. The platform models these into your aggregate reports.
If GA4 Realtime shows nothing after rejection, Consent Mode v2 is either disabled or wired incorrectly. This is a 15-minute fix in most consent managers (Complianz, Cookiebot, OneTrust, Iubenda all support it). It typically recovers the largest single chunk of missing GA4 data on any B2B site[2].
Check 3: Manually Fire Every Conversion Event
Pull out the list from prep. For each event: trigger it on the live site. Submit the contact form. Book a meeting through Calendly. Click the primary CTA. Open the demo request flow. After each trigger, switch to GA4 → Reports → Realtime → Event count by Event name. The event should appear within 30 seconds.
If an event does not appear, that conversion path has been silently broken. Note the date of the last verified fire (if your event documentation includes it). If the answer is “never recorded a manual verification,” your dashboards have been reporting against a flawed event list since the property was set up.
The most common breaks: a form submit event fires before submission completes so you only see abandoned attempts; a Calendly thank-you page never had the event added; a CTA button class name changed during a redesign and the listener no longer fires.
Check 4: Trace One Campaign End-to-End
Pick a recent paid campaign or content piece. Trace one converted user through every system: first click in the ad platform or referrer URL, GA4 session with correct UTMs, GA4 conversion event, CRM lead record, opportunity. The numbers should line up at each handoff.
Discrepancies are diagnostic. If the ad platform reports 50 clicks and GA4 shows 12 sessions tagged with the campaign UTM, you have UTM stripping somewhere in your redirect chain. If GA4 reports 50 sessions and the CRM has 0 leads, your form-to-CRM integration is broken. Each discrepancy points to a specific layer.
Check 5: Read the Channel Grouping Like a Skeptic
Open GA4 → Reports → Acquisition → Traffic acquisition. Look at Direct as a percentage of total. On most B2B sites with proper UTM hygiene, Direct should be 10-25%. If Direct is over 40%, your channel attribution is broken. UTMs are being stripped, AI search referrals are landing as Direct, or your channel groupings have not been customized for your stack.
Look at Other (Unassigned) too. If it appears, you have campaigns with no UTMs or UTMs that do not match any channel rule. Those campaigns are uncategorized. Their conversions are not flowing to the right channel.
Read the channel order: which channel drives the most sessions, which drives the most conversions, which has the highest engagement. Note any surprise. Surprises are the audit catching something for you.
What to Fix First
Triage by layer. Fix in order. Skip the next layer until the previous one is solid.
Collection first. If Check 2 found Consent Mode v2 disabled or misconfigured, fix it before anything else. Without correct collection, the rest of the audit is measuring a fraction of reality.
Configuration second. If Check 3 found broken conversion events, fix them. Document each one. Add a manual fire test to your quarterly cadence so the next audit catches drift faster.
Attribution third. If Check 4 surfaced UTM stripping or CRM gaps, fix the redirect chain or the integration. Then verify by tracing a new conversion end-to-end.
Reporting last. If Check 5 showed channel grouping noise, customize the channel groups. This is the last layer because it depends on clean attribution, which depends on correct events, which depends on collection. Fixing it first is putting paint on a wall that has not been built yet.
Most marketing leaders try to fix the reporting layer first because dashboards are visible. The audit reverses the instinct. Fix what is invisible. The dashboards correct themselves.
Make This a Quarterly Habit
The audit is not impressive. It is mechanical, replicable, and almost always finds something. The reason most B2B SaaS marketing teams have an analytics trust gap is not technical skill. It is that nobody on the team owns the quarterly cadence. The audit you do not run is the data you do not trust. The data you do not trust is the budget you cannot defend.
If this audit is more than your team can handle quarterly, the underlying problem is the website ownership gap, not the audit itself. Someone needs to own this work. That ownership is the difference between making decisions on data and making decisions on dashboards that look like data.
For the broader framework on what trustworthy analytics enables and the four layers it sits on, see the Analytics Trust Gap. For what neglected tracking actually costs over time, see the hidden cost of website neglect.
The audit takes 30 minutes. Block it on your calendar this quarter. Block it for the next four quarters. The version of your dashboard you will have a year from now depends almost entirely on whether you treat this as habit or as emergency.
Sources
- Google, About Consent Mode – Official documentation on Consent Mode v2 cookieless ping modeling ↩
- Trackingplan, Web Analytics Audit Checklist – 20.3% of analytics data lost to consent banner rejection on B2B sites ↩
Seeing these patterns at your company?
Book a free WebOps Diagnostic. I'll review your site before the call and share specific observations.
Book a Free Call →Frequently Asked Questions
Within 30% of each other is normal: GA4 counts sessions that successfully fired tracking, GSC counts clicks at the search-result level, and consent rejection plus ad blockers explain the rest. Anything beyond a 50% gap means GA4 is collecting less than half of your traffic. That's a collection layer problem, not a methodology difference.
First-time audit: 60-90 minutes because you will find things to fix. Once the collection layer is healthy and events are documented, ongoing quarterly audits run in 30 minutes. The cadence matters more than the duration. Quarterly catches drift early; annual lets six months of bad data shape decisions.
Viewer access on the GA4 property and Owner or Full access on the Search Console property are enough for the diagnostic. Fixing what you find usually requires GA4 Editor and access to your tag manager. Schedule the audit when you can pair with someone who has both, or do the diagnostic alone and queue fixes for a sprint.
Fix forward, do not try to backfill the past. The data is gone. Document what was broken, fix it, mark the date, and treat the post-fix numbers as the new baseline. Comparing pre-fix and post-fix data only works if you can isolate what changed. Most teams find the cleanest move is to draw a line and move on.
Because rejection means no data by default. Without Google Consent Mode v2 enabled and correctly wired into your consent manager, every rejecting visitor sends zero events. On B2B audiences with privacy-aware visitors, rejection rates of 30-50% are common. With Consent Mode v2 enabled, rejected visitors still send anonymous pings that GA4 models into traffic counts.
