Online marketing checklist: an audit for better decision-making

When I start working with a new client, I do not begin by rewriting ads. First, I find out what the company owns, what it measures, where an order is placed and who can make a change. More than once, it has turned out that the domain, hosting or advertising account remained with a former supplier. Strategy then rests on access the company does not have.

The original checklist had 289 items and grew over time. Such a list is a good store of questions, but a poor goal. An audit is not a competition in ticking boxes. It should reveal risks and create an order of work based on money, impact and difficulty.

Before you start, define the scope and audit owner

I carry out an audit when taking over a project, after a major change to the website or measurement, and then regularly. Critical operational checks have a shorter interval than strategic reviews. I monitor website availability and feed errors continuously; it makes sense to review the offering, access and communication mix at least after a significant business change.

For every finding, I record:

what is wrong or unverified;
its impact on money, data, operations or risk;
who owns the remedy;
what needs to be supplied;
the deadline and method of verification;
priority: blocking, high, medium, low.

Without accountability, another document emerges—one the company returns to in a year and is surprised by exactly the same mistakes.

1. The company must own its critical assets

The domain, hosting, website, e-shop, analytics, advertising accounts, catalogues and email infrastructure should be under the company’s control. An agency or specialist receives partner or user access. They should not be the sole owner.

Is the company truly the domain holder, and are renewal notices sent to an active contact?
Does the company have invoices and a contractual relationship with the hosting provider and e-shop platform?
Are there at least two legitimate administrators of critical accounts?
Is two-factor authentication enabled, with recovery options stored securely?
Have former employees, agencies, apps and partners been removed?
Are passwords not shared by email or in a spreadsheet?
Is there a documented register of accounts, IDs, owners and billing contacts?

This part will not generate new revenue tomorrow. But it protects the company from a situation where its website or advertising stops working and no one can intervene. With Meta assets, it also reduces confusion during a security incident or account restriction.

2. Basic economics determines what marketing may do

Before I evaluate channels, I need a commercial foundation:

main product lines and services;
margins or contribution after variable costs;
the best-selling and most profitable offers;
the share of new and returning customers;
the maximum acceptable cost per order or lead;
the share of leads that turn into business;
the capacity of the warehouse, support and sales team;
locations, devices or segments with a significant difference in results.

A cost-to-revenue ratio without considering margins can lead to growing revenue that does not make money. A cheap lead without information about quality can overload sales. A marketing audit is therefore not just a tag check. It checks whether technical data connects to economics.

3. Walk through the customer journey like a real person

I place a test order or submit a form from both mobile and desktop. For an e-shop, I go through different payment and delivery methods if operations allow it. I watch not only for errors, but also friction.

Is the offer and the next step easy to understand?
Do search, filtering and returning from the basket to the product work?
Can the quantity or item be changed without losing the order?
Are price, tax, delivery and timing visible before confirmation?
Can customers buy without unnecessary registration?
Does the correct transactional email arrive, and does the customer know what happens next?
Does an enquiry reach the correct CRM or person responsible?
Does sales respond within the time the company promises?

If the journey does not work, I do not send more traffic into it. Advertising would only pay for the same problem faster.

4. Check measurement through events, not the presence of code

I draw up a measurement plan: event, time of triggering, value, currency, identifiers, consent, target system and the person responsible for checking it.

For every key journey, I run a test and verify:

one correct service, container or dataset ID;
the event at the right time and without duplication;
the correct value, currency and order or product ID;
exclusion of the payment gateway or other technical sources if they distort attribution;
respect for consent settings;
transfer to analytics, the advertising system and the internal system;
the difference between the number of transactions in the report and actual orders.

For web analytics, I use the current Google Analytics 4 framework. I cover Meta measurement, server-side events and deduplication in the article about Meta Pixel and Conversions API. I no longer bring old Universal Analytics into a new audit.

5. Campaigns need a common language

Across Google Ads, Sklik, Meta and other paid channels, I check fewer screens and more decisions:

Which conversions are used for optimisation, and are they truly commercial?
Are new and returning results separated where economics makes this important?
Do campaigns have consistent names, UTM tagging and accountability?
Do ads lead to a working final URL without unnecessary redirects?
Are budgets and limits in line with the company’s capacity?
Is money being spent on an outdated offer, an out-of-stock product or low-quality leads?
Is there a check for unusual spend and sudden changes in results?
Are permissions, billing and connected accounts current?

Every platform likes to show its own contribution. That is why I compare it with analytics and sales. The aim is not to find one magic number, but to understand the differences and decide according to an agreed source.

6. Product data must match the actual inventory and website

For an e-shop, XML feeds and catalogues are a standalone operational system. An old but still accessible feed URL can look functional even when it is no longer updated.

Do the product count and update time match the source e-shop?
Are IDs, names, prices, availability, delivery, images and categories correct?
Are products rejected or matched incorrectly?
Do IDs in website events match IDs in the catalogue?
Are unsellable items removed from campaigns, and does the website offer a suitable alternative?
Can the company see errors, and is a person assigned to resolve them?

A feed is not a file uploaded once. It is a regular data flow. When it is wrong, an automated campaign merely spreads the error faster.

7. The website must be usable, available and discoverable

I divide the technical part into performance, usability and indexing. A score from a single tool is not enough on its own.

Does the main content load quickly on an ordinary mobile connection?
Are images unnecessarily large, and do third-party scripts block the page?
Does content jump during loading, and does the page respond quickly to input?
Do keyboard navigation, contrast, form labels and alternative text work?
Do existing, redirected and removed URLs return the correct status codes?
Are canonical tags, robots.txt and the sitemap aligned?
Does internal linking lead to 404s, 410s or redirect chains?
Do pages have a unique purpose, title, description and main heading?
Is the website monitored and backed up?

You can find a more detailed technical check in the article about website technicalities. For an e-shop, I also review search, filters, basket, delivery information, returns and contact details for a real company.

8. Email marketing rests on consent, deliverability and relevance

I check the source of contacts, segmentation, frequency, automation and the commercial role of every campaign. A large database is not an asset if the company does not know why it writes to it and messages end up in spam.

Is the source and purpose of communication known for every segment?
Do unsubscribing and address suppression work across systems?
Are SPF, DKIM and DMARC configured and monitored correctly?
Do templates look good on mobile, and do all links work?
Are transactional and marketing messages properly separated?
Do automations have an owner and a check after a change to the website or offering?
Are campaigns tagged so their visits make sense in analytics?

I discuss practical strategy on the email marketing page. Legal setup needs to be assessed according to the specific operation, country and data handling; a checkbox copied from a competitor is not an audit.

9. Competitors are a source of questions, not a template

I look at how competitors explain their offer, which pages gain visibility, which ads are running and how they handle the customer journey. I do not copy. I look for gaps, different positioning and things customers expect in the category.

An ad that has been running for a long time need not be profitable. High article traffic need not bring business. An external SEO metric is not accounting. Competitor observation forms a hypothesis that I verify with my own data.

10. An audit ends with priorities and verification

I order findings by impact and dependencies:

Security and ownership: what can cut the company off from operations or data.
Broken customer journey: what directly prevents an order or enquiry.
Faulty measurement: what leads to an incorrect budget and optimisation.
Campaign economics: what spends money without a corresponding result.
Performance and content: what improves long-term usability and visibility.

After a fix, I repeat the same test. It is not done when a supplier writes “deployed”. It is done when the company sees the correct result and knows who will continue to check it.

If you want to turn an audit from a long list into an order of decisions for management, see how companies work with me on a similar review. The result should not be a zillion items. It should make clear what to fix now, what to plan and what can safely be left alone.