Short answer: A lead tracking audit (also called a lead management audit) tests the full chain from ad click to landing page, analytics event, CRM record, sales stage and revenue, then checks that qualified outcomes flow back to Google Ads and Meta. Use the 28-check template below: each check has a test you can run in a browser or CRM and a pass criterion. Score it by weight, fix every failed critical check before spending more on ads, and repeat the audit every quarter or after any website or CRM change.
Need this done for you? GrowthSparx offers a fixed-scope lead tracking and attribution setup: GA4, Google Ads, Meta, WhatsApp, calls and CRM wired into one dashboard, usually live in 2–3 weeks.
How do you run a lead tracking audit?
Block 90 minutes with three people: whoever manages ads, whoever owns the website tags, and a sales manager with CRM access. Audit evidence, not screenshots of settings. A setting that says "enabled" proves nothing until a test lead travels through it.
- Prepare tools. Google Tag Manager in Preview mode (it opens Tag Assistant, which shows which tags fired and what triggered them) and GA4 DebugView, which shows events from a debug device in near real time.
- Send test leads using the script below, each with a recognisable name such as "AUDIT TEST 07 Oct", so the CRM team can find and delete them afterwards.
- Work through sections A to E, marking each check Pass, Fail or Not applicable, with a note of the evidence.
- Score, then log every failure with an owner and date.
Do it before raising budgets, after a website redesign, after changing CRM or form tools, and every quarter. Tracking breaks quietly: a developer renames a form field and leads stop carrying their source for weeks.
Which test leads should you send?
| Test | Journey | What it proves |
|---|---|---|
| T1 | Google ad click (ad preview or a live click) on desktop, browse two pages, submit form | Click ID persistence, form event, CRM source |
| T2 | Same on mobile, through any redirect or cross-domain step | Mobile form, redirects, cross-domain session |
| T3 | Meta instant form test lead (Meta's Lead Ads Testing Tool) | Meta-to-CRM integration and field mapping |
| T4 | WhatsApp button on a UTM-tagged landing page | Click event and chat-to-campaign attribution |
| T5 | Call the tracking number from a mobile | Call capture, routing and CRM creation |
| T6 | Repeat T1 with the same phone number | Duplicate handling and write-once source |
Then move one test lead through qualified, opportunity and won in the CRM, and confirm the stage change reaches the feedback upload (section E).
A. Are lead definitions and governance in place?
Check this first. If marketing and sales define a qualified lead differently, every later number is contested.
| # | Check | How to test | Pass criterion | Weight |
|---|---|---|---|---|
| A1 | Lead stages are written down | Ask marketing and sales separately to define lead, valid lead, qualified lead, opportunity and sale | One shared document; both teams give the same definitions | High (3) |
| A2 | Rejection reasons are a fixed list | Open the CRM disqualification field | Picklist (wrong number, no budget, outside area, job seeker, duplicate, competitor), not free text | Medium (1) |
| A3 | Each stage has an owner and timestamp | Open five recent won deals and look at stage history | Every stage change shows who and when | High (3) |
| A4 | Consent and retention are documented | Ask where form consent text and data retention rules are written | Consent wording on forms; a stated retention period; named access owner | Critical (5) |
The Digital Personal Data Protection Act, 2023 applies to the names and numbers you collect; its Rules were notified on 14 November 2025, with an 18-month phased compliance period, and each consent notice must state the specific purpose of collection. A clear consent line on each form and a retention period are basic hygiene, not paperwork.
B. Is campaign tagging consistent?
| # | Check | How to test | Pass criterion | Weight |
|---|---|---|---|---|
| B1 | Google Ads auto-tagging is on and survives | Click your own ad (or use ad preview), check the landing URL for gclid= after any redirect | Click ID present on the final page | Critical (5) |
| B2 | UTMs follow one naming convention | Export last 90 days of source / medium / campaign from GA4 (Traffic acquisition report) | No case duplicates (Facebook vs facebook); no untagged paid campaigns | Medium (1) |
| B3 | Meta and other paid links carry UTMs | Open three live Meta ads and read the URL parameters field | utm_source, utm_medium, utm_campaign on every ad | High (3) |
| B4 | Campaign names match between platform and CRM | Compare five campaign names in Google Ads with utm_campaign values stored in the CRM | Exact match, so spend can be joined to leads | High (3) |
| B5 | Cross-domain journeys keep the session | Go from landing page domain to booking or form domain; check that the _gl parameter appears | One GA4 session across domains | Medium (1) |
Google's auto-tagging documentation warns that some sites reject unfamiliar URL parameters or lose them in redirects; the click ID must reach the final landing page for conversions to track. For naming rules and examples, use our UTM parameters guide. For B5, the setup is in cross-domain tracking for landing pages.
C. Does the website capture leads correctly?
| # | Check | How to test | Pass criterion | Weight |
|---|---|---|---|---|
| C1 | Lead event fires only on success | Submit a form with an invalid phone number, then a valid one, with GTM Preview / Tag Assistant open | Event fires once, only after the valid submit | Critical (5) |
| C2 | No duplicate conversions | Reload the thank-you page; submit twice; check GA4 DebugView and Google Ads conversion count next day | One conversion per lead; Google Ads lead action set to count "One" | High (3) |
| C3 | Click IDs and UTMs reach the form | Land with a test gclid and UTMs, browse two pages, then submit | Hidden fields hold gclid / gbraid / wbraid and UTMs at submit | Critical (5) |
| C4 | Calls and WhatsApp are tracked separately | Tap the phone and WhatsApp buttons on mobile; watch DebugView | Distinct events (for example click_call, click_whatsapp), not counted as leads | Medium (1) |
| C5 | No personal data in analytics | Search GA4 page paths and event parameters for @ signs and 10-digit numbers | No email, phone or name anywhere in GA4 | Critical (5) |
| C6 | Consent banner does not silently block tags | Accept and decline consent; check which tags fire in Tag Assistant | Behaviour matches your consent design; declined users are not tracked by mistake | High (3) |
| C7 | Server-side validation stops junk | Submit 12345 as a phone number and a disposable email | Rejected, or flagged as invalid in the CRM | Medium (1) |
C5 is non-negotiable. Google Analytics policy says no data may be passed that Google could recognise as personally identifiable, including email addresses and mobile numbers, and that URL paths and parameters must be free of it. The usual leak is a thank-you URL such as /thanks?phone=98…. Fixes for C1 and C2 are covered step by step in form tracking with GTM and fixing duplicate conversions.
D. Is lead management in the CRM working?
This is the part most audits skip, and where most revenue leaks. A perfectly tracked lead that nobody calls for two days is still lost.
| # | Check | How to test | Pass criterion | Weight |
|---|---|---|---|---|
| D1 | Every channel creates a CRM lead | Send one test lead each from website form, Meta instant form, Google lead form, WhatsApp and a phone call | All five appear in the CRM within 5 minutes | Critical (5) |
| D2 | Source is stored write-once | Submit a second enquiry from the same phone via a different source | First source unchanged; latest source updated; activity logged | High (3) |
| D3 | Phone numbers are normalised | Look at 20 recent records | All in +91XXXXXXXXXX format | Medium (1) |
| D4 | Duplicates merge without losing history | Merge two test duplicates | Opportunities and source fields survive the merge | High (3) |
| D5 | Every lead gets an owner | Filter leads created last week with no owner | Zero unassigned after 1 hour in working hours | High (3) |
| D6 | First response time is measurable | Report median minutes from created to first call or message, last 30 days | Report exists; median under 15 minutes in working hours | High (3) |
| D7 | Won revenue matches finance | Compare last month's CRM won value with invoices | Within 5%, or differences explained | High (3) |
The 15-minute target in D6 is our internal standard for inbound leads, not an external benchmark; set your own, but measure it. If D1 fails for WhatsApp, capture the chat through your WhatsApp Business API provider's CRM integration rather than relying on the click event.
E. Do qualified outcomes flow back to the ad platforms?
| # | Check | How to test | Pass criterion | Weight |
|---|---|---|---|---|
| E1 | Primary conversion is the right one | Google Ads > Goals: list primary actions | One primary action per real outcome; page views and button clicks secondary | Critical (5) |
| E2 | Qualified stages are sent back to Google Ads | Check the offline / enhanced conversions for leads action and its last upload date | Uploads at least daily, within Google's 90-day click window | High (3) |
| E3 | Meta receives CRM stages | Events Manager: look for a Lead or custom CRM event from the server | Server events arriving with event_id for deduplication | Medium (1) |
| E4 | Upload errors have an owner | Open the upload diagnostics in Google Ads and Events Manager | No unresolved errors older than 7 days; named owner | Medium (1) |
| E5 | Ad leads reconcile with CRM | Compare one week of platform-reported leads with CRM leads from the same source | Gap under 10% (or explained) | High (3) |
Three Google rules shape section E. Google retains GCLIDs for 90 days, so click-based conversions older than that cannot be uploaded; conversions matched on personal data have a 63-day limit; and Google recommends uploading at least daily. Google now recommends enhanced conversions for leads over GCLID-only imports, calls Data Manager the fastest setup route, and from 15 June 2026 moved these uploads to the Data Manager API (Google Ads Help). Our offline conversion tracking guide covers the build; the Meta side is in Meta Conversions API for lead generation.
How do you score a lead management audit?
Each check carries a weight: Critical 5, High 3, Medium 1. The 28 checks total 82 points (7 critical, 13 high, 8 medium). Mark "not applicable" checks out of both the score and the total.
Score = points from passed checks ÷ points available × 100.
| Score | Grade | What to do |
|---|---|---|
| 90–100 | Healthy | Safe to scale spend and use qualified-lead bidding. Re-audit quarterly. |
| 75–89 | Usable with gaps | Keep budgets steady; fix high-weight failures within 30 days. |
| 50–74 | Unreliable | Do not change bidding strategy or move budget between channels on this data. |
| Below 50 | Broken | Treat reported CPL and ROAS as unknown. Fix capture and CRM first. |
Override rule: any failed critical check caps the grade at "Unreliable", whatever the score. One missing click ID (B1) or personal data in GA4 (C5) is enough to invalidate the rest.
Worked example: an account passes everything except C3 (click IDs not reaching the form, critical, 5), D6 (no response-time report, high, 3) and B2 (messy UTMs, medium, 1). Score = (82 − 9) ÷ 82 = 89%, which would be "Usable", but the C3 failure caps it at "Unreliable". That is the right call: without click IDs, offline conversion uploads cannot match, so the bidding system is learning from form fills only.
For agencies and in-house teams, the scoring and grade tables in this template are exactly what we use in onboarding audits for lead generation clients.
What should the remediation log look like?
An audit without a log is a list of complaints. Keep one row per failed check:
| Check | Finding | Impact | Fix | Owner | Due | Retest result |
|---|---|---|---|---|---|---|
| C3 | gclid lost when visitors move from /offer to /contact | Offline uploads cannot match | Store click IDs in a 90-day first-party cookie; write to hidden fields | Web developer | 7 days | Pass after T1/T2 retest |
| D6 | No first-response report | Slow follow-up invisible | CRM report: created to first activity, median and 90th percentile | Sales ops | 14 days | – |
| B2 | "Facebook", "facebook", "fb" as sources | Split channel reporting | UTM naming sheet; GA4 custom channel group | Ads manager | 30 days | – |
Fix in this order: anything that exposes personal data, then anything that loses lead source or creates duplicates, then CRM process gaps, then feedback uploads, then naming and labels. Once the audit passes, monitor it continuously with the data-quality panel described in our marketing dashboard guide.
Sources
- Tag Manager Help: Preview and debug containers: Tag Assistant shows fired and not-fired tags.
- GA4 Help: Monitor events in DebugView: enabling debug mode; consent limitations.
- GA4 Help: Best practices to avoid sending PII: no email or phone in URLs or parameters.
- Google Ads Help: About auto-tagging: GCLID behaviour and redirect issues.
- Google Ads Help: Offline conversion imports FAQs: 90-day GCLID retention, 63-day limit, daily uploads.
- Google Ads Help: About offline conversion imports: enhanced conversions for leads, Data Manager, 15 June 2026 change.
- PIB: Digital Personal Data Protection Rules, 2025: notified 14 November 2025; phased compliance; purpose-specific consent notices.