"Free audit" is the most devalued phrase in marketing services. Half the time it means a junior consultant screenshares your instance for an hour, reads a templated checklist, and hands you a deck whose final slide is a proposal. You didn't get an audit; you got a lead magnet with your logo on it.
That's a shame, because a real audit is one of the highest-leverage things you can do to a marketing stack — precisely because most stacks have never had one. Systems get implemented, admins turn over, tools accrete, and nobody ever goes back to check whether the machine still does what everyone assumes it does.
Here's what a genuine audit covers, what you should walk away holding, and how to tell the real thing from the pitch.
The five layers a real audit examines
However the checklist is packaged, serious audits interrogate the same five layers:
Data flow: where records are born, travel, and die. Every entry point (forms, imports, enrichment tools, sales-created records), every hop between systems, and every exit (unsubscribes, deletions, archival). The audit maps the actual routes — not the diagram from the implementation deck three years ago — because the gap between the two is where most problems live.
Integration health: the seams between systems. Sync scope, sync errors, field mapping drift, and the reconciliation question: do the core counts match across systems, and if not, by how much and why? This layer produces the most urgent findings, because a quietly failing sync corrupts everything downstream of it — reporting, routing, scoring, all of it.
Automation inventory: what's running and why. Every active trigger, batch job, and workflow, each answering three questions — what does it do, what does it touch, does anything still depend on it? Mature instances always contain automation nobody can explain. The audit's job isn't to delete it; it's to document it so someone can safely retire it later.
Measurement integrity: whether the numbers can be trusted. Tracking coverage, UTM discipline, attribution configuration, and whether the reports leadership actually looks at are built on fields that are actually populated. The most common finding here isn't wrong numbers — it's unmeasured activity: campaigns that ran with broken tracking, meaning a year of "results" is a year of guesses.
Cost and utilization: what you pay versus what you use. Database tiers priced for records that are 30% unmarketable, seats nobody logs into, overlapping tools doing the same job, features paid for and never turned on. This is the layer that funds the fixes — it's common for the savings found here to cover the cost of remediation entirely.
Notice what's not a layer: your campaign strategy, your creative, your channel mix. An audit of the stack is about whether the machine works, not whether you're feeding it the right campaigns. Auditors who drift immediately into strategy critique are usually pitching, not auditing.
What you should walk away holding
The deliverable test separates real audits from theater. You should end up with:
A prioritized fix list, not a findings dump. Forty findings ranked "critical" is a sales tactic, not a triage. A real fix list has three attributes per item — impact, effort, owner — and a clear top five. If everything is urgent, nothing was actually prioritized.
Findings you can act on without hiring the auditor. Each item should be specific enough that your own admin, or any competent third party, could execute it. "Improve data hygiene" is a slogan. "1,140 records failing sync on picklist value X; fix the mapping or add the value; one hour" is a finding.
Documentation that outlives the engagement. The automation inventory and data-flow map are worth keeping even if you fix nothing this quarter — they're the instance knowledge that normally walks out the door with each departing admin.
Red flags: the audit that's actually a pitch
A few tells, learned from cleaning up after them:
The findings are suspiciously aligned with the auditor's service catalog. If a firm that sells migrations concludes you need a migration, and a firm that sells managed services concludes you need managed services — the audit was a mirror.
No numbers. Real findings come with counts: how many records, how many failing, how much per year. Vague severity language ("significant gaps in your automation maturity") without quantification means nobody actually counted.
You can't keep the deliverable. If the full findings are only "walked through" on a call and the document requires a signed proposal, it wasn't your audit. It was theirs.
No access, big conclusions. An audit performed entirely from a discovery call — no instance access, no data pulled — is an opinion. Opinions can be useful; they shouldn't be labeled audits.
Everything is critical, and the fix is always them. The honest version of an audit routinely includes findings the auditor can't monetize: things your own team should just do, tools you should cancel, work that belongs with a different specialist. If nothing in the fix list points away from the auditor, be suspicious.
When an audit is worth doing
Four moments where the value is obvious: you've inherited a stack and its institutional knowledge just left; you're planning something big — a migration, a re-platform, a new leadership team — and need current state before committing; renewals are approaching and nobody can defend the line items; or marketing and sales numbers have disagreed for two quarters and the debate has replaced the analysis.
And one honest counter-case: if you're mid-fire — launch week, a compliance incident, a migration in flight — fix the fire first. An audit is a diagnostic, and diagnostics are for when the patient can sit still.
The uncomfortable question to ask any auditor
Including us: "If your fix list is right, what on it should we NOT hire you for?" A real auditor has an immediate answer, because a real fix list always contains items that belong to your own team, your CRM admin, or nobody at all. An auditor who can't name one has handed you a proposal wearing an audit's clothes.
Our version: a stack audit is one call and one week — you get the prioritized fix list and every finding, and they're yours whether or not we ever do the fixes. The deeper engagement, for stacks that need the full five layers documented, is account & stack audits.