The confidential audit checklist: 17 things we check in every account

Before we take on any account, we run the same audit. Seventeen checks, four layers, no exceptions — whether the account spends $5K or $80K per month, whether it runs Meta, Google, or both. The point of a fixed ppc account audit checklist is not thoroughness for its own sake. It is that account failures are repetitive: after enough audits, you learn that the same seventeen defects explain most of the wasted spend, and that skipping a "probably fine" check is exactly how the expensive one gets missed.

This is the full list. Each check has a pass criterion and exists because of a specific failure pattern we have found — usually more than once. The four layers are ordered by dependency: structure problems corrupt attribution, attribution problems corrupt creative decisions, and all three corrupt unit economics.

Layer 1: Structure — where the money physically flows

1. Conversion volume per learning unit. We compute weekly conversions per ad set and per campaign. Pass: the core ad sets each receive 30–50+ conversions per week. Fail looks like a $40K account spread over 15 ad sets, every one permanently in learning, the platform guessing at the advertiser's expense. This single check predicts more of an account's fixable upside than any other.

1. Campaign role clarity. Every campaign must have one stated job: prospecting, testing, retargeting, or brand defense. We ask what each campaign is for and check whether budget behavior matches the answer. Accounts accumulate campaigns the way attics accumulate boxes; overlapping roles mean the platform arbitrates internally and the advertiser pays the spread.

1. Audience overlap and self-competition. We check exclusion logic between prospecting and retargeting, and between "different" prospecting ad sets. Pass: clean exclusions or deliberate consolidation. Fail: three ad sets bidding on the same users, inflating each other's CPMs and splitting the same conversions three ways in reporting.

1. Budget allocation vs. stated strategy. We map actual 30-day spend by campaign against what the team says its priorities are. The gap is routinely 30–40 points — a team that says "we're focused on new customer acquisition" with 45% of spend in retargeting and brand search. The account does what the budget does, not what the deck says.

1. Search-side hygiene (where Google runs). Search term reports, match type discipline, negative lists, and what PMax is actually cannibalizing from branded search. Pass: negatives maintained within the last 30 days and branded traffic measured separately from non-brand. We have found accounts where 25–35% of "non-brand" PMax revenue was branded queries the account would have won free. Details of how we rebuild this live on our Google Ads service page.

Layer 2: Attribution — whether the numbers can be believed

1. Server-side event coverage and deduplication. CAPI (Meta) and enhanced conversions (Google) present, firing, and deduplicated against browser events via event_id — verified in Events Manager, not taken on faith. Fail: double-counted purchases quietly halving apparent CPA, or missing server events starving the model of 15–25% of true conversions.

1. Event Match Quality and identifier completeness. Purchase EMQ of 8+ on Meta; hashed email, phone, and address passed from the order object. Below 6, the platform cannot connect conversions to people, and every optimization decision downstream degrades invisibly.

1. Revenue reconciliation. Platform-claimed revenue summed across channels and compared against the order system for the same 28 days. Pass is not a specific ratio — over-claim is normal — pass is that the team knows the ratio and uses it. Fail is the common case: nobody has ever run the comparison, and the account scales on numbers that sum to 160% of actual revenue.

1. Attribution settings sanity. Click and view windows, GA4 model settings, consent mode status, and whether reporting mixes attribution windows across channels in one dashboard. A 7-day-click Meta number sitting next to a 30-day-click Google number in the same "ROAS" column is not a dashboard; it is a category error. What replaces it is a triangulated reporting layer, and the reconciliation math from check 8 feeds directly into Layer 4.

Layer 3: Creative — where the leverage actually is

1. Concept diversity, not asset count. We cluster the live ads by actual concept — angle, format, hook — rather than counting files. Pass: 5+ genuinely distinct concepts in rotation on the core spend. Fail: forty "ads" that are one video in six crops and seven headline swaps, meaning the account has one bet and rising frequency on it.

1. Fatigue exposure and concentration risk. Share of spend on the top concept, its frequency trend, and its CPA trend over the trailing 60 days. When one concept carries more than ~50% of spend and its CPA has drifted up two consecutive fortnights, the account is standing on a trapdoor. We quantify how much spend is at risk if that concept dies this month.

1. Testing cadence and kill discipline. Evidence of a working pipeline: new concepts launched on a regular rhythm, a fixed testing budget, and — the part almost everyone fails — written thresholds for promoting winners and killing losers. Pass: decisions traceable to numbers. Fail: ads paused "because it felt done" and winners discovered by accident. Our creative analytics service exists because this layer is where most accounts have the largest gap between effort and system.

1. Message-to-landing-page match. We click the top ten ads by spend and grade whether the landing page continues the ad's promise, offer, and specificity. A 20% mismatch here wastes more money than most bidding mistakes, and it never shows up in platform dashboards because the platform's job ended at the click.

Layer 4: Unit economics — whether winning the auction is worth it

1. CAC targets derived from margin, not habit. We ask where the target CAC came from and reconstruct it from contribution margin: AOV, COGS, shipping, payment fees, returns. In roughly half of audited accounts the target is inherited folklore — a number someone set two pricing changes ago. An account can hit its CAC target every month and lose money on every order.

1. Cohort payback and value segmentation. Does the team know 60- and 90-day revenue per customer by acquisition channel and entry product? Pass: a cohort table exists and CAC ceilings differ by segment. Fail: one flat target treating a $28 discount-hunter and a $140 full-price customer as equal — which caps the account at whatever the average supports, and is a leading cause of the plateau pattern we see in local lead-gen accounts as much as in e-commerce.

1. Marginal economics of the last dollar. Blended MER trend against spend level over the trailing 90 days. Average ROAS can look healthy while marginal ROAS — what the last $5K of monthly spend returned — is below 1. We estimate the marginal curve from spend-step history; accounts that scaled in large jumps make this easy to see and painful to read.

1. Concentration and dependency risk. Share of revenue from one platform, one campaign, one concept, one product. Anything above ~70% on a single point of failure gets flagged with a cost to diversify. This is the check that turns an audit from a performance document into a risk document, and it is the one founders thank us for a year later.

What the findings document looks like

The output is not a 60-slide export. It is a short document with a fixed shape:

• A scored summary — each of the 17 checks marked pass, partial, or fail, with one line of evidence per mark. No prose padding.
• Quantified findings, ranked by money. Each fail carries an estimate: "retargeting over-attribution ≈ $4–6K/month of spend with unproven incrementality," "fragmented structure ≈ 20–30% CPA premium vs. consolidated benchmark." Estimates are ranges, and we show the arithmetic.
• A sequenced fix list, ordered by dependency and effort — measurement before structure, structure before scaling — with the two or three items that justify their cost in the first month marked explicitly.
• What we would not touch. Every account has things that work. Saying so is what separates an audit from a sales document.

A ppc account audit checklist stays the same because the failures stay the same. What changes per account is which layer is bleeding and how much. If you want this run against your account — same seventeen checks, same scoring, under NDA — that is exactly what the confidential audit is.