Marketing Operations Audit Checklist: Tests and Template

A marketing operations audit checklist should follow a campaign from its first tagged click through form submission, marketing automation, CRM assignment and revenue reporting. The point isn't to count how many tools you own. It's to prove that the handoffs between them work, identify the failures that matter and assign each fix to someone who can close it.

Use this audit when campaign reports don't match CRM records, leads go missing, source fields drift or a new marketing leader inherits a stack without a trustworthy process map. You'll get a repeatable test method, a copyable worksheet and a way to prioritize findings without pretending that every failed checkbox has the same impact.

What belongs in a marketing operations audit?#

A marketing operations audit covers campaign setup, measurement, conversion capture, automation, CRM handoffs, reporting and operating controls. A website performance review alone won't show whether a qualified lead reached the right salesperson, and a CRM hygiene report won't show whether the original campaign source survived the trip.

The most useful unit of inspection is a data handoff. For each handoff, name the system that creates the data, the one that receives it, the field or event that carries it, the owner and the proof that the transfer worked.

1. 01Campaign link
   Breaks when Confirm approved UTM values and the final destination.
2. 02Landing page
   Breaks when Verify page, consent state and key-event instrumentation.
3. 03Form and automation
   Breaks when Check successful submission, record identity and workflow entry.
4. 04CRM handoff
   Breaks when Confirm assignment, stage and source-field persistence.
5. 05Reporting
   Breaks when Reconcile event, lead and opportunity definitions.

A practical audit distinguishes three types of evidence. Configuration evidence is a screenshot of a setting. Transaction evidence is a test record or event that passed through the workflow. Outcome evidence is the downstream record or report that a stakeholder uses. A green toggle is useful, but it isn't proof that a customer-facing journey works, and it's certainly not outcome evidence.

Define scope before opening the dashboards#

Write down the campaign family, the business outcome, the systems in scope and the date range. Assign a marketing operations owner and a sales or RevOps reviewer. Pick at least one high-value path, one failure path and one returning-contact path. You'll learn the most from the failure path. If the business has regional consent rules or multiple CRM instances, treat those as separate paths rather than averaging them away.

For a first pass, inspect a recent campaign with a landing page, a form, a follow-up workflow and a CRM owner. If the team can't identify that chain, the missing system map is already a finding.

The marketing operations audit checklist#

The checklist below is a working control set. It's not a regulatory standard or a vendor certification. Mark each item Pass, Fail, Partial or Not applicable, and attach a link to the evidence. Don't mark a check as passed just because someone remembers testing it last quarter.

Campaign intake and naming#

Campaign intake is healthy when every live campaign has an approved purpose, an owner and consistent identifiers. Inspect a real brief and its actual published links, not only the template that the team's supposed to use.

Google Analytics describes manual tagging as adding UTM parameters to final URLs so acquisition reporting can identify source, medium and campaign. A naming policy doesn't help if redirects strip those parameters or if the CRM overwrites the values later, which happens more than you'd think. Test the full URL rather than reviewing a spreadsheet of approved names.

Analytics and consent instrumentation#

Analytics controls pass when a test action produces the intended event and parameters under the expected consent state. Inspect both what the browser sends and what the analytics property receives. Google recommends DebugView for checking event and parameter delivery, while Tag Assistant can expose tag and consent configuration problems. Our step-by-step guide to using Google Tag Assistant shows how to run that check.

Consent deserves its own negative test. Google's consent debugging guide describes a failure in which a tag reads or writes a cookie before the default consent state is set. Test accept, reject and changed-preference journeys under the regions that matter to you. Consent-mode behavior isn't a substitute for a legal review of your actual processing and jurisdiction, and it'll never be one.

Google's Analytics policy also prohibits sending information that identifies an individual, including email addresses, into Analytics. Inspect page URLs, event parameters and hidden form fields for accidental personal data before treating tracking as clean.

Forms and marketing automation#

A form audit passes when a submitted test lead becomes the correct record, enters the intended workflow and receives the expected follow-up without creating an unwanted duplicate. Test the happy path, a validation error and a returning contact. The failure path is where teams often confuse a button click with a completed submission, and it's easy to do.

Identity rules are product-specific, so they're worth a close look. HubSpot's form documentation says that enabling automatic creation from unknown email addresses creates a contact for a unique submitted email, while other settings can associate a submission with an existing record. Audit the settings in your own portal and verify the resulting record. Don't lean on a generic assumption about how every form behaves.

For notifications, inspect the destination and its owner. HubSpot's form settings documentation notes that its contact-owner notification won't send if the contact has no owner. The broader lesson's operational: a successful form submission isn't the same thing as a staffed sales queue.

CRM ownership and lifecycle#

A CRM handoff passes when the right record arrives with the right owner, stage and campaign context. Sales and marketing should agree on the definitions before they compare counts, and they'd better write them down. A dashboard discrepancy may reflect different stage rules rather than a broken integration, so don't assume a bug.

Salesforce lets admins set a default lead owner in Lead Settings, which acts as the fallback when assignment rules don't apply. That fallback's a useful audit target, but a default owner doesn't guarantee someone follows up. Check how the queue's monitored and what the actual assignment history shows.

HubSpot documents both standard and custom lifecycle stages and settings that can update stages automatically. If marketing calls a lead qualified while sales treats the same stage as unworked, the audit needs a definition and ownership fix before anyone changes a workflow.

Reporting and reconciliation#

Reporting passes when the team can explain the differences between platform events, unique leads, accepted leads and pipeline records. Counts won't necessarily match because those entities represent different things. The audit should document the expected relationship. It shouldn't ignore unexplained gaps.

Google Analytics documents source, medium and campaign dimensions and also supports configurable attribution settings and key-event lookback windows. Don't compare a session-based source report directly with a CRM first-touch field and call the difference a defect. First write down which touchpoint, identity and time window each report represents.

Governance, privacy and recovery#

Governance controls pass when changes are owned, access is appropriate and broken journeys get found before a stakeholder notices missing leads. Check the incident path as well as the original implementation. A perfectly documented campaign that fails silently still creates operational risk, and that's the case people miss.

For US commercial email, the Federal Trade Commission says that senders must offer a working opt-out and honor requests within ten business days. Its guidance also addresses truthful headers, nondeceptive subjects and a valid postal address. Check the current FTC CAN-SPAM compliance guide and get legal advice where needed. An operations checklist can flag a failure, but it can't determine all legal obligations for every campaign, so they're yours to confirm.

How to test a complete campaign journey#

A complete campaign journey test starts with a real landing-page link and ends with evidence in the receiving system. Running isolated tag checks isn't enough because each component may work while the connection between components fails. That's exactly where leads vanish. Use a synthetic contact and tell sales, so the test doesn't trigger a real customer outreach.

1. Freeze the test scenario

   Record the campaign URL, approved UTM values, expected form, intended lifecycle stage and receiving owner. Use a synthetic email and a clear test label.

2. Observe the browser path

   Open the link with a clean session. Inspect redirects, consent behavior and the analytics event in a debugging view. Save timestamps and a screenshot or event payload.

3. Submit and inspect the record

   Submit a valid test lead, then repeat with an invalid field. Check the actual form response, deduplication behavior and marketing automation enrollment.

4. Follow the CRM handoff

   Locate the resulting CRM record. Compare owner, lifecycle stage, original campaign fields and assignment history against the expected result.

5. Reconcile the reporting path

   Confirm the test is visible where it should be and absent where it shouldn't be. Note reporting latency and exclusions before declaring a mismatch.

6. Close the test with evidence

   Attach the test record, event evidence and the reviewer sign-off. If a step fails, record the exact boundary and assign the fix.

A useful negative test is a valid form submission with a missing routing attribute. The form may create a record, but it can sit in a fallback queue. Record the fallback owner, alert and escalation path. The non-negotiable outcome is that a real lead has a monitored destination. A CRM ID isn't enough.

Example: a lead that appears in analytics but not in the sales queue#

Imagine a webinar campaign where analytics registers a successful form event, the marketing platform creates a contact and the CRM shows no new assigned lead. The audit shouldn't begin by replacing analytics, since it's rarely the culprit. First compare the form submission ID with the marketing contact ID, inspect the sync mapping and check whether a deduplication rule updated an existing CRM contact instead of creating a new lead.

Next, inspect the lifecycle-stage rule and the queue assignment criteria. If the record's under a different object or owner, fix the handoff or reporting definition. If nothing arrived, capture the failed sync event and escalate it to the integration owner. That's the clean path. Re-run the same synthetic scenario after the repair.

Copyable marketing operations audit worksheet#

A marketing operations audit worksheet needs an explicit pass condition, observed evidence, owner and retest date. A simple row-per-control format is far more useful than a colored scorecard with no underlying proof. Copy the following table into a spreadsheet and add rows for your campaign-specific integrations.

Marketing operations control	Pass condition	Evidence to attach	Owner	Result
Campaign URL and UTMs	Published link preserves approved values	Final URL and redirect capture	Demand gen	Not tested
Analytics key event	Intended event appears once for successful action	Debug event and parameter view	Analytics	Not tested
Form to automation	Valid test creates or updates intended contact	Form submission and contact ID	Marketing ops	Not tested
Automation to CRM	Record arrives with expected owner and stage	CRM record and assignment history	RevOps	Not tested
Campaign reporting	Record and event counts reconcile by definition	Report filters and sample IDs	Analytics	Not tested
Consent and suppression	Configured behavior matches reviewed requirements	Consent and unsubscribe test evidence	Privacy owner	Not tested

The worksheet is deliberately blank. A team shouldn't mistake the example rows for completed tests, and it mustn't copy a fictional pass result into its audit log. Add the systems, field names and actual evidence links used in your environment.

Add a finding register next to the worksheet#

For every Fail or Partial result, create a finding with the failing boundary, a reproducible test, business consequence, named owner, proposed repair and verification method. Keep the finding separate from the checkbox. A checkbox describes the control; the finding records what went wrong and how the team will prove it was fixed.

Use these columns: finding_id, campaign, system_from, system_to, control, expected, observed, evidence_url, severity, owner, due_date, retest_status. A screenshot without a test ID or timestamp is weak evidence because the next reviewer can't reproduce what you saw.

How to score and prioritize audit findings#

Prioritize audit findings by business impact and failure propagation, not by the number of red cells. A lost form submission affects revenue capture directly, while inconsistent capitalization in a campaign name usually affects reporting hygiene. A privacy or security issue may need immediate escalation regardless of its lead volume, because it's a different class of risk.

Use the following editorial triage rules. They're a proposed operating model, not published industry benchmarks.

Marketing operations severity	Example	First action	Proof of closure
Critical	Valid submissions never reach a monitored CRM destination	Escalate to marketing ops and sales owner	Successful end-to-end retest
High	Campaign source is lost across a major integration	Assign mapping fix and impact analysis	Source persists on test records
Medium	One dashboard uses an outdated stage definition	Correct definition and document filters	Reviewed report matches agreed logic
Low	Noncritical naming label varies in archived assets	Add to governance backlog	Naming review completed

A useful severity decision considers whether the defect affects all campaigns or only a subset, whether there's a working fallback and whether anyone can detect it quickly. A small failure on the highest-value lead path can easily outrank a broad cosmetic problem.

Don't average away a broken journey. A campaign can pass every documentation check and still fail the single test that matters: whether a qualified contact reaches an accountable owner. Treat critical-path failures as their own escalation lane, even when the overall checklist looks healthy. It's the only safe way.

Who owns each marketing operations audit control?#

Ownership should follow the boundary where a failure occurs, and that's rarely the team that noticed it. Demand generation owns the approved campaign intent, analytics owns event definitions, marketing operations owns automation behavior and RevOps or sales operations owns CRM routing. IT and privacy teams join when access, data protection or infrastructure is involved.

Marketing operations boundary	Accountable owner	Supporting reviewer	Handoff evidence
Campaign brief to tagged link	Demand gen	Marketing ops	Approved URL and naming record
Landing page to analytics	Analytics	Web engineering	Event debug trace
Form to marketing automation	Marketing ops	Web engineering	Submission and contact record
Marketing automation to CRM	RevOps	Marketing ops	CRM assignment history
CRM to executive dashboard	RevOps	Finance or analytics	Metric definition and filter review
Consent and email suppression	Privacy owner	Marketing ops	Approved rule and negative test

A named owner isn't enough if that person hasn't got permission to fix the system. For each critical boundary, record who can make the change, who approves it and who verifies it. Keep separation between changing a rule and signing off on the retest where the risk warrants it.

When should a marketing operations audit run?#

A marketing operations audit should run before a high-impact launch, after a major stack change and whenever lead or revenue reporting becomes unreliable. Use a lightweight recurring check for critical journeys and a deeper review when processes, ownership or data models change. The right frequency depends on campaign volume and risk. There's no universal calendar rule.

A practical cadence is to smoke-test live forms and routing frequently, review source and stage drift at a regular operations meeting and perform a full boundary-by-boundary review after material changes. Keep a baseline test that can be replayed after each release. That baseline's often more valuable than a large annual questionnaire nobody's got time to repeat.

How the audit becomes continuous monitoring#

One-off audits find the defects present on inspection day. Monitoring detects whether the same boundary breaks again when a page is republished, a tag changes or a CRM field is remapped. The two practices complement each other, and they're not rivals: audits define expected behavior and monitoring checks it between reviews.

A campaign monitoring product can watch a selected journey between formal audits, but it won't replace an owner, an approved data dictionary or a legal review. Keep human sign-off for changes to forms, CRM assignments and consent configuration. You'll want a person accountable.

Common marketing operations audit mistakes#

The most damaging audit mistake is testing settings rather than outcomes. A tag can be published, a workflow can be active and a CRM connector can show a green status while a real lead is lost at a conditional branch. The audit has to prove the transaction. The configuration alone isn't evidence.

Another mistake is treating every mismatch as data loss. Analytics sessions, form submissions, unique contacts and sales-accepted leads aren't interchangeable units. Document their definitions, filters and identity rules before deciding that a difference is a bug.

A third mistake is collecting evidence without an owner or a retest. The audit ends only when the business accepts the residual risk or the repaired path passes again. That's the finish line. An unresolved finding with no due date is simply a forgotten observation.

Reporting is one of the areas this audit touches, and the marketing report template gives you a monthly and weekly format with a data check before sending.

Marketing operations audit checklist FAQ#

The marketing operations audit checklist FAQ addresses scope, evidence, cadence and ownership. Use these answers to decide whether a quick campaign smoke test is enough or a full data-flow audit is warranted.