The most expensive sentence in analytics is "we set that up already." Setups are claims. Verification is evidence. And the standard verification most teams do, clicking through GTM preview mode and seeing green checkmarks, is not evidence of anything except that the tag can fire in ideal conditions for a logged-in employee with consent granted and no ad blocker.
Your customers do not browse in ideal conditions. Here is the procedure I actually run, in order, on every audit.
Layer 1: watch the network, not the tool
Open your site in a normal browser window, open developer tools, go to the network tab, and filter for collect. GA4 hits go to an endpoint containing /g/collect. Now do the thing you want measured: load a page, add to cart, buy something on staging if you have it.
You are checking four things:
- The request exists. No request, no data, whatever any preview pane claims.
- The event name is right. Look at the
enparameter in the request. - The values are right. For a purchase, the transaction ID, value, and currency should match the order you just placed. Empty or null values here are silent report killers.
- It fires once. Two identical requests means duplicate tags, and every number in your property is inflated.
This takes ten minutes and finds more real problems than any other single check I know.
Layer 2: DebugView, for the parameter detail
GA4's DebugView (Admin, then DebugView) shows events arriving in near real time with their full parameter payloads, either from a device with debug mode enabled or while GTM preview is connected. Use it to confirm the parameters GA4 actually received, not just what the browser sent: mistyped parameter names and unregistered custom dimensions show up here as missing or ignored values.
One warning. DebugView shows your test device. It says nothing about whether real users' events arrive. That is what layers one and three are for.
Layer 3: reconcile against a source of truth
Pick last full week. Count purchases in GA4. Count orders in Shopify, WooCommerce, your backend, wherever the money actually landed. Compare.
There will be a gap. There is always a gap: ad blockers, declined consent, browser privacy features, and people who bought before your last fix all live in it. The point is not zero gap. The point is that you know the number. A stable gap in the low range is measurement reality. A gap that jumped after a release is a bug with a date attached. A gap nobody has ever measured is a business running on hope.
Do not skip this because it is unglamorous. It is the only check that catches problems in the majority of traffic you never personally test: other devices, other browsers, other countries, other consent choices.
The consent-state test everyone skips
Run layer one twice more: once after declining the consent banner, once after accepting. With consent declined, check what still fires. Depending on your setup and whether Consent Mode is configured correctly, GA4 hits may legitimately continue in cookieless form or should stop entirely; what must not happen is business as usual with full identifiers. If declining changes nothing about your network traffic, your banner is furniture, and that is a compliance problem before it is a data problem. I wrote that failure mode up separately in what your consent banner isn't blocking.
When: after every release, not once
Tracking does not stay verified. Every deploy, redesign, new banner, and new plugin can break assumptions silently. The realistic cadence for a small team:
- Full three-layer check after any release touching templates, checkout, or the tag container.
- The reconciliation check monthly, on a calendar reminder, because it is the one that catches what you did not think to test.
- An event-list review quarterly, hunting duplicates and orphans.
If you run this once and find a mess larger than an afternoon can fix, that is the point where a structured audit makes sense: everything that fires, mapped against everything that should, with the fixes prioritized by money touched. That is literally the Clarity engagement I sell, and the reconciliation gap from layer three is how you will know whether it paid for itself.