CRO Audit: What It Checks, What It Costs, and What You Get

A CRO audit is a structured review of why the people who already reach your site do not do the thing you want them to do. It is not a redesign and it is not a list of opinions about your buttons. It is a diagnosis: which pages lose people, at which step, and what that step costs you per month.

The distinction matters because most of what gets sold as a conversion rate optimization audit is a checklist someone ran past your homepage in twenty minutes. A real one starts from your analytics, not from a template, and it ends with a ranked list of changes, each with a number next to it.

This guide covers what an audit checks, what it costs on the open market, how to run a usable one yourself, and how to tell the two apart when you are buying.

A conversion audit looks at four layers, and skipping any of them produces findings you cannot act on. Most agencies show you the fourth layer because it photographs well, and skip the first because it is tedious. The order below is the order the work has to happen in, not the order it looks impressive in.

The measurement layer. Are conversions tracked at all, on every form, on every path, without double counting? A surprising share of audits stop here because the numbers the client has been reporting for a year turn out to be wrong.

The traffic layer. Which sources bring people who convert and which bring people who bounce. A 1% site-wide rate often hides paid traffic at 4% and an SEO page at 0.2%.

The page layer. Where attention goes, what gets read, where scroll stops, which form fields are abandoned. This is where session recordings and heatmaps earn their keep.

The message layer. Whether the page answers the question the visitor arrived with, in the order they need it answered. This is the layer that moves numbers most and gets audited least.

Market pricing splits cleanly by how much primary research the audit includes, and the gap between the ends is wide enough that the word audit stops being useful on its own. Ask what the deliverable contains before comparing two quotes, because a €600 audit and a €9,000 audit are not the same product sold at different margins.

Three things move the price more than site size: how many distinct conversion paths you have, whether you already have clean analytics, and whether the auditor is expected to test their own recommendations afterwards. The last one is worth paying for, because an auditor who never has to prove a recommendation will hand you twenty of them.

An audit built on broken measurement produces confident conclusions about nothing, which is worse than no audit at all because you will act on them. Before the first heatmap goes on screen, four things have to be true, and checking them takes an afternoon rather than a sprint. If any one fails, fixing it comes first and the audit waits.

• Every conversion fires once, from every path, including the phone link and the PDF download
• Landing-page reports separate organic, paid and direct rather than lumping them
• Internal traffic and bot traffic are filtered out of the property being audited
• At least eight weeks of history exists, so seasonality does not read as a trend

Google's own guidance on conversion tracking setup covers the first two in detail, and it is worth reading before paying anyone to interpret numbers you have not verified.

You can run a usable version of this yourself, and doing so is the fastest way to learn whether you need to buy one. The five steps below are the same sequence a paid audit follows, minus the moderated user sessions, which are the part that genuinely needs an outsider. Budget two days of focused work rather than two hours spread across a fortnight.

1. Build the funnel table. For each landing page: sessions, conversions, rate, and revenue per session. Sort by sessions descending. This table decides everything that follows.
2. Find the biggest absolute loss. Not the worst rate, the biggest loss. A page at 0.8% with 9,000 sessions is worth more attention than a page at 0.1% with 200.
3. Watch twenty recordings of that page. Twenty is enough to see a pattern and few enough to actually do. Write down every point where you wince.
4. Check the page against the question it was built to answer. Read it as somebody who arrived from that exact search. Note where you stop believing it.
5. Write findings as fixes with sizes. "Improve trust" is not a finding. "Move the three client logos above the form, half a day" is.

Nobody audits an entire site in one pass, and the sites that try produce a document that gets read once. Ranking pages by potential rather than by how much they irritate you is the whole discipline, and the ranking is arithmetic rather than judgement. Multiply sessions by the gap between the page's rate and the rate of your best comparable page.

That figure is the ceiling of what fixing the page can return, and it usually puts the pages nobody talks about at the top of the list. In our own client work the highest-value target is almost never the homepage. It is a service page or a category page that receives steady search traffic and was written once, three years ago, by someone who has since left.

An ecommerce CRO audit carries everything above plus the checkout, and the checkout is where most of the recoverable money sits. According to Baymard Institute research, the average documented cart abandonment rate sits around 70%, and a large share of it traces to causes that are cheap to fix rather than to price.

The additional checks are specific: guest checkout availability, total cost visible before the final step, number of form fields between cart and payment, error handling on card decline, and whether the delivery date is shown before the customer commits. Each of those is a single change with a measurable effect, which is why ecommerce audits tend to pay back faster than lead-generation ones.

The gap between the two is visible in the deliverable before you read a word of the findings, and knowing the tells saves you from paying agency prices for a template. A checklist audit talks about best practice. A real audit talks about your numbers. Four questions separate them reliably.

• Does it cite your data? Findings without a session count or a funnel step behind them came from a template.
• Is anything ranked? Twenty unordered findings mean the auditor did not decide what matters.
• Is any finding negative? An audit that says every element needs improving has not looked hard.
• Is there an estimate attached? Not a guarantee. An estimate, with the reasoning shown.

"The audits that change anything are the ones that name the three things to do and say out loud what to ignore." - Vezert conversion lead

The deliverable is the product, so agree on it in writing before the work starts rather than discovering the format at handover. A CRO audit that arrives as a slide deck of observations is not finished, whatever it cost. What you should have in hand is short and specific.

A ranked list of findings, each with the page, the evidence, the proposed change, an effort estimate and an expected range. A test plan for the top three, with the sample size each needs and how long that will take at current traffic. A list of what was checked and found healthy, because that is what stops the next agency from re-auditing the same ground. And a retest date.

If you would rather not run this internally, our conversion optimization work and landing page builds start from exactly this audit, and the findings carry straight into the build.

A CRO audit is worth buying at one specific moment: when you have enough traffic to measure, a rate you suspect is low, and no agreement internally about why. Before that, spend on traffic. After a redesign, wait eight weeks so the data means something. Nielsen Norman Group's work on usability testing remains the clearest argument for why five users find most of what a hundred would.

The audit itself is cheap relative to what it prevents. Most of its value is not the improvements it recommends but the redesign it stops you from paying for.