CRO Audit: What It Checks, What It Costs, and What You Get

A CRO audit is a systematic diagnostic evaluation of your website conversion funnel that combines heuristic UX inspection, quantitative GA4 drop-off analytics, qualitative session recordings, and ICE or PIE hypothesis prioritization to identify exact revenue leaks and rank testable fixes by financial return.

It is not a cosmetic redesign and it is not a list of subjective opinions about your button colors. The distinction matters because most of what gets sold as a conversion rate optimization audit is a generic checklist someone ran past your homepage in twenty minutes. A real diagnosis starts from your raw analytics, verifies whether your current numbers meet a good conversion rate for your traffic mix, and ends with a ranked backlog of changes where every recommendation carries an effort estimate and a projected revenue figure.

This guide covers what an audit checks across all four diagnostic layers, what it costs on the open market, how to run a usable version yourself in Google Analytics 4, and how to separate genuine analysis from a template when comparing agency proposals.

A conversion audit looks at four layers, and skipping any of them produces findings you cannot act on. Most agencies show you the fourth layer because it photographs well, and skip the first because it is tedious. The order below is the order the work has to happen in, not the order it looks impressive in.

The measurement layer. Are conversions tracked at all, on every form, on every path, without double counting? A surprising share of audits stop here because the numbers the client has been reporting for a year turn out to be wrong. We verify Google Tag Manager triggers, thank-you page deduplication, cross-domain checkout parameters, and server-side event parity against actual CRM leads.

The traffic layer. Which sources bring people who convert and which bring people who bounce. A 1% site-wide rate often hides paid search traffic converting at 4.5% alongside an informational blog post converting at 0.2%. Segmenting by acquisition channel, landing page, and device category reveals whether you have a page problem or an audience mismatch.

The page layer. Where attention goes, what gets read, where scroll stops, and which form fields trigger abandonment. This is where session recordings, scroll maps, and field-level form telemetry earn their keep, exposing rage clicks, broken mobile sticky bars, and input validation errors that never show up in standard pageview reports.

The message layer. Whether the page answers the question the visitor arrived with, in the order they need it answered. This is the layer that moves numbers most and gets audited least, covering headline alignment with paid ad copy, pricing clarity, and specific proof placed right beside the primary call to action.

Market pricing splits cleanly by how much primary research the audit includes, and the gap between the ends is wide enough that the word audit stops being useful on its own. Ask what the deliverable contains before comparing two quotes, because a €600 audit and a €9,000 audit are not the same product sold at different margins.

Three things move the price more than site size: how many distinct conversion paths you have, whether you already have clean analytics, and whether the auditor is expected to test their own recommendations afterwards. The last one is worth paying for, because an auditor who never has to prove a recommendation will hand you twenty of them.

An audit built on broken measurement produces confident conclusions about nothing, which is worse than no audit at all because you will act on them. Before the first heatmap goes on screen, four things have to be true, and checking them takes an afternoon rather than a sprint. If any one fails, fixing it comes first and the audit waits.

• Every conversion fires once, from every path, including the phone link and the PDF download
• Landing-page reports separate organic, paid and direct rather than lumping them
• Internal traffic and bot traffic are filtered out of the property being audited
• At least eight weeks of history exists, so seasonality does not read as a trend

Google's own guidance on conversion tracking setup covers the first two in detail, and it is worth reading before paying anyone to interpret numbers you have not verified.

You can run a usable version of this yourself, and doing so is the fastest way to learn whether you need to buy one. The five steps below are the same sequence a paid audit follows, minus the moderated user sessions, which are the part that genuinely needs an outsider. Budget two days of focused work rather than two hours spread across a fortnight.

1. Build the funnel table. For each landing page: sessions, conversions, rate, and revenue per session. Sort by sessions descending. This table decides everything that follows.
2. Find the biggest absolute loss. Not the worst rate, the biggest loss. A page at 0.8% with 9,000 sessions is worth more attention than a page at 0.1% with 200.
3. Watch twenty recordings of that page. Twenty is enough to see a pattern and few enough to actually do. Write down every point where you wince.
4. Check the page against the question it was built to answer. Read it as somebody who arrived from that exact search. Note where you stop believing it.
5. Write findings as fixes with sizes. "Improve trust" is not a finding. "Move the three client logos above the form, half a day" is.

Building a custom Funnel Exploration in Google Analytics 4 turns vague bounce statistics into step-by-step drop-off arithmetic across your highest-traffic journeys. Standard reports only show where users enter and where they leave, hiding the exact micro-step where purchase or lead intent collapses. Setting up a closed funnel with device breakdown exposes whether friction lives in your offer, your form fields, or your mobile layout.

Map the sequence using four to five discrete events: session_start on the target landing page, scroll depth past 50%, form_start (or add_to_cart), and generate_lead (or purchase). Next, apply a breakdown by device category and browser. When mobile conversion sits below 45% of your desktop conversion rate on the same traffic source, the culprit is almost always layout friction: sticky chat widgets covering submit buttons, unoptimized keyboard types on phone inputs, or Interaction to Next Paint (INP) delays exceeding 200 milliseconds.

Speed telemetry and form length directly govern how many visitors survive between step two and step four. According to Portent research on site speed and conversion rates, landing pages that load in 1 second convert at 2.5x to 3x the rate of pages taking 5 seconds. Similarly, reducing lead capture forms from 9 fields to 4 fields typically lifts completion rates by 35% to 50% because every optional input acts as a micro-exit.

Once you have isolated 10 to 15 specific friction points, rank them using either the ICE framework (Impact, Confidence, Ease, each scored 1 to 10) or the PIE framework (Potential, Importance, Ease). High-traffic pages with verified GA4 drop-offs and low engineering effort rise to the top immediately, giving you an objective test queue for A/B testing instead of debating opinions in a meeting.

Nobody audits an entire site in one pass, and the sites that try produce a document that gets read once. Ranking pages by potential rather than by how much they irritate you is the whole discipline, and the ranking is arithmetic rather than judgement. Multiply sessions by the gap between the page's rate and the rate of your best comparable page.

That figure is the ceiling of what fixing the page can return, and it usually puts the pages nobody talks about at the top of the list. In our own client work the highest-value target is almost never the homepage. It is a service page or a category page that receives steady search traffic and was written once, three years ago, by someone who has since left.

An ecommerce CRO audit carries everything above plus the checkout, and the checkout is where most of the recoverable money sits. According to Baymard Institute research, the average documented cart abandonment rate sits around 70%, and a large share of it traces to causes that are cheap to fix rather than to price.

The additional checks are specific: guest checkout availability, total cost visible before the final step, number of form fields between cart and payment, error handling on card decline, and whether the delivery date is shown before the customer commits. Each of those is a single change with a measurable effect, which is why ecommerce audits tend to pay back faster than lead-generation ones.

The gap between the two is visible in the deliverable before you read a word of the findings, and knowing the tells saves you from paying agency prices for a template. A checklist audit talks about best practice. A real audit talks about your numbers. Four questions separate them reliably.

• Does it cite your data? Findings without a session count or a funnel step behind them came from a template.
• Is anything ranked? Twenty unordered findings mean the auditor did not decide what matters.
• Is any finding negative? An audit that says every element needs improving has not looked hard.
• Is there an estimate attached? Not a guarantee. An estimate, with the reasoning shown.

"The audits that change anything are the ones that name the three things to do and say out loud what to ignore." - Vezert conversion lead

The deliverable is the product, so agree on it in writing before the work starts rather than discovering the format at handover. A CRO audit that arrives as a slide deck of observations is not finished, whatever it cost. What you should have in hand is short and specific.

A ranked list of findings, each with the page, the quantitative evidence, the proposed change, an engineering effort estimate, and an expected conversion range. A statistical test plan for the top three hypotheses, specifying the minimum detectable effect (MDE), the required sample size per variant at 95% confidence and 80% statistical power, and how many weeks that test will require at current traffic. A list of what was checked and found healthy, because that is what stops the next agency from re-auditing the same ground. And a scheduled retest date.

If you would rather not run this internally, our conversion optimization work and custom landing page builds start from this exact diagnostic process, with transparent scope and pricing before any build begins.

A CRO audit is worth buying at one specific moment: when you have enough traffic to measure, a rate that sits below a good conversion rate for your industry, and no agreement internally about why. Before that threshold, spend your budget on qualified traffic. After a major redesign, wait eight full weeks so your seasonal and channel data means something. Nielsen Norman Group's work on usability testing remains the clearest argument for why five users find most of what a hundred would.

The audit itself is cheap relative to what it prevents. Most of its financial value is not just the lift from the top three hypotheses you validate through A/B testing, but the €15,000 to €40,000 blind redesign it stops you from paying for when only two funnel steps were actually broken.