An automated GTM audit runs the same fixed checks on every tag, trigger and variable and can be repeated after every change; a manual Google Tag Manager audit adds business context, judgement on unusual setups and a look at the site's code. For most containers the best order is automated first, to clear the mechanical problems, then a person reviewing what is left. Tracking Whisper runs the automated checks, builds fixes in its own workspace for your approval and keeps watching afterwards.
A GTM audit tells you whether the container behind your tracking can be trusted. There are two ways to get one: a person works through the container by hand, or software runs a fixed set of checks against it. Both have a place. This page compares an automated Google Tag Manager audit with a manual audit, shows what each catches and misses, and explains how Tracking Whisper fits in.
What a GTM audit has to cover
Whichever way you run it, a complete audit looks at eight areas, in this order:
- Access. Who can read, edit, approve and publish, and whether former staff or agencies still have access.
- Installation. Whether the container loads once, on every page, in the right place.
- Versions and workspaces. Unpublished changes, unnamed versions, abandoned workspaces.
- Tags. Duplicates, paused tags, Custom HTML with no owner, tags for products that no longer exist.
- Triggers. Unused triggers, triggers on clicks where a success signal is needed, overlapping conditions.
- Variables. Unused variables, fragile DOM scraping, values that should come from the dataLayer.
- Consent. Tags with consent settings left unconfigured. Tag Manager's Consent Overview groups tags into those with and without consent configured.
- Size and security. The Versions page shows a size indicator for large containers, and Google recommends optimising when it goes above 70 percent; community templates and Custom HTML deserve a security review.
Our GTM audit checklist breaks these into 40 checks with a pass or fail for each.
What an automated GTM audit does well
Most of the list above is mechanical. A tag either has consent settings or it does not; a variable is either referenced or unused. Software is good at this kind of work.
- Coverage. It checks every tag, trigger and variable, not a sample. On a container with hundreds of items, a person under time pressure skims.
- Consistency. The same checks run the same way on every container, so two audits a year apart can be compared line by line.
- Speed and repeatability. It can run again after every fix and after every published version, which turns the audit from a yearly event into a routine.
- Cost. Once it is set up, running it again costs very little, which matters for agencies with many clients.
Google's own tools help here too. Tag Diagnostics shows quality issues with Google tags and their severity, and the Tag coverage summary shows which pages are tagged. An automated audit goes further into the container's own configuration.
What a manual Google Tag Manager audit does better
- Business context. A person asks whether you measure the right things: is the main conversion the one sales cares about, is lead value defined, does revenue mean gross or net. No fixed check can answer that.
- Judgement on unusual setups. Single-page apps, several domains in one journey, third-party iframes, server-side containers: an experienced auditor reads the intent behind odd configurations and decides which ones are deliberate.
- The site's code. A manual audit can review how the dataLayer is filled in the theme or the app, talk to developers and find problems that start before GTM is involved.
- Prioritisation and conversation. A good auditor explains which findings matter for your business and walks stakeholders through the report.
Side by side
| Automated GTM audit | Manual GTM audit | |
|---|---|---|
| Checks every tag, trigger and variable | Yes | Depends on time and container size |
| Same checks every time | Yes | Varies by auditor |
| Re-run after each fix or release | Easy | Usually a new engagement |
| Judges whether you measure the right things | No | Yes |
| Handles unusual implementations | Within its checks | Yes, with experience |
| Reviews the site's code and dataLayer source | No | Often |
| Explains findings to stakeholders | Written report | Report and conversation |
| Cost | Low per run | Varies with scope and auditor |
How to combine them
The two work best in sequence. Run the automated audit first and fix the mechanical findings: delete what is unused, add consent settings, remove duplicates. Then bring in a person for what is left, the questions about what to measure and the parts of the setup that do not fit a pattern. The manual audit is shorter and better value because it is not spent counting unused variables. Afterwards, keep the automated checks running so the container does not drift back.
Give the auditor the access they need and no more. Google Tag Manager offers Read, Edit, Approve and Publish per container. Read is enough for an audit; nobody needs Publish to review a container.
What Tracking Whisper does
Tracking Whisper is an AI agent for tracking and analytics that works in Google Tag Manager, GA4, Google Ads and Meta.
- Automated audit. It audits GTM containers with a fixed set of checks across the areas above. See GTM audit.
- Browser checks. It loads key pages in a real browser and checks the dataLayer, the hits sent and the consent state, so the audit covers what actually fires, not only the configuration.
- Fixes after approval. It builds fixes in its own GTM workspace and publishes a version only after a person approves. See tracking setup.
- Monitoring. It watches container versions, key pages and GA4 numbers, and alerts you when something stops or leaves its usual range. See monitoring.
It does not replace the conversation a manual audit brings, and it does not review your site's code; where the site must change, it writes a dataLayer guide for your developers. Pricing is per client a month, with a free plan for one client with read-only Tag Manager access. See pricing.
Next step
Connect a container on the free plan with Read access and run the automated GTM audit; take the remaining findings to a person if they need judgement.
Frequently asked questions
What does a GTM audit check?
A complete audit covers access and permissions, how the container is installed, versions and workspaces, tags, triggers, variables, consent settings, and container size and security. Our GTM audit checklist lists 40 checks in that order, each with a clear pass or fail.
Can an automated GTM audit replace a manual one?
For the mechanical checks, mostly yes: it finds paused and orphaned tags, duplicates, tags without consent settings and unused variables faster and more consistently than a person. It cannot tell whether you measure the right things for your business, or judge an unusual implementation, so a manual review still has a place.
How often should I audit a GTM container?
Run a full audit once a year and whenever the container changes hands, for example when a new agency takes over. Between full audits, automated checks after each published version and monitoring of key events catch most problems.
What access does an audit need?
Read access to the container is enough to see tags, triggers and variables. Google Tag Manager also offers Edit, Approve and Publish. An auditor does not need Publish, and Tracking Whisper can audit with Read access only.
How much does a manual GTM audit cost?
Prices vary with the size of the container, the number of sites and whether a written report and a call are included. Ask for a fixed quote against a clear scope. Tracking Whisper's free plan covers one client with read-only Tag Manager access.
Sources
Last updated by Dimitris.