Will the CRO audit sitting in your inbox actually tell you anything true, or is it another deck of page opinions with no numbers checked underneath? A client asked me exactly that after paying for one: it opened with twelve slides on button colour, hero copy and above-the-fold layout, and nowhere in those twelve slides did anyone check whether the "conversion rate" the whole report was built on was even being measured correctly. It was not. The purchase event was firing twice on a meaningful share of orders, enough that the baseline the entire audit was optimising against was wrong before a single recommendation got written. Whether you are about to commission a CRO audit or have just been handed one, I want to help you tell a real one from a templated PDF with your logo dropped in.
a conversion rate optimisation (CRO) audit is a review of why visitors do not complete a purchase or a lead form, and what to fix first. A real one runs in a specific order because each layer depends on the one before it: measurement (is the data trustworthy at all), then the funnel (where people actually drop), then the pages (what is happening at that drop point), then a qualitative layer (why), then a single ranked list of what to fix and roughly what it is worth. This article covers each stage in that order, what goes wrong when audits skip straight to page opinions, when a CRO audit is not what you need yet, a checklist you can run over an audit you have already been sold, and the questions worth asking whoever is selling you one.
It is a buyer's guide rather than a how-to-run-one, though the order below is exactly what I follow when I run these myself.
Why the order matters more than the content
Every stage of a CRO audit depends on the layer beneath it being sound. Get the measurement wrong and the funnel numbers built from it are wrong too, which means the page you get told is "underperforming" might not be the real problem. Send the qualitative work (session recordings, heatmaps, surveys) at the wrong page, and the audit spends its budget explaining a symptom instead of the cause.
Most of what gets sold as CRO is page opinions with no foundation checked underneath them. It reads well in a deck. It rarely survives contact with the actual account.
Stage one: is the measurement trustworthy at all
This is the stage almost every audit I have reviewed skips, and it is the one that should come first.
Before anyone looks at a single page, the question is whether the number being called "the conversion rate" is real. Four things get checked here:
Consent handling. If cookie consent is not wired correctly, a meaningful share of sessions never get measured at all, and the sessions that are missing are not random. They skew towards whichever region or browser handles consent differently, which quietly biases every number downstream.
Duplicate events. A purchase or lead event firing more than once per transaction is common and easy to miss, because it does not throw an error, it just inflates the count. On 18 Carati, a Magento jewellery retailer, part of the wider audit and prototype programme we ran was rebuilding the GA4 ecommerce tracking end to end: six events rebuilt, four consent signals configured correctly. None of that appears in a screenshot of a landing page, but it decides whether every other screenshot means anything.
Missing events. The opposite problem: a step in the funnel that never gets recorded, usually because a checkout redirect or a payment provider takes the customer off-domain and the returning hit does not fire. This one is quieter than duplication because it does not inflate anything, it just makes a real step disappear from the report.
Does the reported number match reality. The blunt check: pull the order count from the store's own admin for a given week and compare it to what analytics reported for the same week. If they do not match within a sensible margin, nothing else in the audit can be trusted until that gap is explained.
I have seen this often enough to know that skipping this stage does not save time. It just means building the rest of the audit on a number nobody has checked.
Stage two: where the funnel actually drops
Once the measurement is trusted, the next question is where in the journey people are leaving; not why yet, just where.
This means pulling the standard steps (landing, product view, add to cart or basket, checkout start, payment, confirmation) and looking at the percentage that survives each one over at least two to four weeks, not two to four days. A single bad day skews this badly, particularly for stores where weekday and weekend behaviour genuinely differ.
The output of this stage is a handful of candidate problem points, nothing more elaborate than that. If 40% of sessions add to basket but only 8% start checkout, that gap is the story, and everything after this stage exists to explain that one number.
Stage three: what the pages are actually doing at that point
This is where most CRO audits start, and it only makes sense once you know which page you are looking at and why.
At the identified drop point, the audit looks at load speed on that specific template, form friction (how many fields, how many required, how many optional), trust signals near the decision (reviews, returns policy, delivery cost visibility), and whether the page actually answers the question the visitor has at that stage of the journey. On Periodico, a Shopify storefront BYLT runs headless on Next.js, part of the conversion-path work was rebuilding the product page itself: a proper mobile gallery with real colour swatches, one-tap buying, and the measurement table auto-structured instead of buried in a description field. That is page-level work, and it is real, but it only mattered because the drop point it addressed had already been identified in stage two. Doing that work on a page nobody was actually leaving from would have been effort spent on the wrong problem.
One pattern worth watching for specifically: an audit that spends its budget on the homepage because the homepage is easy to have opinions about, while the actual leak is three steps into checkout on mobile Safari. Homepages are the page every stakeholder has looked at, so they attract the most confident opinions and the least evidence. If an audit's page-level section is heavier on the homepage than on the step where your own funnel data says people leave, that is worth asking about directly.
Stage four: the qualitative layer, and why it comes fourth
Session recordings, on-site surveys, and heatmaps are genuinely useful, and they are also the layer most commonly used to skip the first three. Watching a handful of recordings without knowing which page and which step to watch is entertainment. It tells you nothing about what to fix.
Used properly, qualitative evidence explains a drop the data has already shown you. If checkout abandonment spikes at the shipping-cost step, recordings of that specific step will usually surface the actual friction: people opening a new tab to check a competitor's shipping cost, or hesitating on a delivery estimate that reads as vague. Watched with no prior hypothesis, the same recordings just produce anecdotes.
We rebuilt the booking flow for Le Torri di Porsenna, a hospitality client, and the direct-booking gain came from work grounded in a specific, already-identified point in the booking journey where guests were dropping to third-party platforms. The brief was that specific from day one rather than a vague "improve the booking experience" request.
Stage five: the final ranked list
The final stage is the one that decides whether the previous four were worth doing. A good audit ends with a small number of prioritised recommendations, each with an estimate of the size of the opportunity and the effort to fix it. A bad one ends with a spreadsheet of sixty items in no particular order, and that is what quietly costs clients time for weeks after the audit lands. Nobody ships sixty things. Somebody ships the top three, and if the audit did not tell you which three, you are guessing with the same information you had before you paid for it.
A useful ranked list answers three questions per item: how big is the underlying problem, using the funnel data from stage two rather than an educated guess, how confident is the auditor that the fix addresses the actual cause (based on stages three and four), and roughly how much work is it. Sort by the first two. Do not sort by which fix is easiest to build a slide around.
When a CRO audit is the wrong tool right now
Not every store is ready for one, and an honest audit will say so before it says anything else.
If traffic is too low for the numbers to mean anything. A funnel built on a few hundred sessions a month will bounce around from week to week regardless of what changes on the page. Fix acquisition first, or accept that any CRO recommendation is closer to a guess than a finding.
If the store is mid-migration or mid-rebuild. Auditing a checkout that is about to be replaced wastes the audit on a version of the site that will not exist in a month.
If nobody can act on the output. With no developer time or design capacity to ship even the top three findings, an audit produces a document that sits in a drive somewhere. Worth being honest about before commissioning one.
Checklist: what to look for in an audit before you buy it
- Does it start by testing the measurement, or does it assume the analytics is correct and move straight to opinions?
- Is the funnel broken down into individual steps with a percentage surviving each one, over at least two to four weeks?
- Are page-level findings tied to a specific step identified in the funnel data, or are they general observations that could apply to any site in the category?
- Does any qualitative evidence (recordings, surveys) reference a specific step, or is it presented as standalone anecdote?
- Does the final output rank recommendations by size of opportunity, or is it a flat list?
- Can the auditor show you the raw event data, not just a dashboard screenshot?
Questions to ask whoever is selling you the audit
- "Can you show me a purchase event firing in DebugView or the equivalent, right now, on my site?" If they cannot, they have not verified the number the whole audit rests on. For what it is worth, this is not a gotcha question: I run that exact check myself, live, in every audit before writing anything down.
- "How many weeks of funnel data is this based on?" Two days only tells you about two days.
- "Which specific step is each page recommendation addressing?" If the answer is vague, the recommendation was probably written before the funnel data was pulled.
- "What are the top three things to fix first, and why those three?" A confident, specific answer here is the clearest signal you are talking to someone who did the work in order. Someone who skipped straight to the deck usually hedges instead.
If you want the measurement layer checked properly before anyone forms an opinion about your pages, that is the order BYLT runs a CRO audit in, and it is the same discipline behind the tracking rebuild on 18 Carati, the product-page work on Periodico, and the booking-flow work on Le Torri di Porsenna.
