How to Audit Your Ad Attribution Setup: A Step-by-Step Guide for Ecommerce Brands

An ad attribution setup audit isn’t something most teams schedule on purpose.

It usually happens by accident, someone notices the numbers don’t add up, goes looking for why, and ends up doing an audit whether they meant to or not.

Running one deliberately, on a schedule, catches the same problems before they’ve already cost a quarter of bad budget decisions.

Signs Your Attribution Setup Needs an Audit

The clearest signal is a persistent, unexplained gap between what a platform reports and what actually landed in the bank account. A little discrepancy is normal, every platform measures differently.

A growing or erratic one usually means something in the setup itself is broken, not just biased.

A few more specific tells: your paid social team and your finance or analytics team disagree about whether tracking is “basically fine,” and neither can point to hard evidence either way.

Reported conversions moved sharply after a platform announced an attribution change, and nobody’s confirmed whether that’s a measurement artifact or an actual performance shift. Event Match Quality has quietly drifted and nobody’s checked it in months.

Or the simplest sign of all: it’s been more than a quarter since anyone actually looked.

Your 5 Step Audit Checklist

Step 1: Pixel placement and firing.

Confirm the pixel loads on every key page, not just the homepage, and fires exactly once per event.
Use a browser extension like Meta Pixel Helper in an incognito window to check for duplicate installations, a common issue on sites running multiple tracking plugins or a leftover snippet from a previous theme.

Step 2: Event deduplication.

If you’re running both a browser pixel and a server-side Conversions API, this is where most silent damage happens, and it’s also usually the reason iOS ROAS still looks wrong even after CAPI is technically live.

Every event needs a shared, unique event ID passed identically through both the pixel and the server call.
If those IDs don’t match, or worse, use a static placeholder value, the platform either double-counts the same conversion or fails to recognize it’s the same event at all.
Check this directly in Events Manager: browser and server versions of the same action should appear as a single deduplicated event, not two.

Step 3: UTM hygiene.

Pull a list of every utm_source, utm_medium, and utm_campaign value used in the last 30 to 90 days.
Look for the fragmentation that breaks reporting without anyone noticing: “Facebook,” “facebook,” and “facebook.com” all showing up as separate sources for the same channel.
A documented, lowercase, hyphenated naming convention fixes this going forward, but the audit itself is where you catch how much historical damage the inconsistency has already done.

Step 4: Server-side setup.

Confirm Conversions API events include the same rich parameters as the browser pixel, value, currency, content IDs, not a stripped-down version.
Check Event Match Quality specifically.
A “Good” or higher rating means the platform can reliably match a server event to the person who actually saw the ad.
A quietly degrading EMQ score is one of the most common findings in an audit and one of the easiest to miss, since nothing visibly breaks when it happens.

Step 5: Cross-platform reconciliation.

Compare what Meta, Google, and TikTok each report against your actual store revenue for the same period, and against each other.
Expect overlap, that’s normal, multiple platforms will legitimately claim the same sale under their own attribution rules.
What you’re checking for is whether the combined total is wildly out of proportion to reality, and whether recent platform-side changes are being compared correctly.

Meta’s March 2026 click redefinition is a good example of where this trips people up: click-through totals dropped on their own after that change, but click-through plus the new engage-through category should land close to the old combined number.

Comparing pre-change click-through to post-change click-through alone will make it look like something broke when it didn’t.

Common Findings and What to Fix First

A few issues show up in almost every audit, roughly in order of how much downstream damage they cause.

Missing or misconfigured deduplication tops the list, because it doesn’t just create noisy reporting, it actively feeds the platform’s optimization algorithm bad signal, which compounds every day it goes unfixed. Fix this first, before touching anything else on the list.

Weak Event Match Quality is second. It’s invisible until you check it directly, and it degrades match rates in a way that quietly worsens both reporting accuracy and campaign optimization at the same time.

UTM fragmentation is third. It doesn’t corrupt platform-side optimization the way the first two do, but it makes your own internal reporting unreliable, which matters just as much when it’s informing a budget decision.

Stale or duplicate pixel installations round out the list, usually a legacy snippet nobody remembered to remove after a platform migration or theme change. Low urgency individually, but they compound with everything above.

How Often to Re-Audit

A full audit on a quarterly cadence catches most drift before it does real damage, with a lighter monthly check on signal quality specifically, Event Match Quality, deduplication status, whether CAPI is still connected and healthy.

Outside that schedule, a few events should trigger an audit regardless of when the last one happened: any announced attribution or measurement change from a major platform, any website or checkout redesign, since tracking code often lives on exactly the pages that get rebuilt, and any noticeable, unexplained shift in reported conversions that doesn’t match a real change in spend or performance.

Waiting for the next scheduled quarterly check when one of these has already happened is how a small, fixable issue turns into a quarter of decisions made on bad data.

If you want a second set of eyes on your own setup, or want to see what independent, first-party measurement looks like running alongside your current pixel and CAPI configuration, book a live AdBeacon demo.

—-

FAQ

How do I know if my ad attribution setup needs an audit?

Watch for a persistent gap between platform-reported and actual revenue, disagreement between your paid media and analytics teams about whether tracking is reliable, a sharp shift in reported conversions after a platform announced an attribution change, or simply more than a quarter since the last check.

What’s the most common attribution setup problem found in audits?

Missing or broken event deduplication between a browser pixel and server-side Conversions API events. Without a matching event ID on both, platforms either double-count conversions or fail to connect the two data sources, feeding bad signal into both reporting and optimization.

How often should ecommerce brands audit their attribution setup?

A full audit quarterly, with a lighter monthly check on signal quality specifically, Event Match Quality and deduplication status. Additionally, audit immediately after any platform attribution change, website or checkout redesign, or unexplained shift in reported conversions.

What is Event Match Quality and why does it matter?

Event Match Quality (EMQ) measures how reliably a platform can match a server-side event to the actual person who saw the ad, based on the customer parameters sent alongside it. A weak score quietly degrades both attribution accuracy and campaign optimization, and it doesn’t show up unless someone checks it directly.

Why does UTM hygiene matter for attribution accuracy?

Inconsistent UTM values, like “Facebook,” “facebook,” and “facebook.com” all tagging the same channel, fragment your own reporting even when platform-side tracking is working correctly. A documented, lowercase naming convention prevents this, but an audit is where you catch how much historical data has already been affected.