CRM Audit Checklist

This checklist turns a CRM audit into a series of checks you can actually tick off. It’s platform-neutral, so it works for HubSpot, Klaviyo, Zoho, Pipedrive, Salesforce or a smaller tool, and each item is phrased as something you can verify in under ten minutes. For the reasoning behind each area, read the companion guide on how to audit your CRM.

Print or save as PDF

How to use this checklist

Work through the sections in order. Data and definitions come first because almost every automation or reporting problem traces back to them. Mark each check Pass, Fail or Not applicable, and for every Fail write one line of evidence in the findings log at the bottom: a record ID, a workflow name, a report that disagrees with finance. “Data is messy” is not a finding. “1,840 contacts have no lifecycle stage, 70% created by the Shopify sync” is.

Give yourself a fixed time box. Two to four days is realistic for a single team’s CRM. If one section is eating all the time, note it and move on; that alone tells you where the problem is.

1. Scope and access

1. The reason for the audit is written down in one sentence (migration, reporting mismatch, poor lead follow-up, new team joining).
2. You have view access to settings, property definitions, workflow history and integration logs, not just records.
3. A dated export of the main objects (contacts, companies, deals, orders, tickets) has been saved before you start.
4. You know who owns the CRM day to day and who can approve changes.
5. Every connected tool is listed: forms, ecommerce platform, billing, support desk, enrichment, ads, data warehouse, integration platform.

2. Data quality

1. Run a duplicate check on email address and on company domain. Record the count and the top source of duplicates.
2. Filter contacts with no email and no phone. Decide whether they serve any purpose.
3. Check the five most-used fields for blank rates (for example lifecycle stage, owner, country, lead source, company). Record the percentage blank for each.
4. Open twenty recently created records at random. Note anything that looks wrong: names in capitals, test entries, job titles in the company field.
5. Confirm country, state and phone fields use one format, not a mix of “UK”, “United Kingdom” and “GB”.
6. Check how many records were created in the last 90 days with no source recorded.
7. Look for obvious test, internal or competitor records that are still counted in reports.
8. Confirm unsubscribed, bounced and invalid emails are flagged consistently and not being reimported by a sync.

3. Properties and fields

1. Export the full property list for contacts, companies and deals (or the equivalent objects).
2. Flag properties with no description. If no one can explain a field, no one should be filtering on it.
3. Find properties that duplicate each other (“Lead Source”, “Source”, “Original Source Detail”, “lead_source_new”).
4. Check dropdown properties for retired options that are still in use on live records.
5. Identify free-text fields that should be dropdowns because reports or workflows depend on them.
6. Confirm which system is the source of truth for each synced field (CRM, billing, ecommerce platform), and that only one system writes to it.
7. Check that required fields on forms and record creation actually match what sales and marketing need.
8. Record any property used in a workflow or report that is more than 30% blank.

If this section turns up a lot, the CRM data dictionary template gives you a structure for documenting fields properly.

4. Lifecycle stages and customer states

1. Each lifecycle stage has a written definition, an entry rule and an exit rule.
2. Sales and marketing give the same answer when asked what makes someone a qualified lead.
3. Count records in each stage. Look for stages with suspiciously few records (often unused) or far too many (often a dumping ground).
4. Check how stages are set: by workflow, by integration, by hand, or by a mix. Mixed setters are a common source of wrong stages.
5. Confirm stages can’t move backward in ways that break reporting (or that backward moves are deliberate and documented).
6. Find customers who are still marked as leads, and leads who are marked as customers. Note the count and the cause.
7. Check whether lost or churned records have a defined state, or just stay in their last stage forever.
8. Confirm ecommerce or subscription states (first-time buyer, repeat buyer, lapsed, canceled) are calculated from real order or billing data.

The customer lifecycle map template is the place to write the definitions if they don’t exist yet.

5. Pipelines and deals

1. Every pipeline stage has a clear exit criterion that a rep could recognize without asking.
2. Open deals older than twice your normal sales cycle are listed and reviewed.
3. Deals with no owner, no amount or no close date are counted.
4. Closed-lost reasons are required and use a fixed list.
5. Deal stage probabilities (if used for forecasting) have been reviewed in the last year.
6. Deals are associated with the right contacts and companies, not orphaned.

6. Lead routing and ownership

1. Submit a test lead through each main form and record how long it takes to get an owner.
2. Check the routing rules against the current team. Look for departed reps, renamed territories and paused round-robins.
3. Count unassigned leads created in the last 30 days.
4. Confirm there’s a fallback owner or queue when no rule matches.
5. Check what happens to leads submitted outside working hours or on weekends.
6. Confirm existing customers and open-deal contacts are not routed as new leads.

The lead routing workbook helps document the rules once you know where they break.

7. Automation and workflows

1. Export or list every active workflow, flow or automation with its owner and last-edited date.
2. Flag automations with no clear owner or no description.
3. Find automations that have enrolled nobody in the last 90 days. Decide whether they’re seasonal, broken or dead.
4. Find two or more automations that set the same property. Note which one wins and whether that’s intended.
5. Check for automations that send email to the same audience in the same window (welcome flow plus newsletter plus sales sequence).
6. Review error or action logs for repeated failures.
7. Confirm re-enrollment settings match intent on the five most important automations.
8. Confirm every automation that sends messages respects unsubscribe and suppression status.
9. Check that internal notifications go to people who still work there and still read them.

For a deeper pass on individual automations, use the workflow QA checklist.

8. Integrations and sync

1. Each integration has a named owner and a documented purpose.
2. Field mappings are written down, including direction (one-way or two-way).
3. Sync error logs have been checked in the last 30 days.
4. Records created by integrations carry a source value so they can be traced.
5. Integration-platform tasks (Zapier, Make, n8n) are listed, with any that fail silently identified.
6. Key events (order placed, subscription canceled, meeting booked, form submitted) arrive in the CRM within the expected time. Test at least one.
7. API keys and connected-app permissions belong to a service account or an active admin, not a former employee.

9. Email, consent and deliverability

1. Consent status is stored per contact and per channel where required (email, SMS).
2. The source and date of consent are recorded for new subscribers.
3. Hard bounces and spam complaints suppress the contact automatically.
4. SPF, DKIM and DMARC are set up for every sending domain, including the CRM’s own sending.
5. Marketing and sales email use sensible sending domains or subdomains.
6. Long-term unengaged contacts are either excluded from regular sends or handled by a sunset process.
7. Preference or subscription types reflect what people actually signed up for.

10. Reporting

1. The three to five reports leadership looks at most are identified.
2. Each of those reports has a known definition (which records, which date field, which filters).
3. CRM revenue or customer counts are compared against finance or the ecommerce platform for one recent month. Record the gap.
4. Attribution or source reports are checked for a large “unknown” or “offline” bucket.
5. Dashboards with no views in 90 days are listed for removal.
6. Lifecycle conversion reports use stage-entry dates, not current stage, if the goal is to measure movement.

11. Users, permissions and governance

1. Active users match current staff. Former employees are deactivated.
2. Admin rights are limited to people who need them.
3. There is a written rule for who can create properties, workflows and integrations.
4. Changes to important automations are logged somewhere (even a shared document).
5. Someone reviews new properties and workflows at least once a quarter.

Findings log

Copy this block once per finding.

• Finding: one sentence describing what’s wrong.
• Area: data, properties, lifecycle, pipeline, routing, automation, integration, email, reporting or governance.
• Evidence: record IDs, workflow names, counts, screenshots.
• Impact: what this breaks for the business (missed follow-up, wrong report, compliance risk, wasted spend).
• Severity: High (affects revenue, compliance or leadership reporting now), Medium (causes regular manual work or errors), Low (housekeeping).
• Effort: Small (under a day), Medium (a few days), Large (a project).
• Suggested fix: what you’d change, in one or two sentences.
• Owner and date: who will fix it and by when.

Prioritizing what you found

Sort the findings log by severity first, then effort. High-severity, small-effort items go into the first week. High-severity, large-effort items need a short plan of their own. Low-severity items can be batched into a monthly cleanup.

One caution. Fixing automation before fixing the definitions and data it depends on usually means fixing it twice. If your log has both, start with the data and lifecycle items even when an automation fix looks quicker.