The Ecommerce CRO Audit Checklist (What's Actually In One)

A CRO audit is a structured review of where your store loses buyers and why. This checklist covers all six phases of one, the version FunnelFreaks runs for D2C brands on Shopify, which starts with analytics validation rather than assuming the tracking is already correct.

Most published CRO checklists begin at phase two. They open with heatmaps and page-level heuristics, working from GA4 data nobody has verified. That ordering is why so many audits produce confident findings that don't survive contact with production.

Work through the phases in sequence. Each one assumes the previous is complete.

Phase 1: Analytics Validation

Everything downstream reads this data. Verify it first.

  • view_item fires on every product page view

  • add_to_cart fires on every cart addition, including quick-add and upsell modules

  • begin_checkout fires on checkout entry, verified on a real mobile device, not desktop emulation

  • add_payment_info fires for every payment path, including COD

  • purchase fires exactly once per order, wait 30 seconds after confirmation page load when testing

  • transaction_id present on every purchase event and matching the platform order ID

  • value and currency populated correctly, with a documented decision on whether value includes tax and shipping

  • items array complete with item_id, item_name, price, quantity

  • GA4 purchase count within 5–10% of platform order count over 30 days

  • GA4 revenue reconciles with platform revenue, with any gap explained

  • Only one GA4 implementation active; check theme.liquid, app embeds, and GTM for duplicates

  • Payment gateway domains on the referral exclusion list

  • Cross-domain tracking configured if landing pages sit on separate domains

  • UTM parameters surviving the full journey to purchase

  • Custom dimensions registered for payment method, order type, and product category

  • Consent Mode implemented with modelling enabled

  • Shopify and GA4 timezones matching

Stop condition: if the purchase count gap exceeds 20%, or GA4 reports more purchases than the platform, fix that before continuing. Every subsequent phase inherits the error.

Phase 2: Funnel Analysis

  • Closed funnel built in GA4 Funnel Exploration across all five ecommerce events

  • Clean 30-day window selected, excluding sale periods

  • Absolute user counts recorded at each step, not just percentages

  • Step-to-step rates compared against expected ranges

  • Any step showing 95%+ completion flagged as a possible tracking artefact

  • Funnel segmented by device category

  • Funnel segmented by traffic source and medium

  • Funnel segmented by new versus returning users

  • Funnel segmented by payment method, COD versus prepaid

  • Funnel segmented by city tier where geographic expansion is underway

  • Landing page breakdown applied to identify entry-point effects

  • Trended funnel checked for sudden drop-off changes matching a deploy or theme update

Phase 3: Behavioural Research

Direct these tools at the specific steps and segments phase two identified. Unfiltered session recordings are browsing, not research.

  • Session recordings filtered to the highest-value drop-off segment

  • Rage clicks identified on non-interactive elements

  • Scroll depth measured against key content positions on mobile

  • Form field abandonment tracked which field is last touched before exit

  • Dead clicks checked on payment and submit buttons

  • Heatmaps reviewed for the specific pages flagged in funnel analysis

  • Exit intent patterns noted on cart and checkout

  • Search behaviour reviewed if onsite search is available

  • Customer support tickets reviewed for recurring purchase-blocking themes

Phase 4: Technical and Experience Review

  • Mobile page load speed measured on 4G conditions, not broadband

  • Core Web Vitals checked for product and checkout pages

  • Third-party script audit, apps and tags affecting load time

  • Add-to-cart button position verified above the fold on common mobile viewports

  • Product page information completeness; sizing, shipping, returns, reviews

  • Checkout form field count measured against the 12–14 range

  • Guest checkout available without forced account creation

  • Shipping costs visible before the cart stage

  • Payment method coverage confirmed: UPI, COD, cards, wallets, EMI

  • COD availability verified for the pincodes your traffic comes from

  • Payment failure recovery path tested, does a failed UPI transaction preserve the cart

  • Error message clarity reviewed on form validation

  • Trust signals present at the payment step; returns policy, support contact, security indicators

Phase 5: Quantification

  • Users lost calculated at each funnel step

  • Intent weighting applied, a product page bouncer isn't worth a full order value

  • Realistic recovery rate applied per step

  • Recoverable revenue calculated per leak

  • Leaks ranked by recoverable value, not by raw drop-off percentage

  • Implementation effort estimated for each fix

  • Final ranking by recoverable value divided by effort

Phase 6: Hypothesis Development

  • Each finding written as a structured hypothesis with observation, proposed change, expected impact, and measurement plan

  • Hypotheses scored using ICE or PIE

  • Required sample size calculated per test from the validated baseline conversion rate

  • Realistic test velocity established from actual conversion volume

  • Success metric defined per test before launch

  • Test log created to record losers alongside winners

How to Use This

If you're running the audit yourself: work through the phases in order and stop at the phase one exit condition if your numbers don't reconcile. Continuing past a broken measurement layer produces findings that look rigorous and aren't.

If you're evaluating an external partner: use this as a scope comparison. Ask which phases their audit covers. Most proposals start at phase two. Our 10 questions to ask when hiring a CRO agency covers the full evaluation, and our breakdown of CRO agencies for D2C brands in India covers who specialises in what.

If you're deciding whether to hire at all: our decision framework for D2C startups covers when in-house is the better call.

Why Phase One Comes First

The ordering is the part most checklists get wrong, and it isn't a stylistic preference.

Consider a store where begin_checkout stopped firing on mobile after a theme update. Phase two shows a catastrophic cart-to-checkout collapse. Phase three directs session recordings at the cart page. Phase four scrutinises cart UX. Phase five quantifies a leak that doesn't exist. Phase six produces hypotheses about a step that was working correctly the entire time.

Every phase executes competently. The output is entirely wrong, because the input was never verified.

Our pre-CRO data audit guide covers phase one in full technical detail, and our guide to why GA4 and Shopify numbers don't match explains what each reconciliation gap size means.

What a Complete Audit Produces

Six deliverables, one per phase:

  1. A validated analytics layer with any tracking gaps documented and fixed

  2. A quantified funnel showing drop-off by step, device, source, and payment method

  3. Behavioural evidence explaining the highest-value drop-offs

  4. A technical and UX findings list

  5. Recoverable revenue estimates ranked by value and effort

  6. A prioritised, testable hypothesis backlog with sample sizes calculated

A deliverable that opens with heatmap screenshots and closes with generic UX recommendations isn't an audit. It's a design review with analytics decoration.

Want this audit run on your store, starting with the phase most agencies skip? Talk to FunnelFreaks.

CRO Agency vs In-House: A Decision Framework for D2C Startups ›