Attribution audit framework

The UTM Audit
Checklist

25 checks to run before every campaign launch. Catch broken UTMs before they corrupt three months of attribution data.

Real scenario: Revenue review happens. Someone asks "why is direct traffic 40% of our attributed pipeline?" You dig into GA4. The campaigns looked good at launch. But utm_medium values drift: "social", "Social", "paid-social", "socialmedia" in the same campaign. Your channel attribution is destroyed. It's been like this for 8 weeks.

This doesn't have to happen. Use this checklist before launch — not after it breaks.

Why UTMs break (and when you discover it)

Copy-paste from old campaigns

You grab utm_campaign="summer-2024" from an old brief and modify it to "summer-2025". Someone else does the same, but types "summer2025" instead. Now you have two values for the same logical campaign.

Manual URL building

Spreadsheets, Slack messages, email drafts. Each person interprets the naming convention differently. utm_source becomes linkedin, LinkedIn, and linked-in in the same campaign.

Wrong parameter names

utm_source, utm_Source, utm-source all show up. Some platforms ignore unrecognized parameters silently. Your data is incomplete before anyone notices.

Encoding errors

Spaces get encoded as %20 or +. Some analytics platforms normalize these, others don't. Your campaign data fragments across multiple rows.

Missing parameters

utm_medium left blank because "everyone will know it's paid search". But GA4 treats blank utm_medium differently than your default. Direct traffic ticks up mysteriously.

Discovered way too late

You find out when a revenue review highlights an anomaly. By then, 3 months of campaigns have run with broken tracking. The data is gone.

The brutal part: You don't discover it in real-time. GA4 doesn't flag inconsistent utm_source values. Your link shortener doesn't warn you about encoding issues. You discover it when the data looks wrong weeks later — and by then, the campaign is over and the data is already in your reports.

What your UTM data looks like before and after this checklist

Real data patterns from a 30-person marketing team

Before — utm_source values found
google
Google
google_ads
googleads
google-ads
GOOGLE
Googl
linkedin
LinkedIn
linked-in
linkedIn
newsletter
Newsletter
After
the checklist
After — governed source values
google
linkedin
facebook
email
direct
referral

The 25-point UTM audit checklist

25
audit checkpoints
5 categories covering every layer where UTM data breaks — from link creation to CRM sync
3 hrs
to run the full audit
A complete UTM audit from data pull to action items takes under half a working day
40%
errors are preventable
Nearly half of UTM data corruption is caused by missing validation at link creation
1

Parameter Completeness

5 checks — Do all required parameters exist?

utm_source is present on all links (never blank)

This is your link source. Every single link needs it.

utm_medium is present on all links (never blank)

This is your channel. "cpc", "email", "social" — never leave it empty.

utm_campaign is present on paid links and email links

Campaign grouping for reporting. Required for paid, always recommended for email.

utm_content is populated when running A/B tests or multiple creatives

Differentiates between ad variants within the same campaign.

utm_term is populated on paid search campaigns

Keyword tracking for PPC. Omit if not running paid search.

2

Value Consistency

5 checks — Do all values follow your naming rules?

utm_source values match your approved source list exactly

Lowercase, no spaces. If you approve "linkedin", not "LinkedIn" or "linked_in".

utm_medium uses standard values: cpc, email, social, display, affiliate, referral

Do not invent values like "paidsocial" or "em". Standardization matters for rollups.

utm_campaign names follow your naming convention

Check date format consistency, product/team naming, and campaign phase.

No spaces in any UTM value

Spaces break UTMs or get URL-encoded inconsistently. Use hyphens instead: "paid-search-q2".

No special characters requiring URL encoding

Avoid #, &, %, + in parameter values. Use only alphanumeric, hyphens, and underscores.

3

Technical Integrity

5 checks — Will the UTMs survive to your analytics?

All destination URLs resolve with a 200 status

404s will kill your campaign. Test every URL before launch. Watch for redirect chains > 2 hops.

UTM parameters survive redirect chains

If your shortened URLs or tracking redirects swallow UTMs, your data dies here.

No double-encoding in parameter values

Values should not contain %20 or %26 — spaces and & are handled by the URL builder.

Parameters use lowercase naming

utm_source not UTM_SOURCE. Case matters in some analytics platforms.

URL separator before first parameter is ? not &

https://example.com?utm_source=... not https://example.com&utm_source=...

4

Attribution Logic

5 checks — Will your analytics understand this link?

Paid social links all use utm_medium=social consistently

Pick one value for all paid social (social or paid-social), then use it everywhere.

Email links use utm_medium=email

Not newsletter, not email-campaign, not EDM. Consistency = reliable reporting.

All paid search keywords have utm_medium=cpc

PPC channels need consistent tagging. Your GA4 channel report depends on this.

Organic social posts use utm_medium=social consistently or no UTMs at all

Don't mix organic and paid. Pick one pattern and stick to it.

Your brand name in utm_campaign doesn't conflict with paid search campaigns

If utm_campaign contains your product name, separate it from your brand keyword campaigns.

5

Governance & Coverage

5 checks — Is this campaign launch-ready?

Every link in your campaign brief has a UTM

Spot-check for missed links before launch. One untagged link kills your attribution story.

UTM values are documented in your campaign brief before links are built

Your team should know what utm_campaign="q2-expansion-2026" refers to.

Links were built in your UTM governance tool, not a spreadsheet or manual builder

Manual building introduces typos and inconsistencies. Use UTMStandard or similar.

Someone has tested the full link end-to-end in an incognito browser

Click the link → check GA4 real-time → verify parameters appear exactly as expected.

You have a record of all UTMs used in this campaign for future audit reference

Save your campaign brief. Future you will need to know what utm_source="linkedin-ads-jan" meant.

How to run the audit

1

Parameter & value checks (15 checks)

Use UTMStandard's governance tool to automate checks 1–15. Import your campaign spreadsheet → the tool validates completeness, consistency, and syntax against your naming rules. Instant results, zero manual work.

2

Technical integrity checks (5 checks)

Test URLs manually or use a link checker. Verify 200 responses. Click one link from each source through a redirect chain → open GA4 real-time → confirm utm parameters appear unchanged on the landing page.

3

Attribution logic checks (5 checks)

Pull a utm_medium dimension report in GA4 on your test traffic. Scan the list. You should see only your approved values (email, social, cpc, display, etc.). If you see misspellings, stop and fix before launch.

4

Governance checks (5 checks)

Team process. Campaign brief signed off by marketing ops → every link reviewed for coverage → one person tests end-to-end in incognito → store the brief for future reference. 15 minutes.

What to do when you find problems

Critical — fix before launch

  • 404 destination URLs
  • Missing utm_source on any link
  • UTM parameters lost in redirect chain
  • utm_medium blank or completely missing

Important — fix within 24 hours

  • utm_source value inconsistency (linkedin vs LinkedIn)
  • Spaces instead of hyphens in utm values
  • utm_campaign doesn't match your naming convention
  • utm_medium using custom values instead of standard (paidsocial vs social)

Nice to have — fix in next sprint

  • utm_content not populated on A/B test links (attribution will work, but variant tracking is incomplete)
  • utm_term missing on some paid search keywords (you'll still see paid search data, just not by keyword)
  • Campaign brief not documented (you'll still get data, but future you won't remember what utm_campaign="q2-2026" meant)

Automate the technical checks

Checks 1–15 (parameter completeness, value consistency, and technical syntax) can be automated. UTMStandard's governance tool builds your naming rules once → enforces them on every link created → flags violations before the link is generated.

Naming rules auto-populate utm values from dropdown menus and enforce format constraints (lowercase, no spaces, specific values only). When your team goes to build a link, they can't create utm_source="LinkedInAds" or utm_medium="socialmedia" — the tool won't allow it.

Attribution logic checks and governance checks still require human review — but the boring syntax validation is automated.

The one thing you need to know

UTM problems are silent. They don't appear in your campaign performance. They appear in your attribution six weeks later when someone notices your direct traffic is 40% of pipeline. By then, three months of campaigns have already run with broken tracking, and the data is in your reports forever.

This checklist takes 30 minutes to run. The cost of not running it is months of corrupted attribution data.

Use this checklist before every campaign launch. Run it with UTMStandard to automate the technical checks. Catch problems before they become part of your historical data.

Automate UTM governance

Set up naming rules in UTMStandard → your team builds links that automatically pass audit checks → no more inconsistent utm_medium values.

Free plan includes 1 naming rule, 1 template, and 100 links per month.

Create my free account

No credit card required · Free plan always available