How to Run a CDP Data Audit in One Week

The platform has been live for a year. Campaigns go out. Nobody can say with confidence how many customers are in it, whether the purchase event is complete, or why the abandoned-cart flow sends to people who already bought. Every question takes a day to answer and the answer comes with a caveat.

That is the moment for a data audit, and the mistake most teams make is to scope it as a project: eight weeks, a workshop, a forty-page deck. The useful audit takes a week, asks five questions, and ends with a ranked list of fixes short enough to start on Monday.

This is that week. Each day has one question, the checks that answer it, and what the result means. Run it yourself before anyone external does; the week is cheaper than a proposal, and the findings are the same either way.

Fig 1 · One week, one question a day · The audit from Monday’s data check to Friday’s ranked fix list

Before Monday: three things on the desk

The tracking plan, if one exists. The last three months of campaign reports. Admin access to the platform and read access to the shop or app backend. If the tracking plan doesn’t exist, that is finding number one, and the week still runs; you build the plan’s skeleton as you go.

Monday: what data arrives, and does it match what was promised?

The question: is every event in the platform still sent by something, and does what arrives match what the plan says?

The checks: list every event type with its volume over 30 days. Events with zero volume are dead or broken; decide which. Events with a sudden change in volume have a broken source. Take the five events your campaigns depend on most: a view, a cart, a purchase, a signup, and a consent. Pull ten real examples of each. Compare every property against the plan: name, type, whether it’s there, and format.

What it means: expect dead event types. Also expect at least one live event with a property in a format nobody planned, such as a price or a date stored as plain text. Those are silent; the campaigns built on them work until they don’t.

Output: an event inventory with a status per event, and a list of property mismatches.

Tuesday: is a customer one customer?

The question: does the platform hold one profile per person, and do the identity rules match how people behave on your channels?

The checks: count profiles sharing an email, a phone, or a customer number. Read the identity rules as configured, not as remembered. Pick twenty customers from the CRM and find them in the platform. Pick ten of the most active anonymous profiles and read their history for signs of a shared device.

What it means: duplicates on a strong key mean the hierarchy isn’t enforced. CRM customers who can’t be found mean the join fails upstream. Anonymous profiles that look like a family mean a shared-device rule is missing. Each is a different fix with a different owner.

Output: a duplicate count, a “not found” rate, and the merge cases that need a rule.

Wednesday: can we legally send what we send?

The question: does every send check a consent that exists on the profile, per purpose, with a date?

The checks: list the consent categories and what each covers. Map every live scenario’s action nodes to a category. Find nodes with none. Count profiles with a consent record that has no timestamp, no source, or no expiry. Pick one customer who withdrew last month and trace what they received since.

What it means: most audit findings come from three patterns. One consent category for everything, consent captured on the site but never on the profile, and records with no dates. We wrote up the model in consent management and preference centers; the checks are the same on any platform. GDPR fines have passed €6 billion cumulative in EU records.

Output: a category-to-channel map with the holes marked, and the number of profiles with incomplete consent records.

Thursday: what runs, and what does it earn?

The question: which scenarios are live, which are dead, and which can prove they work?

The checks: list every scenario with its last send date and volume. Anything silent for 90 days is a candidate to retire. For the ten highest-volume scenarios, find the holdout group. If there is none, the scenario reports activity, not results. Read the frequency policy and count customers who received more than the cap last month.

What it means: a platform that has had three consultants has scenarios nobody owns. Killing them is the fastest usage saving. A program with no holdouts can’t defend its budget. Frequency breaches are the unsubscribe curve.

Output: a retire list, a “no holdout” list, and the breach count.

Friday: the fix list

The question: in what order?

Rank every finding by two things: how many downstream campaigns depend on it, and how long the fix takes. A broken purchase event that feeds eight scenarios and takes two hours to fix goes first. A naming cleanup that takes two days and improves legibility goes after the things that are wrong. The list is usually ten to fifteen lines. The top three are usually done within the following week, by the team, without a project.

The one deliverable of the audit is that list, with an owner and a date on each line. Not a deck. If the audit produces a deck, it produced the wrong thing.

What the week doesn’t do

It doesn’t redesign the data model, rebuild identity, or write the consent architecture. It tells you which of those are needed and in what order, which is the information a build proposal should be based on and rarely is. In our platform reviews, the week’s findings are the scope; the month after is the work.

The takeaway

Five days, five questions: what arrives, who is a customer, what can you send, what runs, and in what order to fix it. Every answer is a count or a list, not an opinion. Run it once a quarter and the audit stops being an event and becomes the platform owner’s Friday.

Read next

• Event taxonomy pruning: fewer events, better data. What to do with Monday’s inventory.

• Identity resolution: deterministic, probabilistic, and where each breaks. Tuesday, in depth.

• Consent management and preference centers: what good looks like. Wednesday, in depth.