A Google Ads audit: what we check in the first hour of a takeover, in order

In the first hour of taking over a Google Ads account we read no search terms and change nothing in the campaigns. We check, in order, who owns the account and its tracking, whether billing works, whether a real enquiry reaches Google Ads from a clean browser, what automation is changing the account without anyone deciding, and what the change history says. Any one of those can make every later number wrong or leave the account in someone else's hands, and none of them shows on the overview page.

Why the first hour is not the performance audit

Our eight-step audit page starts with search terms, because waste is where the money goes. That order assumes two things: the numbers can be trusted, and the account will still be yours next month. On a takeover neither is known yet. An account whose conversion tag is silently blocked shows a cost per lead that means nothing; an account whose conversion actions live in the previous agency's manager account depends on that agency for its tracking until they are moved. The first hour finds those before anyone builds a plan on top of them.

Ownership: the account, the tag and the container

Google's access level table shows why the business, not the agency, must hold Admin: only Admin can give or remove access, accept or unlink manager accounts, and start advertiser verification. If every Admin login belongs to the outgoing agency, that is the first thing put right, before anything else is touched.

The tracking can belong to someone else even when the account does not. Google's cross-account conversion tracking lets a manager account own the conversion actions its clients use, and Google's help is plain that an account uses either its own conversion actions or the manager's, never both, and that tags set up for the manager take priority. Moving back to the account's own actions can mean new tags on the site, and Google advises leaving the old cross-account tag in place for the length of the conversion window while the switch settles. A Tag Manager container sitting in the old agency's login is the same risk: the tags work until the day someone deletes them.

Billing, and the campaign that looks live

Check that the payments profile is the business's own, the payment method is current and nothing is overdue. Eligible in the status column does not prove that ads are serving: on a new account we opened for a vehicle remapping business in Chester in October 2026, direct-debit billing was not live until the owner confirmed Google's small test deposit, and until then the campaign showed eligible while no ad ran.

One real conversion, proved in a clean browser

This is the check that justifies the hour. A conversion tag in the page source proves only that someone pasted it there. On 9 October 2026, on the site of that same Chester business, the Google Ads tag loaded and the quote form fired the conversion when it was submitted, but the site's Content Security Policy allowed only the analytics hosts, so the browser refused to send the conversion request. No error reaches Google when that happens and nothing looks wrong in the account. It simply records no leads, and the bidding learns that every click was worthless.

Google's own guide to running its tags under a Content Security Policy lists the hosts a Google Ads conversion needs, among them googleadservices.com, googleads.g.doubleclick.net and google.com, plus each regional Google domain named one by one, because the policy syntax allows no wildcard there. A policy written when only analytics was installed will not have them. The test takes five steps.

1. Open the landing page in a clean browser profile, with no ad blocker and no extensions.
2. Open the developer tools on the Network tab, with the Console beside it.
3. Submit the real form with test details you will recognise, or tap the tracked phone link.
4. Look for the conversion request to Google's ad hosts, and for a blocked request or a Content Security Policy error in the console.
5. Note the time, and look for the conversion in the account the next day, once, under the action you expected.

Automation that changes the account on its own

Open the History tab on the Recommendations page, where Google lists the recommendations set to apply themselves and when they last did. Then the automated rules and any scripts, which keep running long after the person who wrote them has gone. Then each Search campaign's AI Max setting: Google's announcement, updated on 11 June 2026, kept the September 2026 automatic upgrade for Search campaigns using automatically created assets or campaign-level broad match, and moved the Dynamic Search Ads upgrade to February 2027. A campaign upgraded in September may be matching far wider than its keywords suggest. Each of these goes on the list with its date; the owner decides what is switched off with the list in front of them.

Counting, change history and the baseline

In the conversions list, read each action's status, source, counting setting and whether it is primary. Imported actions can sit hidden, so the events happen and the account never sees them; two actions can count the same form; a page view can be steering the bidding. Then open the change history for ninety days. A managed account shows changes most weeks with a name beside them, and long gaps mean nobody was in it, whoever was being paid.

Last, download the last ninety days by campaign and by conversion action before anything changes. Every judgement in the first month is a comparison with that file, and once the first change is made the before has gone for good.

What we leave alone in the first hour

Bids, budgets, keywords and ads stay as they are, because a change made before the baseline exists cannot be judged afterwards. The exceptions are the ones that put the account itself at risk: an Admin login the business does not hold, or billing about to fail. Everything else goes on the list, in the order the written audit will deal with it.

The hour is only the start. The written audit then reads everything else, search terms first, and ends with a change list in order: see what the PPC audit covers.

If you would rather run the eight performance steps yourself first, our Google Ads audit page walks through them, and the quote form is there when you want a second reader.