The manual toolkit is free: the analytics and tag manager UIs, browser DevTools, and a spreadsheet. Budget 4–8 hours for a typical site, and accept that the result goes stale with the next container publish.
Automated audit tools trade that time for coverage and repeatability. Tracking Auditor connects read-only to GA4 and GTM, runs the full audit across all six areas above, grades it A–F, and produces a prioritised fix plan with a client-ready export. See a sample report. For a fast, free read on a setup before a full audit, start with the free Google Analytics checker. (And if you can’t audit because you’ve lost access to the GTM account entirely, the free GTM Inspector recovers what’s in the live container so you can rebuild.) Agencies auditing client accounts at volume should see how agencies use Tracking Auditor.