How to conduct a Salesforce audit: A practical guide for IT leaders
At a glance
- A Salesforce audit is a structured review of your org’s data quality, security posture, automation efficiency, integration health, and technical debt: not a one-click health check score.
- According to Salesforce Ben’s Admin Survey, 56.3% of Salesforce admins identify technical debt as the single hardest part of managing their org, the kind of accumulated complexity that only a systematic audit surfaces.
- A well-run audit ends with a prioritized remediation plan, not a list of everything that is wrong. High-impact, low-effort findings go into the next sprint; everything else gets a named owner and a date.
- Itransition conducts Salesforce audits and assessments for IT leaders who need an independent, structured review of their org before a major change, merger, or performance investigation.
Most Salesforce orgs accumulate problems the same way codebases accumulate bugs: gradually, quietly, and faster than anyone fixes them.
Automations built for a process that no longer exists. Duplicate records that compound every quarter. Integration errors nobody investigates because the data still moves, just incorrectly.
A Salesforce audit makes the invisible visible. It is not the built-in Health Check dashboard.
It is a structured review of the six areas where Salesforce orgs degrade, conducted with enough depth to produce findings an IT leader can act on.
This guide covers what to audit, how to audit it, and how to turn findings into a remediation plan.
For teams that need external support, IT outsourcing partners specializing in Salesforce can conduct the review as an independent engagement or alongside an internal team.
Complex remediation efforts across distributed or offshore teams benefit from the same offshore team management discipline that governs any extended technical engagement.
What a Salesforce audit is and what it is not
Salesforce’s built-in Health Check tool generates a security score from 0 to 100, benchmarked against Salesforce’s own recommended settings. It is not a comprehensive audit.
A full Salesforce audit covers six domains that the Health Check score does not measure: data quality, automation efficiency, integration health, user adoption patterns, architecture complexity, and technical debt.
Audits are typically triggered by five situations: dropping user adoption, a planned re-implementation or migration, a company acquisition requiring org evaluation, escalating data errors, or a performance investigation.
Pro Tip: Schedule a Salesforce audit every 18 to 24 months and immediately before any major org change. Reactive audits consistently surface more accumulated debt than scheduled ones.
The six areas every IT leader should audit
Each domain requires a different investigation approach.
1. Data quality and integrity
Run duplicate reports across your lead, contact, and account objects. Measure field completion rates on the fields your pipeline depends on: close date, opportunity stage, primary contact. Identify records created or last modified more than 12 months ago with no associated activity.
2. Security and access
Review user permission sets against the principle of least privilege. Check for sharing rules that grant broader access than the role hierarchy requires. Run the built-in Health Check to identify password policy gaps, session settings, and network access configuration issues.
According to the Verizon Data Breach Investigations Report, stolen credentials and software vulnerabilities are consistently the leading pathways in enterprise security incidents, which makes CRM access control reviews a security priority, not just an admin task.
3. Automation health
Inventory every active Workflow Rule, Process Builder, and Flow. Identify automations that fire on the same triggering record, which can cause recursion and governor limit errors.
According to Salesforce Ben’s Admin Survey, 56.3% of admins cite technical debt as their top management challenge, with legacy automations a key source.
4. Integration health
Audit every connected app and integration user. Review API call volume against your org’s daily limit and identify which integrations consume the most.
Check for failed sync logs in your integration middleware and identify records with mismatched IDs between Salesforce and connected systems.
5. User adoption
Pull 90-day login history and identify licensed users who have not logged in. Measure how many opportunities are being created and updated versus how many are stalling in early pipeline stages.
Review pipeline-critical fields and measure how frequently they are populated by actual data entry versus default values.
6. Architecture and technical debt
Count custom objects, custom fields, and Apex code classes. Identify custom objects with fewer than 100 records that may no longer serve a purpose.
Review Apex code for test coverage below the 75% threshold. Map your page layouts against the profiles that use them and identify layouts with more than 100 fields.
| Audit area | Primary tool | Key output |
|---|---|---|
| Data quality | Reports and dashboards, AppExchange duplicate tools | Duplicate count, field completion rates |
| Security and access | Health Check, Permission Set Analyzer | Over-privileged users, config gaps |
| Automation | Flow Analyzer, Process Builder audit trail | Redundant or conflicting automations |
| Integrations | API usage reports, middleware logs | Failed syncs, limit risk |
| User adoption | Login History, pipeline reports | Inactive users, data entry gaps |
| Architecture | Field usage reports, Apex test coverage | Unused objects, technical debt inventory |
Pro Tip: Start with data quality, then security. Data quality problems affect every other audit finding, inflating automation trigger counts and distorting adoption metrics. Security remediation often requires manager sign-off, so surfacing findings early prevents them from blocking other work.
The four-step audit process
The audit moves through four sequential steps, each building on the output of the previous.
Step 1: Define scope and success criteria
Decide which of the six areas the audit will cover and what output is needed. A pre-migration audit needs architecture and integration findings. An ROI investigation needs adoption and data quality findings.
Step 2: Run the inventory phase
Export the data each audit area requires before any analysis. Login history, API logs, automation lists, object and field counts, permission set assignments.
Step 3: Evaluate and document findings
For each finding, document the impact, the scope of records or users affected, and the remediation path with time estimate.
Step 4: Prioritize and plan
Sort findings by impact and effort. High-impact, low-effort findings should go into a sprint within 30 days. High-impact, high-effort findings go into project planning.
Pro Tip: Before the audit closes, assign a named owner and target date to each finding category. Unowned findings do not get remediated.
How Itransition helps IT leaders conduct Salesforce audits
Itransition conducts independent Salesforce assessments and audits for IT leaders who need a structured external review before a platform migration, org merge, or performance investigation.
Their certified Salesforce team covers all six audit domains and delivers a prioritized remediation roadmap.
Itransition’s Salesforce audit and assessment capabilities include:
- Full org assessment across data quality, security, automation, integrations, adoption, and architecture
- Technical debt inventory with remediation effort estimates for each finding
- Pre-migration audits before Salesforce re-implementations, Lightning migrations, or org merges
- Security and access reviews for organizations under compliance or audit pressure
- Integration health checks for orgs with complex third-party connectivity
- Prioritized remediation roadmaps with sprint-ready findings and multi-quarter planning horizons
IT leaders planning a Salesforce audit can start with Itransition’s Salesforce assessment to define scope, identify critical risks, and build a remediation plan matched to their org’s complexity.
Independent
