Found before it breaks the report, not after.

• The property's time zone and currency match the business's actual operating location, not the default.
• Internal traffic — your own team, your agency — is filtered out, not counted as real visitors.
• Cross-domain tracking is configured if checkout or booking happens on a different domain or subdomain.
• Data retention is set to fourteen months, not the two-month default, if you'll ever need year-over-year comparisons.

• The actual conversion event — purchase, lead form, booking — is marked as a key event, not just tracked as a generic one.
• Event parameters capture value where relevant, not just a fired-or-not flag.
• Duplicate triggers are checked for — a form that fires on both submit and page-load redirect double-counts.
• Thank-you-page-based tracking is confirmed to not also fire on direct visits or refreshes to that URL.

• Consent Mode is implemented if you serve EU or UK traffic, not just a cookie banner with no code behind it.
• Google Signals is deliberately on or off — a decision, not whatever the default happened to be.
• IP anonymisation and data-sharing settings match what your privacy policy actually promises.

• Real-time report shows your own test conversion within a minute of triggering it.
• Numbers here are compared against each platform's own reporting — a wildly different number usually means a tracking gap, not a "GA4 undercounts" excuse.
• At least one other person on the team knows how to find the reports, so it isn't locked in one person's head.

Run this before every launch, not just once at property creation — the setup that was right in January quietly drifts as pages, forms and consent tools change underneath it.