Before removing an agency or changing a lead-tracking tag, map who can administer the Ads account, where its conversions are managed and which billing or audience dependencies rely on a manager. Then check GA4, Tag Manager and the website. A successful login to Ads does not establish control of every system that can alter a lead or stop reporting. [4] [5] [6]
Do not remove an agency, developer, Tag Manager publisher, Analytics administrator, website administrator, or CRM integration until replacement access and the production workflow have been tested. Preserve current container versions, conversion settings, linked accounts, field mappings, and working test evidence before changing authority.
Businesses can use ALLMSP for Google Ads measurement and conversion tracking for organizations in Lawrenceville and Suwanee, throughout Gwinnett County and Metro Atlanta, and across Georgia, with local assistance available when device, network, office, or employee work needs an on-site component.
Worked example: an agency handoff that is not ready to unlink
This hypothetical handoff separates access from operational dependencies. It is not a report of changes to a real advertising account, and none of the observations alone authorizes removing a manager.
| Illustrative check | Finding | Required decision before unlinking |
|---|---|---|
| Direct internal administrator access | An authorized company user can sign in directly. | Keep a tested recovery route; direct access alone does not resolve conversion or billing dependencies. |
| Conversion account | The client uses the departing manager's cross-account actions. | Choose and test the intended conversion setup and campaign goals before disconnecting that dependency. |
| Monthly invoicing | The departing manager is the paying manager. | Arrange the replacement billing setup before unlinking; Google warns ad serving can stop otherwise. |
| One controlled RFQ | A native Ads action and an imported GA4 action both represent the same outcome. | Review campaign goals, including custom goals, so the same RFQ is not intentionally treated as two distinct bidding outcomes. |
The handoff record should identify the client and manager IDs, conversion account, billing owner, current goals, responsible approver and acceptance test. Preserve the old setup until the replacement is verified; record any unresolved issue instead of treating an agency exit date as proof of readiness.
Evidence to collect before changing Google Ads lead tracking
A useful review maps the Ads customer ID, GA4 property, Tag Manager container, Google tag, website, call system, consent platform, CRM, and import connection. It names owners, publishers, outside users, authentication expectations, data policies, and the last real lead test for each component.
- Google Ads users, manager accounts, security requirements, conversion actions, and change history.
- GA4 account and property roles, data restrictions, linked Ads accounts, events, and key events.
- Tag Manager account and container permissions with Read, Edit, Approve, and Publish rights.
- Website, form, call tracking, booking, chat, consent, DNS, and hosting administration.
- CRM users, field mappings, import connections, service accounts, API credentials, and ownership.
- A recent end-to-end test that connects the advertising interaction to a qualified business outcome.
Review campaign configuration and landing-page fit alongside access. Google’s campaign-setup guidance connects the advertised offer with the destination and campaign choices. [3] That review is separate from proving who can administer or recover the accounts.
Map ownership across every measurement system
Google Ads users and manager accounts
What to check: Record direct users, pending invitations, access levels, security settings and the full manager hierarchy. [2] Verify direct internal access, administrative ownership, the conversion account and any paying-manager dependency separately. Linking an existing account does not automatically grant administrative ownership, and unlinking can affect cross-account conversions, shared audiences or monthly invoicing. [4] [5]
What to do next: Remove stale access after a tested internal administrator exists. Downgrade users who need reporting or campaign work but do not need account administration.
Conversion action authority
What to check: List people and manager accounts that created or changed conversion actions, values, primary status, counting, attribution, lookback windows, and imports. Compare changes with approved tickets or campaign decisions.
What to do next: Restore incorrect settings from evidence, limit administrator access, and retest conversions before automated bidding continues to rely on them.
GA4 account and property access
What to check: Capture direct and inherited users, groups, Administrator, Editor, Marketer, Analyst, and Viewer roles, plus cost and revenue restrictions. Confirm the reviewed property and stream IDs match the website.
What to do next: Remove stale access, apply the least role needed, and keep at least two tested internal administrators for the account and critical property.
Record whether each conversion action measures a website interaction, app activity, phone call or offline outcome. [1] For cross-account tracking, inspect the manager account where the actions are managed; a client-account view alone does not establish who can change them. [6]
Review who can change tags and conversion definitions
Tag Manager publishers
What to check: Record account and container permissions separately. Identify who can Read, Edit, Approve, and Publish, plus service accounts, environments, workspaces, and recent versions published by each user.
What to do next: Reserve Publish for trained, accountable users. Keep two internal administrators and remove external publishers only after a working version and replacement access are secured.
Website and form administration
What to check: List people who can add scripts, replace forms, alter confirmation states, change redirects, modify phone numbers, or publish landing pages. Record MFA, account owner, and change history where available.
What to do next: Remove shared accounts, enforce individual access, narrow roles, and connect production measurement changes to a ticket and post-publish test.
Call, booking, and chat platform access
What to check: Record administrators, agencies, number owners, call routing, recording rules, webhook or API access, booking calendars, chat destinations, and who can change conversion definitions.
What to do next: Transfer billing and number ownership to the business, remove stale users, rotate exposed credentials, and retest live calls or bookings after changes.
Consent platform authority
What to check: Identify who can change categories, default states, region behavior, Google consent signals, privacy links, and tag blocking. Compare production behavior with the approved policy.
What to do next: Limit configuration access, document legal ownership, and test accepted and declined states after every banner or tag change.
Inventory the Google tag’s own user permissions as well as GTM container permissions. A tag with one destination inherits access from that Ads account or Analytics property, and its permission model is distinct from a GTM container. [9]
Inspect links, credentials, and data flow
CRM and offline import access
What to check: Record who can alter lifecycle stages, lead values, source fields, imports, matching data, credentials, and schedules. Identify personal accounts or agency-owned connectors.
What to do next: Move ownership to company-controlled accounts, use least privilege, rotate credentials when needed, and validate one controlled qualified lead after each access change.
Linked products and duplicate sources
What to check: List every connected product, account ID, owner, data shared, and conversion or audience dependency. Identify duplicate GA4 properties, old manager accounts, and imports from overlapping sources.
What to do next: Review campaign, audience, billing and conversion dependencies before unlinking. Map actions that represent the same outcome and check the actual campaign goals: secondary actions in a custom goal can still be used for bidding. The One counting option operates within an action and does not merge separate actions that describe the same RFQ. [11] [12]
Recovery and change evidence
What to check: Confirm two internal recovery paths, preserved container versions, website rollback, account IDs, billing control, and an end-to-end lead test. Record what happens if the agency or developer is unavailable.
What to do next: Create missing backup access, export or document configurations, and run the recovery procedure before removing the current owner.
Rank access findings by revenue and data risk
Treat unknown account ownership, unauthorized publishing, exposed credentials, broken consent, and conversion changes affecting automated bidding as urgent. Treat one-person recovery, agency-owned call numbers, and undocumented imports as continuity risks. Reporting-only access cleanup can follow once production control is protected.
Priority 1: Active measurement or access compromise
Use this level for unknown administrators, malicious or unexplained tags, exposed CRM credentials, consent behavior that contradicts policy, or primary conversion changes already influencing budget and bidding.
Priority 2: Ownership and continuity risk
Use this level when the business depends on one publisher, an agency-owned account or phone number, a personal integration, an untested import, or a property that cannot be recovered internally.
Priority 3: Permission and documentation debt
Use this level for excessive reporting roles, stale viewers, unclear naming, missing review dates, and incomplete account maps after production and recovery risks are controlled.
Related next steps: Build and test the intended Google Ads lead-tracking path; Improve conversion quality after ownership is established.
Official product documentation and ALLMSP resources
Frequently Asked Questions
Who should have administrative access to a Google Ads account?
Give administrative access to named people who need to manage users and account controls, with an authorized internal recovery route. Review direct users, pending invitations and the full manager hierarchy. Linking an existing client account does not automatically give the manager administrative ownership; ownership is a separate platform permission and can extend through the manager hierarchy. It also does not transfer ownership of the client's data. Resolve conversion and billing dependencies before removing a manager, even when an internal administrator can sign in.
How can a review find unauthorized Google Ads conversion changes?
Compare the approved conversion register with current action settings and recorded changes. For each important action, capture its source, conversion account, category, value, counting method, primary or secondary status and the campaign goals that use it. Cross-account actions are managed in the manager account, so a client-only review may not expose the person able to edit them. Investigate an unexplained change with its owner before reversing it, and retest the intended lead path after an approved correction.
Sources: [6]
Which GA4 roles should be reviewed for lead tracking?
Check account and property access, including inherited users and groups, and record each person's effective role. A GA4 Marketer can edit events and key events, import conversions into Ads and change attribution settings; tracking authority is not limited to Administrators. Google's conversion-import instructions also require admin access to the destination Ads account, so the Analytics role alone is insufficient for that workflow. Parent-account permissions can give broader access than a direct property assignment. Removing one property-level entry therefore may not remove the effective access. Verify the actual role and the connected Ads workflow before approving a user removal.
Why is Tag Manager Publish access more sensitive than Edit access?
In a Tag Manager container, Edit allows workspace changes but not version creation or publishing; Approve allows version creation but not publishing, while Publish can release changes. A publisher can therefore put a changed conversion or consent implementation into production. Review account-level and container-level permissions separately. Also inventory the Google tag's own users: its permissions can be inherited from Ads or Analytics and are not the same as GTM container permissions. Keep an authorized recovery administrator before removing the last working access path.
Why should website access be included in a Google Ads tracking review?
Website access can change the form, confirmation behavior, scripts or landing page that creates the conversion signal. Identify who can publish through the CMS, form platform, hosting deployment or embedded integrations, not merely who can edit an Ads campaign. Use a controlled test to follow the expected submission to its destination and check for duplicate or missing signals. Preserve an approved rollback version before a deployment. A correct Ads action cannot compensate for a broken form or an unauthorized production script.
What access should be reviewed in call tracking and booking systems?
Record provider administrators, number or booking inventories, routing destinations, integrations, exports and billing contacts. Have an authorized company owner confirm how access and service can be recovered or transferred under the provider's terms. Compare a controlled call or booking with the destination record and conversion signal; avoid recording real conversations or customer details as test material. Do not remove an agency account until number continuity, active bookings and the replacement integration have a documented owner and acceptance test.
Who should control consent settings used by Google Ads tags?
A named business owner should approve the consent requirements with the appropriate privacy or legal reviewer, while authorized implementers manage the banner, consent signals and tag behavior. Google's consent documentation separates obtaining a choice, communicating it and making tags respect it. Check each applicable consent path and region using approved tests. Installing consent mode or seeing a banner is not proof of legal compliance, and an agency should not silently broaden collection to improve a conversion total.
Sources: [10]
What should be reviewed before changing a Google Ads CRM import?
Identify the conversion action and its owning account, then map the CRM field, qualifying event, timestamp, value, permitted matching data, credentials and import schedule. Capture a small approved sample and error handling before changing the mapping. Check whether the same lead is already represented by another import or website action. A changed stage definition can alter bidding signals even when the integration still runs. Agree the intended business outcome and recovery plan with sales and the account owner before release.
How can linked Google products create duplicate lead conversions?
The same RFQ can be sent by a native Ads tag, imported from GA4 and later uploaded from a CRM. List the actions by actual outcome and inspect each campaign's goals. Choosing One controls counting within an action; it does not automatically merge different actions that represent the same lead. Secondary actions are normally observational, but an action in a custom goal can still be used for bidding. Test one authorized inquiry end to end and decide which signal serves each distinct purpose.
What proves a business can recover its Google Ads tracking setup?
An authorized internal owner should demonstrate direct account access and a recovery route, identify the relevant Ads, GA4 and GTM IDs, and retrieve the current configuration and approved publishing history. Include the website, consent platform, CRM, call system and billing or manager dependencies. Then perform a controlled inquiry and reconcile the expected destination and signals without relying on a departing person's password. Record unresolved dependencies explicitly; a password vault entry or screenshot alone is not a completed recovery test.
Related ALLMSP Resources
Sources
- Google Ads conversion measurement options. Official guidance for choosing website, app, phone, and offline conversion actions and reporting goals, with the planning steps on this page applying it to the work needed to audit Google Ads users, manager accounts, and conversion ownership. ↩
- Manage Google Ads manager-account users and access. Official steps for reviewing users, invitations, access levels, account hierarchy, and administrative ownership, with the configuration checks here applied to the controls needed to audit Google Ads users, manager accounts, and conversion ownership. ↩
- Set up a Google Ads campaign for success. Official recommendations for conversion tracking, bidding, targeting, campaign organization, ads, and assets, with the review process on this page using that guidance to help the organization audit Google Ads users, manager accounts, and conversion ownership. ↩
- Google Ads: administrative ownership of client accounts ↩
- Google Ads: effects of unlinking a manager account ↩
- Google Ads: cross-account conversion tracking ↩
- Google Analytics: account and property access roles ↩
- Google Tag Manager: user and container permissions ↩
- Google tag: users, permissions and inherited access ↩
- Google tag platform: consent management concepts ↩
- Google Ads: primary and secondary conversion actions ↩
- Google Ads: conversion counting options ↩
- Google Ads: Analytics conversion imports and required access ↩
