Facebook ads audit checklist: a new client’s ad account in 30 minutes

Before you start: the right access, and hands off

Ask the client to add your business as a partner to their business portfolio. Don’t take their login, and don’t move their ad account into your portfolio:

Most marketing companies won't need to claim ad accounts from their clients.

For the audit itself, partial access is enough. On an ad account, Meta’s “View performance” task lets you view ads and access reports; “Manage campaigns” adds creating and editing ads; only full access controls settings, finances and permissions (source). Ask for the pixel as well — “Use events dataset” lets you see its data. Jon Loomer runs his paid audits that way — he cannot create, edit, pause, or change anything in your account and removes his access within 48 hours of delivering (source).

Then two rules for the next 30 minutes:

• Change nothing. Budget, targeting and creative edits restart learning — see Learning limited — and you lose the clean “before” picture.
• Write down the baseline. Spend, results and cost per result for the last 30 days by campaign, plus the client’s own count of leads and sales from their CRM for the same days.

The plan:

1. Minutes 0–5: ownership and access.
2. Minutes 5–8: billing and account settings.
3. Minutes 8–15: tracking.
4. Minutes 15–20: structure and budget.
5. Minutes 20–25: ads and the settings that change them.
6. Minutes 25–30: lead forms and the CRM.

Minutes 0–5: who owns the account, and who has access

None of the seven audit checklists we compared asks who owns the ad account and the card, yet it is the problem that hurts most later. Open Business settings in the client’s portfolio and compare what you see with this:

Why ownership matters: an ad account stays in the portfolio it was created in. If you create a new ad account in a business portfolio, it will permanently be a part of that portfolio. This means the ad account can't be deleted or transferred from the portfolio. (source) The pixel is the same: you can’t delete a dataset or transfer it to another business portfolio (source). A partner’s access, by contrast, can be removed at any time, and a partner can’t pass the asset on — only the organization that owns the asset can share it with another business portfolio (source). If a previous agency owns the account, the client should know that before you build on it.

A split setup causes trouble long before anyone leaves. One agency on Shopify Community couldn’t connect the Conversions API because the ad account and Pixel is owned by my agency and not by the client, while the client owned the Page (source).

Two-factor authentication isn’t optional either: If two-factor authentication isn't turned on, Meta may restrict or remove people's access to advertising (source). Jon Loomer’s account checklist adds: remove users inactive for 90 days and keep at least two employees with full admin access (source).

Minutes 5–8: billing and account settings

• Payment method. Without one, ads can be created but these ads will get no delivery (source). Only someone with full control can change it, which is how it should be for an agency. Check for an account spending limit that someone set and forgot — our guide to spending limits and failed payments covers it.
• Time zone and currency. Ads Manager reports days in the account’s time zone, so a CRM in another zone splits days differently. Changing either one creates a new ad account: When you change your time zone, this closes the existing ad account and ads created with the closed account will stop running. (source) Currency can be changed once every 60 days and only with no balance due; for some countries, Poland among them, the business country and currency must match (source). If either is wrong, plan the switch with the client — it means rebuilding the campaigns.
• EU beneficiary and payer. If the client advertises in the EU, every ad set needs them: since August 2023 if beneficiary and payer information is not provided, the ad will not be published. Set defaults at account level so new ad sets get them (source).
• Special ad category. In 2026 there are four: housing, employment, financial products and services, or issues, elections, and politics. Financial products and services replaced “credit” in January 2025, and Ads may be rejected if the advertiser does not choose an appropriate Special Ad Category. The category narrows targeting — ages generally fixed to 18–65+, all genders, no lookalikes (source). Employment is wider than job ads: it includes ads for internships or professional certification programs (source). If the client sells courses that end in a professional certificate, check the category with Meta’s guide. Political ads have not been allowed in the EU since 6 October 2025.
• Verification. Meta is widening advertiser verification so that verified advertisers drive 90% of its ad revenue by the end of 2026 (source). If the account shows a verification request, put it at the top of your list.

Minutes 8–15: tracking

The question isn’t “is the pixel installed?” but “does the event the ad sets optimise for actually arrive?” A pixel can fire page views for months while the Lead event is broken. One Shopify store, after several experts confirmed its pixels were connected, still saw Meta report 3460 link clicks in a week while the store showed zero sessions from Facebook (source).

1. List the optimisation events. For each active ad set, note the conversion it optimises for (Lead, Purchase, a custom conversion).
2. Check each one fired in the last 7 days in Events Manager, and on the website with Meta Ads Data Advisor (the extension once called Pixel Helper): Inactive: Your event is not currently sending data. (source).
3. Look for server events. Browser-only tracking loses events to ad blockers and browser privacy settings. If the Conversions API sends the same events, they need a shared event ID to be counted once — see Conversions API for CRM.
4. Read event match quality. Meta suggests you aim for an Event Match Quality score of 6.0 or higher (source).
5. Open Diagnostics in Events Manager and note anything active.

Two things you no longer need to check: ranking eight events in Aggregated Event Measurement, and verifying the domain for conversion events. Meta: You no longer need to prioritize 8 conversion events per domain for web conversion optimization, and the Aggregated Event Measurement tab is gone from Events Manager (source). Domain verification still matters for controlling who can edit link previews to the client’s site (source), so verify it in the client’s portfolio, not yours.

Minutes 15–20: structure and budget

Count the active campaigns and ad sets, and set each ad set’s weekly results next to its spend. An ad set that can’t reach about 50 results a week stays in Learning limited; ten small ad sets with the same goal usually do worse than two larger ones.

Overlap is not bidding against yourself

Many checklists say that audiences overlapping by more than 20% or 30% make the ad sets bid against each other. Meta says the opposite: when several of your ads qualify for the same auction, only one competes — This ensures that your ads will not bid against one another. The cost is different: too much overlap makes delivery uneven and results less predictable (source). The fix is the same — fewer, larger ad sets.

Settings that move money for you

• Placements and budget sharing. Since October 2025, Sales and Leads campaigns can let Meta spend up to 5% of the budget on placements you excluded, and ad set budget sharing can move up to 20% of a budget between ad sets of one campaign (source). Note which campaigns have them on.
• Account controls. Placement exclusions and audience controls can be set for the whole ad account. Jon Loomer’s note on them: It's also possible that this was set and forgotten. (source)
• Old targeting. Ad sets created before October 2025 with detailed targeting options Meta retired stopped delivering by 15 January 2026 unless they were updated (source). An ad set “on” but silent since winter may be one.
• Attribution. The 2026 default is 7-day click, 1-day engaged view and 1-day view (source). Ad sets with different settings can’t be compared side by side; note which ones differ.

Minutes 20–25: ads, and the settings that change them

• Ads that spend without results. Sort ads by spend over the last 14 days and mark those with spend and no result.
• Tired creatives. High frequency with a falling click-through rate means the same people keep seeing an ad that no longer works.
• Rejected ads and account status. Check for rejections and warnings — our guide to a restricted ad account explains each status.
• Ad relevance diagnostics. Quality, engagement rate and conversion rate rankings help compare ads, but they aren't available for ads with fewer than 500 impressions and are not inputs into the auction (source).

Creative enhancements nobody chose

Clients often complain that Meta added music, cropped an image or rewrote text. In Ads Manager, some creative features are switched on unless someone turns them off: Meta marks them “On by default” and lists them under Review defaults (source). Three places to check:

• The ad itself. Open an active ad and look at its Advantage+ creative section, and at Advanced preview too: Some enhancements can only be turned off in Advanced preview, and won’t be visible in the Ad creative. (source)
• The ad account settings. A “Test new creative features” checkbox lets Meta apply enhancements and features in testing to eligible campaigns (source).
• Automated rules. A rule can switch Advantage+ creative on, and other rules may pause ad sets or raise budgets — see alerts and rules.

Through the API, by contrast, almost every enhancement is opt-in (source), so ads created by tools and by hand in the same account can differ.

Opportunity score

A low score doesn’t mean a bad account. It measures how many of Meta’s recommendations you follow, and Meta itself says it does not reflect your actual or future performance, even if your score is high. (source) What matters for the audit is which recommendations were already applied: Advantage+ audience or automatic placements switched on in one click show up only in the ad sets’ settings.

Minutes 25–30: lead forms and the CRM

• Where the leads go. Lead information is only available on Meta for 90 days, so older leads cannot be downloaded. (source) If leads aren’t synced to a CRM or downloaded regularly, that is a finding.
• Who can see them. By default only people with full control of the Page or messaging permissions can download leads (same source) — an agency with partial access to the ad account may see lead counts but not the leads.
• Form type. More volume or Higher intent, and which questions filter people out — see lead quality.
• Ads Manager against the CRM. Compare last month’s leads in both. A large gap points to tracking or attribution; our guide to client reports has a three-number check that tells which.
• Sales back to Meta. If the client’s CRM records which leads bought, are those stages sent back, so Meta can find more people like the buyers? See matching CRM sales to ads.

Write it up: three fixes, then a week of data

For each finding, write one line: what you saw, the number, and the next step. Then sort:

1. Stops spend or loses data: wrong owner or a former employee as the only admin, no payment method, the optimised event not firing, leads expiring unread.
2. Wastes money now: ads spending without results, tired creatives, enhancements or rules nobody chose.
3. Structure: merging ad sets and changing budgets. Do these last — they restart learning.

Send the client the list before you touch anything, fix the top three, and judge the result after a week against the baseline you wrote down at the start.

Audit advice that is out of date in 2026

These still appear in checklists published this year:

How Variafy helps

Ask your assistant “Audit this ad account” and Variafy reads the account in one pass and changes nothing. You get:

• Account status and the spending limit.
• Tracking: whether each event the active ad sets optimise for fired in the last 7 days, server-side events, event match quality and custom conversions that are archived or unavailable.
• Learning limited ad sets and their share of spend.
• Ads that spent without a result over 14 days, rejected ads and tired creatives.
• Cost per result this week against the previous 30 days, with the changes made in the account when it rose.
• Missing data: no CRM connected, no link tags.

Each finding comes with numbers and a next step, and anything it couldn’t check is named rather than skipped. After that, the same audit runs on its own every 7 days and lands in your morning brief.

It does not check ownership, partners, the payment method’s owner, the special ad category or account-level creative settings — do those by hand with the list above.

Add https://www.variafy.com/mcp to your assistant. Variafy is in private beta: join the waitlist.

How we checked

Questions

Related guides

• Learning limited on Facebook ads: what it means on a small budget
• Facebook ads report for clients: what to send every week
• Facebook ad account restricted: what to do, step by step