An audit is not a list of problems. It is an argument for a sequence of work, and it either survives contact with a CFO, an engineering backlog, and six months of hindsight, or it does not.
Severity is not priority. An eyeballed register almost never produces the right order.
Most audits fail all three tests above. The four failures below are not stylistic complaints. Each one is the specific reason a particular audit stopped being used.
Findings get ranked by how technically offensive the defect is rather than by what it costs. A rendering quirk on a template nobody visits outranks a measurement error that has been misdirecting budget for eight months.
An audit that recommends everything has prioritised nothing. Without an order the client can defend, the roadmap collapses into whichever item the loudest stakeholder remembers from the readout.
A number with no stated basis collapses at the first challenge from a skeptical stakeholder. So does an observation written as an interpretation, because once the interpretation is disputed there is nothing underneath it left to defend.
An audit structured as prose cannot be sorted, filtered, assigned, or tracked. Nothing in it survives delivery, because there is nothing in it that a tracker can hold.
Context and method come first, because a finding is only as trustworthy as the data behind it, and the reader deserves to know what that data was before being asked to act on it.
3
Parts, in reading order
23
Sections across the document
11
Diagnostic pillars, fixed question sets
40
Fields recorded per finding
Front matter
Establishes who the audit is for and what it has to achieve, then declares the data it stands on before a single finding appears.
Part one
Establishes where the site actually stands, so that nothing later in the document rests on a number nobody agreed to.
Part two
Eleven pillars, each answering a fixed question set, plus the conditional modules the business model requires.
Part three
Where the diagnostic becomes a sequence of work with owners, effort, and dates attached.
Each pillar exists to answer one question. The question is the same on every engagement, which is what makes the answer comparable across them.
| Pillar | The question it answers |
|---|---|
| Crawlability and indexation | Can the pages that matter be reached, and are the pages that are indexed the ones that should be? |
| Architecture and internal linking | Does authority reach the pages that convert, and is anything orphaned from the sections that should feed it? |
| Technical health and performance | Do the templates hold up in the field, on the devices the traffic actually arrives on? |
| Structured data and entity | Is anything on the page machine-readable as an entity, and does the estate resolve to one organisation? |
| On-page and templates | Does the template make each page distinguishable, or does the distinctive term sit past the truncation point? |
| Content and keyword strategy | Does each topic have exactly one owner, or does the site compete against itself? |
| AI search readiness | Are the pages retrievable but not selected, and if so, what is the selected source offering that these are not? |
| Off-page authority | Where does authority come from, what is genuinely at risk, and what should be left alone? |
| Analytics and measurement | Do the numbers the client reports mean what the client thinks they mean? |
| What is working | What is driving traffic today, and what must not be touched? |
| Competitive benchmark | Where does the estate actually stand against the sites it loses to? |
Why the tenth pillar earns its place: a section on what is working, and specifically on what not to touch, is cheap to write and stops a new engineering team from refactoring away the one thing driving traffic.
Modules attach where the business model requires them, and are removed rather than included empty when it does not.
The register is the spine of the document. Nothing appears in the roadmap that does not carry a finding ID, and no finding is recorded without a disposition. Each one is a structured record across forty fields, grouped into eight sets.
An immutable ID, a headline that states the problem rather than the fix, and a pillar and category so recurring failure types can be counted across engagements.
The level the problem lives at — portfolio, cohort, site, template, or page set — plus what it applies to, how many URLs are affected, what share of the site or of organic sessions that represents, and clickable examples. A finding without examples is an assertion.
Separates what was observed from what it means. The observation is stated neutrally, with no interpretation, because that is the part defended under challenge. Confidence is Confirmed when it was reproduced, Probable when the data is consistent with it, and Suspected when it is a pattern and not a proof.
The causal chain from defect to harm, the type of harm, a quantified estimate where one is honestly possible, and the basis for it. Severity is business impact if nothing is done; cost of inaction states what worsens, and over what horizon.
Splits three things most audits merge: the recommendation, which is the decision in one sentence; the implementation, which is what a developer works from without a follow-up call; and the acceptance criteria, which verify the work was done correctly — a separate question from whether it worked.
Attaches to the recommendation rather than the finding, and captures what breaks if the fix goes wrong. This is what lets a client sequence a low-risk quick win ahead of a high-impact frightening one, which is usually the correct order.
How many properties one execution covers, the leverage and risk factors derived from that, the score, the band, and the wave it lands in. Every field in this group except the wave is a formula, and none of them is ever set by hand.
Owner as a role rather than a name, status, and how the fix will be verified and when. Shipped and Verified are different states. When a recommendation is declined, the decision note records why, which is the field that protects everyone involved six months later.
The mandatory field: impact basis is required even when the estimate is null. A number without a stated derivation is a number a client can dismiss, and an admission that no reliable model exists is stronger than a figure invented to fill a cell.
A worked example: one record from a six-property healthcare portfolio audit, expanded into the eight groups above. This is what a single row of the register holds.
Sample record P08-01
Severity is not priority. A Suspected Critical affecting two percent of pages should rank below a Confirmed Medium affecting sixty percent, and an eyeballed register almost never produces that result.
score = (severityWeight × reach × confidenceFactor × leverage)
/ (sqrt(effortDays) × riskFactor)
Six terms, each one an input rather than a constant. The model can be retuned to a client's risk appetite, and the whole register re-prioritises when it is.
| Term | What it does, and what it is worth |
|---|---|
| Severity weight | Business impact if nothing is done. |
| Reach | Affected share, floored. Measured against organic sessions wherever that represents the harm better than a URL count. |
| Confidence factor | Scales the whole score by how well the finding is proven. |
| Leverage | Rewards a single fix that covers multiple properties. |
| Effort | Days of work, dampened rather than ignored. |
| Risk factor | Penalises work that is dangerous and hard to undo. |
| Component | What it asks, and what it weighs |
|---|---|
| Blast radius | What breaks if the fix goes wrong. |
| Failure likelihood | The odds it goes wrong, given this team and this stack. |
| Reversibility credit | How fast it can be undone. An instant revert justifies shipping sooner. |
Linear effort in the denominator crushes every large initiative toward zero, and a register built that way recommends nothing but quick wins. The square root dampens effort without ignoring it: a twenty-day project is penalised about four and a half times against a one-day project, not twenty.
Bands fall out of thresholds on the score. They are computed, never set by hand, and they move when an input moves.
| Band | Score | What it means |
|---|---|---|
| P1 Quick win | 1.20 and above | High return against what it costs and what it risks. Ship first. |
| P2 Structural | 0.45 and above | Real work with real return. Sequenced behind the quick wins and any dependency. |
| P3 Strategic | 0.15 and above | Large, slower, often needing a pilot and a held-back control before full rollout. |
| P4 Monitor | Below 0.15 | Recorded and watched. Acting would cost more than the exposure is worth. |
Ten findings from the same worked example, ordered as the model orders them rather than as severity alone would.
| ID | Finding | Score | Band |
|---|---|---|---|
| P16‑01 | Conversions are double counted, so every performance number is inflated | 8.421 | P1 Quick win |
| P08‑01 | The staging subdomain is fully indexed and duplicating the flagship site | 4.168 | P1 Quick win |
| P11‑04 | No physician or organisation markup anywhere in the estate | 1.600 | P1 Quick win |
| P12‑02 | Titles lead with the brand and truncate before the condition name | 1.279 | P1 Quick win |
| M1‑02 | Forty-one location listings carry wrong hours or duplicate entries | 0.520 | P2 Structural |
| P07‑02 | Provider profiles are orphaned from the specialty sites that should feed them | 0.508 | P2 Structural |
| P10‑01 | Provider photos push the template past the LCP threshold on mobile | 0.352 | P3 Strategic |
| P13‑03 | The flagship and the specialty sites compete against each other on the same queries | 0.255 | P3 Strategic |
| P14‑01 | Clinical content is absent from AI answers on the queries that convert | 0.185 | P3 Strategic |
| P15‑02 | A retired directory campaign left 240 low-quality links pointing at the flagship | 0.011 | P4 Monitor |
Read the fourth row against the eighth. A Confirmed Medium on thirty-six percent of a cohort, costing a day and a half and reverting instantly, scores 1.279 and ships in week two. A High that is only Probable, on thirty-one percent, costing twenty-two days and carrying a portfolio-wide blast radius that is hard to undo, scores 0.255 and waits for a controlled batch. Severity alone would have inverted that order, and the client would have spent a quarter on the wrong thing.
The last row is the one an audit is usually least willing to write. 240 low-quality links, seven years old, no manual action, no ranking discontinuity traceable to them: the recommendation is to document and monitor, and explicitly not to disavow. Disavowal is the risky action there, not inaction.
| Band | Findings | Effort (days) | Share of effort |
|---|---|---|---|
| P1 Quick win | 4 | 12.0 | 17% |
| P2 Structural | 2 | 10.0 | 14% |
| P3 Strategic | 3 | 43.0 | 61% |
| P4 Monitor | 1 | 5.0 | 7% |
| Total | 10 | 70.0 | 100% |
A portfolio audit is not the same audit run six times. Above the eleven pillars sits a portfolio layer that no single-site audit needs.
On most portfolio audits the largest single finding is that three properties should be one.
The diagnostic runs once at estate level with per-property columns, and each property receives a short annex carrying its own snapshot, findings, and roadmap slice. Site-level stakeholders read only their annex. Nobody reads eleven full pillar stacks.
Findings pick up a scope dimension and, critically, a leverage figure expressed as one fix to N sites. A medium severity finding that ships once and repairs eleven properties outranks a high severity finding on one, and without that term the roadmap sequences wrong.
Two artefacts, and one of them is alive.
Three parts, the sections that apply, and the modules the business model requires. Sections that do not apply are removed rather than left empty, and the sources section records what was excluded and why.
A spreadsheet with the scoring model exposed as editable inputs. Change a severity, an effort estimate, or any weight, and the bands recalculate. It is built to live in the tracker the client actually uses, not to be admired once and filed.
Ordered by band and by dependency. For portfolio work, waves run pilot, then cohort, then full estate, with a validation gate between each.
Key takeaway: that wave structure is also what turns a Probable finding into a Confirmed one. A controlled batch against a held-back control is both the safe way to ship and the only way to prove the causal claim.
Single site or portfolio, with the register handed over as a live document your team keeps working after the readout. If that is the shape of what you need, the conversation starts here.