Auditing a GTM Container You Did Not Build

The usual version goes like this. An agency or a freelancer set up Google Tag Manager two or three years ago. They have since left. Google Ads reports more purchases than Shopify has orders, Meta reports a different number again, and nobody can say which one is right. You open the container and find dozens of tags with names like “GA4 – Copy” and “Test pixel DO NOT DELETE”, and you have no idea which of them matter.

I read the pages ranking for “google tag manager audit” before writing this. They are good housekeeping guides: naming conventions, folders, consolidating tags. Every one of them assumes you built the container yourself. None of them asks who still has the keys, none tells you to take a backup first, and none looks at the tracking running outside the container, which on a Shopify store is where most of the double counting comes from. That is the audit this post covers.

What does an inherited container look like?

An inherited container is one where the person who understood it is gone. You can recognize one by its symptoms long before you open it:

• The platforms disagree with the store. Google Ads or Meta shows more purchases than your Shopify orders report, or far fewer.
• Nobody knows who has access. The login belongs to a former employee, a former agency, or an email address nobody checks.
• Changes are frightening. Nobody touches the container because the last time someone did, a conversion stopped recording and it took a month to notice.
• Tags exist that nobody can explain. Old Universal Analytics tags, pixels for tools you cancelled, custom HTML blocks with no notes.

Google Tag Manager (GTM) is the tool that loads your tracking tags, the small scripts that tell Google, Meta and others what happened on your site. If it is wrong, every report built on top of it is wrong, including the ones your ad budget decisions rest on. So the audit starts with control, not with tags.

Who actually controls your container?

Whoever holds Administrator rights on the GTM account controls your container, and on an inherited store that is often not you. Open Admin, then User Management, at both the account level and the container level, and write down every email listed.

GTM has two layers of permission, and Google’s documentation on users and permissions sets them out. At the account level a user is either a User, who can see basic account information, or an Administrator, who can create containers and change everyone’s permissions. At the container level the rights run from Read through Edit and Approve up to Publish, and only Publish can push a change live.

Back it up before you change anything

Export the live container version to a file before you change a single tag. Google’s container export and import guide covers it: Admin, Export Container, choose the published version, and download it as a JSON file. That file can be imported back later if something breaks.

Then open the Versions tab. GTM keeps a history of every published version with the name of who published it and when, as its publishing and versions documentation describes. On an inherited container this history is the closest thing you have to notes. A version published the week your conversions changed is where to look first.

Two habits for everything that follows. Make changes in a new workspace, not the default one, and give every version you publish a name that says what changed. The next person to inherit this container may be you in a year.

Is GTM even the thing firing your tags?

Often it is not, and this is the check the ranking guides skip. On a Shopify store tracking can live in at least four places, and the GTM container is only one of them. Auditing the container alone tells you nothing about the other three.

Custom pixels matter more than they look. Shopify’s custom pixels documentation says they can collect events on the checkout and post-purchase pages, and that they run in a sandbox where not every piece of pixel functionality works. In practice that means purchase tracking on a modern Shopify store may be running from Customer events rather than from the container you are looking at.

So the first real output of the audit is a list: every place a Google, Meta or other tag is loaded, and which conversion each one sends. Until you have that list, you cannot say whether a tag in GTM is the only copy or the third.

Am I counting the same sale twice?

Probably, if Google Ads or Meta reports more purchases than Shopify has orders over the same dates. That comparison is the ten-minute test, and you can run it without opening GTM at all.

1. Pick the last full month. Note the order count from Shopify Analytics.
2. Note the purchase conversions Google Ads reports for the same month, using the Conversions column for your primary purchase action.
3. Divide one by the other. Google Ads will never see every order, because some customers arrive from other channels, so its number should be lower than Shopify’s. If it is higher, something is counting the same sale more than once.
4. Repeat for Meta, keeping in mind that Meta credits sales differently and its numbers are never directly comparable to Google’s.

To find which tags are responsible, place a test order with GTM in preview mode. Google’s preview and debug guide explains the setup. Watch the purchase step and count how many tags fire for one order. Then check the Customer events and sales channel settings for anything sending the same event outside GTM. Two Google Ads purchase tags on one order, one from GTM and one from the Google & YouTube app, is the pattern I find most often in an inherited account.

What to check inside the container

Once you know what GTM is responsible for, the container review itself is quick. Work through the Tags list with the preview open and sort each tag into keep, fix or remove.

• Dead tags. Universal Analytics stopped processing data years ago. Any tag for it is clutter. So is a pixel for a tool you no longer pay for.
• Custom HTML tags. Read every one. They can contain anything, including a second copy of a tag that also exists as a proper template.
• Triggers set to All Pages. Fine for a base tag. A conversion tag on All Pages counts every page view as a sale.
• Paused tags. Decide whether each is meant to come back. If nobody knows, export it in your backup and delete it.
• Consent settings. If you sell to shoppers in regions with consent rules, check whether the tags respect your cookie banner. Google’s consent mode setup guide is the reference for how Google tags should behave before and after a shopper answers it.
• IDs. Check every measurement ID and conversion ID against the accounts you own. An inherited container sometimes still sends data to the old agency’s test property.

Naming and folders matter, and the ranking guides cover them well. They come last here because a tidy container that double counts purchases is still wrong.

Which fixes come first?

Fix control first, then counting, then tidiness. The order is set by what each problem costs you while it stays broken.

Step four is the one with money attached. Google Ads uses the conversions you send it to decide what to bid, so a purchase counted twice teaches automated bidding that a campaign is working better than it is. That ties GTM directly to the questions in my Google Analytics audit and to the checks in what to verify before trusting a GA4 ecommerce report. If you are weighing whether to move tracking server side once the container is clean, server-side tracking on Shopify covers when it is worth it.

The unglamorous part is that most of this audit is not inside GTM at all. It is access, a backup file and a list of where tags live. The container clean-up everyone writes about is the last step, and the one that matters least.

Questions people ask