# Martech stack audit scope: <company>

Fill this with the sponsor before collecting exports. A question without a decision owner is out of scope. Anything the audit cannot access is recorded as not checked, never as PASS.

## Header

- Company: <name>
- As-of date: <YYYY-MM-DD>. Every script runs with `--as-of` set to this date.
- Prepared by: <role>
- Trigger: <inherited stack | renewal cycle | budget cut | AI connection request | numbers disagree | other>
- Decision deadline: <date, and the renewal, budget or launch event behind it>

## Decisions the audit supports

- <Decision, for example "keep, right-size or replace the product analytics tools before the next term end">
  - Owner: <role>
  - Decide by: <YYYY-MM-DD>
- <Decision>
  - Owner: <role>
  - Decide by: <YYYY-MM-DD>

## Questions

Write each question so evidence can answer it. "Review the CRM" is too broad. "Can sales see paid, active and stalled trials without opening billing?" can be tested.

- Q1: <question>
  - Decision owner: <role>
  - Systems: <tool IDs from the register>
  - Evidence: <export, order form, user list, record IDs>
  - Status: <open | answered | not checked>
- Q2: <question>
  - Decision owner: <role>
  - Systems: <tool IDs>
  - Evidence: <source>
  - Status: <open | answered | not checked>

## Workflows to trace (at most three in the first pass)

SaaS starting points: lead to opportunity, trial to activation, subscription to renewal. Ecommerce starting points: click to order, order to refund, first to repeat purchase.

- W1: <name>
  - Entry: <the event or record that starts it>
  - Outcome: <the business fact that ends it, and the system that commits that fact>
  - Systems in order: <tool IDs>
  - Cases to trace: new prospect; existing customer; person in two accounts; refund or cancellation; missing attribution
- W2: <name>
  - Entry: <event>
  - Outcome: <fact and system>
  - Systems in order: <tool IDs>
  - Cases to trace: <five cases>

## Evidence plan

Request each export from the person who already holds read access. Nobody shares a password, API key or token for the audit.

- 12 months of lines from the software, SaaS, subscription, marketing and data GL accounts or cost centres, plus all card and expense lines: date, vendor, amount, currency, payment source
  - Supplied by: <role>; requested <date>; received <date>
  - Any non-martech vendor that still appears becomes an out_of_scope row with a reason before INV01 is read
- Executed order forms and amendments for the tools that make up the top 80% of spend
  - Supplied by: <contract owner or procurement>; requested <date>; received <date>
- Identity provider app report (Okta Application Usage, Entra sign-ins) and the app grants: the Google Workspace accessed apps CSV or the Entra enterprise app grants
  - Supplied by: <IT admin>; source retention: <days>; requested <date>; received <date>
- User exports with role, admin flag, last login and MFA status from each critical tool
  - Supplied by: <tool admins>; requested <date>; received <date>
- The identity provider's user list with each user's status (active, deactivated), to join to the tool exports
  - Supplied by: <IT admin>; requested <date>; received <date>
- Connected-app lists, pipeline and sync lists, iPaaS workflow lists, warehouse job lists, and every manual CSV hop
  - Supplied by: <technical owners>; requested <date>; received <date>
- Five internal record IDs per traced workflow, and two key lists for the match test
  - Supplied by: <data owner>; requested <date>; received <date>
- Every AI assistant, agent or MCP server that can reach CRM, ads, analytics or warehouse data
  - Supplied by: <IT admin and team leads>; requested <date>; received <date>

## Test approvals

The audit reads existing records first. Anything that writes to a live system runs only with this approval.

- Approver: <role>, for <systems>
  - Allowed tests: <test records created or updated, unsubscribes, form submissions, test orders, consent-banner clicks>
  - Test data: <agreed test record IDs, test inboxes the company controls, test payment method>
  - Not allowed: <for example messages to real customers, live ad conversions>

## Access limits

- <System or export that is not available>
  - Checks that become NOT CHECKED: <check IDs>
  - What would close it: <export or read-only access, and who can supply it>

## Owner questions (one set per tool)

- What job does it do, in one sentence that names the work rather than the category?
- Who uses it, and how often? Who uses it once a quarter but cannot lose it?
- What breaks if it is gone tomorrow?
- What writes to it, and what reads from it?
- Who can change it, and who approves changes?
- When does it renew, what is the notice period, and who is allowed to send notice?
- What would you use instead, and has that been tested with your own data?

## Out of scope

- Executing any change: cancelling, downgrading, removing users, revoking tokens, sending notices, editing settings
- Legal reading of contract clauses, and consent or legal basis decisions
- The performance of named people
- <anything else agreed with the sponsor>