How to perform a CRM data audit

A practical CRM data audit is a bounded review of specific customer data assets to check fitness for purpose, measure quality, and plan fixes. In practice, you define a narrow scope and owners, inventory where the data lives, set clear quality rules, run tests for completeness, validity, duplicates, consistency and timeliness, sample for accuracy, confirm consent and retention, then prioritise remediation with monitoring to sustain improvements. The UK Government’s Data Quality Framework and its DQAP implementation guide describe these principles and steps, including roles, rules, baselining, root-cause fixes and repeated measurement (Government Data Quality Framework; DQAP implementation guide).

Set a tight scope and assign ownership

Define the data asset and objective

• Choose one CRM data asset to start, such as Contacts used for email campaigns or Accounts used for invoicing. Write one business objective, for example “make campaigns fit for purpose by ensuring email deliverability and consent status.” The DQAP approach starts by identifying critical data, its primary use and issues to prioritise (DQAP implementation guide).
• Bound the scope: list which fields, time period and regions are in this audit so work remains focused.

Confirm roles and accountability

• Name a data owner (accountable), data steward (defines rules and monitors), and a custodian/technical SME (implements checks and fixes). These role patterns are described in the DQAP guidance and are central to sustained quality management (DQAP implementation guide).

Inventory your CRM data

Create a lightweight catalogue for in-scope sources so nothing critical is missed. For each system or table/object record:

• System and dataset name (for example, CRM Contacts, Marketing platform audiences, Warehouse customer_dim)
• Purpose and primary users
• Owner and steward
• Key fields in scope (for example, email, phone, country, consent status, last activity)
• Upstream inputs and syncs (forms, integrations)
• Where consent or other lawful basis is captured (if applicable) and retention approach

Define quality rules and profile the data

Use measurable data quality dimensions to set rules and targets against the asset’s purpose. The DQAP guide lists six core dimensions: completeness, uniqueness, consistency, timeliness, validity and accuracy (DQAP implementation guide). Apply them pragmatically to CRM:

• Completeness: Required fields are populated. Example rule: every contact used for email must have email and consent status present.
• Validity: Values conform to expected formats and ranges. Example rule: email addresses match a basic email format; country is from the approved list.
• Uniqueness (duplicates): One record per real-world entity. Example rule: flag repeated emails and similar name/company combinations for review. Shared inboxes and legitimate related records are not automatically duplicates; choose a matching rule for your data model.
• Consistency: Fields do not contradict each other or linked data. Example rule: country and state are a valid pair; billing status aligns with latest invoice record.
• Timeliness: Data is up to date for its intended use. Example rule: last activity or sync occurred within your acceptable window for campaigns.
• Accuracy: Data correctly represents reality. Because accuracy can be hard to test automatically, verify with a small, risk-based sample against trusted references or by user confirmation. The DQAP recommends baselining and then tracking changes over time (DQAP implementation guide).

Baseline with targeted checks

• Run automated checks for completeness, validity, duplicates, consistency and timeliness.
• Draw a documented, risk-based sample for accuracy verification, focused on risky segments (for example, high-value accounts or regions used in the next campaign). Record the sample size, selection method and how many sampled values are correct. A targeted sample does not establish the accuracy of the entire database. This establishes your baseline for future comparison (DQAP implementation guide).

Check consent, purpose and retention

If personal data is present, include purpose and retention considerations in scope. Confirm that:

• Consent or other lawful-basis fields required for your use case exist where needed and are consistently populated.
• Data lifecycle decisions (retain, archive, delete) match your business need and documented policy. The Government Data Quality Framework stresses assessing quality and documenting across the lifecycle, and focusing improvements early (Government Data Quality Framework).

Prioritise issues and plan remediation

• Log findings in an issues register with business impact, owner, and acceptance criteria. The DQAP recommends prioritising improvements, setting goals and assigning owners (DQAP implementation guide).
• Address root causes first (for example, add validation to web forms, fix integration mappings). The DQAP notes cleaning alone is not cost effective unless the source issue is resolved.
• Remediate safely: back up data or work in a sandbox; test merges and standardisation; use a rollback plan; deploy in phases. Avoid destructive bulk updates without backup and review.

Govern and monitor continuously

• Publish the rules, thresholds and dashboards so users understand strengths and limits of the data. Report known issues and target dates to stakeholders (DQAP implementation guide).
• Schedule repeated measures at a sensible frequency for the asset and automate where possible. Track trends against your baseline and update the plan as needs change (DQAP implementation guide; Government Data Quality Framework).

A practical decision your audit should inform

Email campaign readiness decision: If validity checks show email format issues and the accuracy sample finds many stale contacts, and consent fields are incomplete, you can decide to pause sending to a risky segment until the appropriate sending permissions can be verified from reliable records, potential duplicates have been reviewed, and the team’s data-quality criteria are met. Filling a consent field or merging records does not create permission to contact someone. This uses your audit’s rules and baseline to make a clear-go/no-go call for that business task.

Run your first bounded CRM data audit

• Define one business objective and the single CRM data asset in scope
• List in-scope systems, tables/objects and name the data owner, steward and custodian
• Back up the dataset or clone a sandbox before any changes
• Write clear quality rules for completeness, validity, duplicates, consistency and timeliness
• Run automated checks and record a baseline; verify accuracy on a small risk-based sample
• Log issues with business impact and acceptance criteria; assign owners
• Fix root causes first; stage merges and standardisation in sandbox with a rollback plan
• Publish a monitoring schedule and thresholds; review with stakeholders

FAQ

Who should own CRM data quality?

Assign a senior data owner for accountability, a data steward to define rules and monitor, and a custodian/technical SME to implement controls. These roles align with the DQAP guidance on ownership and responsibilities for data assets (DQAP implementation guide).

How often should we repeat the audit?

Set a frequency that matches risk and usage, then measure consistently over time. The DQAP recommends establishing measurement frequency, recording results, and refining criteria as systems and needs change (DQAP implementation guide).

Related reading

• How do I clean up my Salesforce data? A practical playbook
• What is CRM data hygiene? A practical guide