Key takeaways
- Start with security: too many System Administrators and unused active users are the most common risks.
- Old Workflow Rules and Process Builders lost Salesforce support at the end of 2025 and should be moved to Flow.
- Measure data quality with a few numbers, such as duplicate rate and empty key fields, so you can see progress.
- Turn the results into a short, prioritised list. Ten fixes done beat fifty findings filed.
A Salesforce org changes every week. Fields get added, people join and leave, automations pile up. After a year or two without a proper review, small issues add up to slow pages, unreliable reports and security gaps.
This is the checklist we use for small and mid-sized orgs. You can run it yourself in a day. Score each point as OK, needs work or critical, then pick the ten most important fixes.
Security and access
- System Administrators. Count the users with the System Administrator profile. In a small company, two is usually enough.
- Inactive users. List active users who have not logged in for 60 days. Each one is an unused licence and a possible security risk.
- Permission sets over profiles. Check whether access is managed with permission sets and permission set groups, which Salesforce recommends, or with many custom profiles.
- Health Check score. Open Setup → Health Check and review the high-risk settings it flags, such as password policies and session timeouts.
- Multi-factor authentication. Confirm MFA is enforced for every user who logs in to the user interface.
- Field-level security. Make sure sensitive fields, such as salary, margin or personal data, are hidden from people who don't need them.
Automation
- Old automation tools. List active Workflow Rules and Process Builders. Salesforce ended support for both on 31 December 2025. They still run, but bugs will not be fixed, so plan a move to Flow (SalesforceTime explains what this means).
- Flow errors. Check who receives Flow error emails and how many arrived in the last month.
- Several automations on one object. Look for objects with multiple record-triggered Flows, triggers and old automations. Overlaps cause loops and slow saves.
- Documentation. Each active automation should have a description that says what it does and who asked for it.
Data quality
- Duplicates. Run a duplicate report on Accounts, Contacts and Leads. Check that matching and duplicate rules are active.
- Key fields. For each core object, measure how many records miss key fields, such as industry, next step or close date.
- Stale opportunities. Count open opportunities with a close date in the past. They inflate the pipeline.
- Unused fields. Find custom fields that are empty on more than 95% of records. They clutter layouts and confuse users.
- Picklist hygiene. Look for inactive or duplicate values and free-text fields that should be picklists.
Reports and dashboards
- Dashboard owners. Every dashboard should have an owner and a running user that makes sense.
- Unused reports. Sort reports by last run date. Archive what nobody has opened in a year.
- KPI definitions. Check that "pipeline" and "win rate" mean the same thing in every report.
- Forecasting. If you use Collaborative Forecasts, confirm that forecast categories match your stages.
User experience and adoption
- Page layouts. Count the fields on your main opportunity layout. More than 40 usually means reps scroll past what matters.
- Lightning pages. Check that key pages use dynamic forms or tabs so users see only what is relevant.
- Logins. Review login history. Users who rarely log in are telling you something.
- Mobile. Open the Salesforce mobile app as a rep and try to update an opportunity in under a minute.
Platform and release readiness
- Sandboxes. Confirm you have at least one sandbox and that it was refreshed in the last six months.
- Release updates. Open Setup → Release Updates and check for items with enforcement dates coming up.
Turning findings into action
An audit is only useful if it leads to changes. Group your findings into three buckets:
| Bucket | What goes in it | When to act |
|---|---|---|
| Fix now | Security risks, broken automations, wrong numbers in leadership reports | This month |
| Plan | Migrations to Flow, layout redesign, duplicate clean-up | Next quarter |
| Watch | Nice-to-have improvements | Review at the next audit |
Then write down a few numbers, such as duplicate rate, percentage of opportunities without a next step and number of active admins, and check them again in three months. Progress you can measure is progress you can explain to leadership.
If you prefer someone to run the audit for you, the OrgStewards Org Health Check covers these 25 points and comes with a written report and a walkthrough.
Frequently asked questions
How often should we audit our Salesforce org?
Once a year as a full review, plus a short check after each major change, such as a new team joining Salesforce or a large data import.
Do we need special tools for an org audit?
No. Salesforce's built-in Health Check, Optimizer-style reports, setup audit trail and standard reports cover most of this checklist. Third-party tools help in very large orgs.