How Do You Audit a Neglected Salesforce Org?

You inherited an org from an admin who left eighteen months ago, and every question about why a field exists gets the same answer: nobody knows. Reports don’t match each other, half the automation seems to run on faith, and the billing page shows managed packages nobody remembers installing. How do you audit a neglected Salesforce org before building anything new on top of it? This post walks through the six areas worth checking, in the order that actually matters, before your next project touches the org.

1. Data Quality: Duplicates, Blanks, and Orphaned Records

Data quality problems compound faster than any other category, since every report, automation, and integration downstream inherits whatever mess already exists in the records themselves. A duplicate Account created eighteen months ago has likely spawned duplicate Opportunities, duplicate Contacts, and at least one report quietly double-counting revenue.

What to check: run your native duplicate and matching rules report to surface existing duplicate Accounts and Contacts. Look for Opportunities with no activity or Close Date change in over a year, since these usually represent dead deals nobody closed out. Check for Contacts with no Account and Cases with no Contact, both signs of records created outside your normal process.

2. Automation Debt: Old Workflow Rules, Process Builders, and Conflicting Flows

Automation debt shows up as behavior nobody can fully explain, because the person who built it is gone and the logic was never documented. Salesforce deprecated Process Builder and Workflow Rules in favor of Flow years ago, but neglected orgs often still run all three side by side on the same objects.

What to check: list every active Workflow Rule and Process Builder under Setup, since these are the most likely candidates for retirement or migration into Flow. Check the Flow error logs for automations that have been silently failing, sometimes for months. Look for two or more automations firing on the same object and field, which is a common cause of unpredictable behavior that looks like a bug but is really a race condition.

3. Security and Access: Profiles, Permission Sets, and Sharing Rules

Security debt accumulates quietly because access is usually granted under time pressure and rarely revisited afterward. A profile with “Modify All Data” handed out to fix one urgent problem two years ago is still sitting there, unreviewed, today.

What to check: pull a list of every profile and permission set with elevated permissions like “Modify All Data,” “View All Data,” or “Manage Users,” and confirm each one still matches an active job function. Review sharing rules for scope that has crept wider than the original business reason. Check for users who left the company but still show as active.

4. Unused Fields and Objects

Unused fields and objects are the clearest fingerprint of a neglected org, because they represent requests that were built and then abandoned rather than retired. Every unused field still shows up in page layouts, reports, and list views, adding clutter that slows down every future admin trying to understand the org.

What to check: Org Check’s field usage analysis, or a manual pass through Setup, will show which custom fields appear in zero reports, zero list views, and zero Flows. Flag custom objects with zero records or a record count that hasn’t moved in over a year. These are usually safe to deprecate once you confirm nothing external still references them.

5. Integration Health: What’s Actually Still Connected

Integration health matters because a neglected org accumulates connections faster than anyone deactivates them. A Connected App built for a tool the company stopped using two years ago is still a live access point into your data.

What to check: review every entry under Connected Apps and Named Credentials, and confirm each one maps to a system still in active use. Check integration user accounts specifically, since these are often left active long after the system they served was retired. Review API usage logs for unexpected callers, which can surface a forgotten integration nobody remembered existed.

6. Reporting Integrity: Do the Numbers Match

Reporting integrity is the area leadership notices first, usually when two dashboards show different numbers for what should be the same metric. This almost always traces back to one of the first five categories rather than being its own separate problem.

What to check: pull the same metric, such as total open pipeline, from three different reports or dashboards built at different times. Where they disagree, trace the difference back to report type, filter logic, or a duplicate record inflating one version. This is usually the step that reveals how much the earlier categories, particularly data quality, have been costing the business in decisions made on bad numbers.

Where to Start Checking Each Area

Frequently Asked Questions

How long does a full org audit take?

A first pass across all six areas typically takes one to two weeks for a single admin working part-time on it, longer if the org has years of undocumented history. An experienced consultant can usually compress this into three to five days, since they already know which symptoms point to which category. The audit itself is faster than what usually follows it: prioritizing and fixing what it finds.

Can we run this audit ourselves, or do we need a consultant?

A motivated in-house admin can run this audit using Org Check and the native reports referenced above, particularly for the data quality and unused-field categories. Security and integration review benefit from outside eyes, since an internal admin often lacks context on decisions made before they joined. Bringing in a consultant for the full pass is usually faster and catches issues a first-time internal audit misses.

What happened to Salesforce Optimizer?

Salesforce retired Optimizer, removing access during the Winter ’26 release for Hyperforce instances and Spring ’26 for the rest. Org Check, a free Salesforce Labs application available on AppExchange, is the direct successor and covers security, data model, automation, and field usage in an interactive dashboard rather than Optimizer’s static report. Since Org Check is a Labs product, it doesn’t carry official Salesforce support, so community resources are the main source of help if you hit an issue.

What’s the very first thing to check if we can only do one?

Start with data quality, specifically duplicate Accounts and Contacts, since every other category’s findings are distorted by dirty data underneath them. A reporting integrity issue, for example, is often just a data quality issue showing up one layer downstream. Fixing duplicates first makes every subsequent audit step more accurate.

What do we do with the audit results once we have them?

Turn the findings into a prioritized backlog rather than trying to fix everything at once, starting with anything actively causing wrong numbers or security exposure. This is also the natural point to put a governance process in place, since an audit without a process to prevent recurrence just resets the clock on the same neglect. An org review can produce both the audit and that prioritized plan in the same engagement.