10 Salesforce Health Check Findings That Surprise CTOs

The Salesforce org has been live for two years. The team uses it daily. Dashboards exist. Reports get pulled. Things look healthy from the outside. Then the Salesforce account executive drops a line on the next renewal call: “You should run a health check.” The CTO’s first reaction is to assume it is a sales tactic — a thinly veiled pretext to upsell into a managed services engagement. Sometimes that is what it is. More often, it is the account team noticing patterns that show up in their visibility but not in yours. Most health checks surface ten or more findings that nobody on the internal team had visibility into. The findings are not exotic. They are configuration drift, accumulated debt, and small decisions that compound.

Finding 1: Permission Set Sprawl

Permission sets are additive. Every time a user needs a new capability, an admin grants a permission set. Over three years, individual users accumulate eight, ten, fifteen permission sets — each granted for a specific need that nobody remembers. The CTO is rarely aware that some users are functionally administrators through stacked permissions even though no single set grants them admin access. A clean org optimization pass typically consolidates permission stacks by 40 to 60 percent without changing what any user can actually do.

Finding 2: Validation Rule Conflicts

Validation rules accumulate over time. A rule added in year one to prevent a specific data quality issue starts conflicting with a rule added in year three to support a new business requirement. The result is users hitting validation errors that block legitimate workflows. Most admins do not realize the conflict exists until users file support tickets. A Health Check inventories all active validation rules and identifies the ones blocking legitimate work or duplicating each other.

Finding 3: Custom Object Proliferation

A typical three-year-old Salesforce org has 30 to 60 custom objects. Most of them were created with good intentions to model a specific business entity. Many of them duplicate functionality already in the standard objects. Many more were created for projects that never launched, for teams that no longer exist, or for use cases that pivoted. The Health Check categorizes each custom object into “actively used,” “underused,” “duplicates standard,” and “abandoned.” The output is a consolidation roadmap that typically retires 20 to 40 percent of the custom object footprint.

Finding 4: Integration Latency Nobody Is Monitoring

Most Salesforce orgs have 5 to 15 active Salesforce integrations — ERP sync, marketing automation sync, billing sync, ticketing sync. Each one was set up by someone, monitored for a few weeks after launch, then left to run. When an integration breaks, the symptom usually shows up two to three weeks later as reports that look wrong or data that seems incomplete. Nobody on the day-to-day team is looking at integration health metrics. The Health Check pulls the last 90 days of sync history for every integration and flags anything with elevated error rates or sync delays. The marketing automation sync is a common offender on its own — see our diagnostic guide on why your Pardot sync keeps failing if that’s the integration flagged. If the marketing platform itself was never fully implemented correctly in the first place, our post on the 5 patterns behind failed Marketing Cloud rollouts covers the deeper root causes.

Finding 5: Report Folder Permission Drift

Field-level security restricts which fields a user can see on a record. But report folder permissions can leak the same data through summary views, calculated columns, and exportable formats. Over time, report folders shared by admins accumulate audiences that were granted access for a specific need and never removed. The CTO discovers during a SOC2 audit that the finance dashboard was shared with the entire sales team three years ago. For what a full security review actually catches, see our breakdown of the 10 Salesforce security gaps most orgs miss. Salesforce’s Data Security Trailhead module walks through the right model for restricting access; Health Checks pull the actual current state and compare it to the model.

Finding 6: Workflow Rules Still Running

Salesforce deprecated Workflow Rules in favor of Flow. The official guidance is to migrate. Many orgs never did, or migrated partially. The org now runs a mix of old Workflow Rules, Process Builder processes, and Flows — three different automation tools doing similar work, with overlapping triggers and unpredictable execution order. Salesforce will eventually retire the old tools. The Health Check inventories every active automation, maps the dependencies, and produces a migration roadmap.

Finding 7: Stale License Allocation

Salesforce licenses are expensive. The most overlooked finding in nearly every Health Check is the percentage of licensed users who have not logged in within 90 days. In some orgs, the number reaches 15 to 25 percent — every one of them a paid seat producing zero value. The cleanup is straightforward: deactivate inactive users, reclaim the licenses, and either rightsize the contract or reallocate the seats. The annual savings often exceed the cost of the Health Check by several multiples.

Finding 8: Data Quality Decay

Duplicate Accounts and Contacts accumulate steadily. A new lead enters the system, the deduplication rule does not catch a slightly different name spelling, and now there are two Account records for the same company. Multiply by years of inbound traffic and the duplicate rate often hits 5 to 15 percent of total records. The downstream effects are real: split pipeline reporting, conflicting sales rep ownership, blocked marketing automation. The Health Check measures the current duplicate rate and recommends specific deduplication rules and cleanup processes.

Finding 9: Adoption Pockets

The org-level adoption metric looks healthy — 90 percent of users logged in this month. The team-level view tells a different story. The customer success team logs in daily. The sales team logs in three times a week. The marketing team logs in twice a month. The product team logged in once last quarter. Adoption pockets are where Salesforce is paid for but not creating value. The Health Check breaks adoption down by team, role, and feature usage, and identifies the targeted training and enablement work that closes the gaps.

Finding 10: No Automated Backups

The CTO always assumes Salesforce handles backups. Salesforce provides some recovery options, but they are limited and slow — Data Export every seven days as a CSV bundle, retention measured in months not years, and recovery requiring manual data restoration. For real business continuity, a third-party backup tool is the standard pattern. The Health Check verifies whether automated backups exist, tests the recovery process, and documents the RTO (recovery time objective) and RPO (recovery point objective) the current setup actually delivers — often very different from what the team assumed.

What a Salesforce Health Check Costs (and What’s Included)

Salesforce Health Check pricing varies by org size and scope. A focused Health Check on a small-to-mid-size org (under 100 users, single cloud, limited integrations) typically lands in the $3,000 to $8,000 range. A comprehensive Health Check on a mid-market org (100 to 500 users, multi-cloud, multiple integrations) typically runs $8,000 to $20,000. Enterprise-scale Health Checks with deep integration analysis, security audit, and remediation roadmap can exceed $30,000. Free or fixed-fee “discovery” engagements often produce a thinner deliverable focused on creating a follow-on engagement.

What is typically included: configuration review of users, profiles, permission sets, roles, and sharing rules. Security audit of MFA, IP restrictions, audit trail, and encryption. Data quality assessment with duplicate rates and data completeness scoring. Integration health analysis across all active integrations. Adoption analysis broken down by team and feature. A written findings report with prioritized recommendations. What is typically NOT included unless explicitly scoped: remediation work, training, change management, and ongoing managed services. Cloud Nexus offers a free 90-minute Salesforce audit that covers the highest-impact subset of these findings as a starting point.

How Often to Run a Salesforce Health Check

The right cadence depends on org maturity and rate of change. Established orgs that are relatively stable benefit from an annual Health Check. High-growth orgs adding users, features, and integrations quarterly benefit from semi-annual Health Checks. Orgs in the middle of a major migration, integration, or org consolidation project should run a Health Check at the start, midpoint, and post-launch to catch drift before it accumulates.

Trigger-based reviews are equally important. After every major Salesforce release (Spring, Summer, Winter), run a focused review of automation and integrations because release changes break edge cases. After admin team turnover, run a review to surface tribal knowledge that left with the previous team. After acquisitions or business unit reorganizations, run a review because role hierarchies and sharing models almost always drift. Before any external audit (SOC2, HIPAA, ISO 27001), run a security-focused Health Check 60 to 90 days ahead so cleanup happens on your timeline, not the auditor’s.

Salesforce Health Check vs Salesforce Audit: What’s the Difference?

The terms get used interchangeably, but they describe different scopes. A Salesforce Health Check is broad and diagnostic — it covers configuration, security, data quality, automation, integration, and adoption across the entire org. The deliverable is a prioritized findings list with recommendations. The audience is internal stakeholders (CIO, CTO, Salesforce admin lead) who want a comprehensive view of the org’s state.

A Salesforce Audit is narrower and compliance-focused. It usually maps to a specific external framework (SOC2, HIPAA, ISO 27001, PCI-DSS) and validates whether the org meets that framework’s specific requirements. The deliverable is a compliance evidence package and an attestation that the controls exist and are operating. The audience is external auditors and compliance officers. Health Checks often feed into Audits — the comprehensive view from a Health Check identifies the gaps that need to close before the formal audit. Skipping the Health Check and going straight to the Audit means cleanup happens under audit pressure.

How a Salesforce Health Check Improves User Adoption

Adoption failure is rarely a training problem. It is usually a configuration problem disguised as a training problem. A sales rep who has to click through five page sections to log an activity will skip the activity. A service agent whose Case page layout shows 40 fields will fill in three. A marketing manager whose Campaign creation flow takes 12 minutes will batch Campaigns instead of building them properly. Each of these is a configuration decision made by an admin who was not measuring the friction it created.

A Health Check that includes adoption analysis surfaces the friction. Time-to-record-an-activity gets measured. Page layout complexity gets scored. Search performance gets benchmarked. The fix is usually a small set of high-leverage configuration changes — page layout simplification for the most-used objects, default field values to reduce data entry, lightning component reorganization to put the most-used actions in the most-visible spots. Adoption improves not because users were retrained, but because the path of least resistance became the right path.

When to Schedule Your Next Health Check

Consider booking a Health Check if any of these are true:

• It has been more than 12 months since the last comprehensive review
• You have a SOC2, HIPAA, ISO 27001, or PCI audit on the calendar in the next 6 months
• Your team is asking why reports are missing data, why automation is unreliable, or why integrations break unpredictably
• You inherited the org from a previous admin and want a baseline before making changes
• License renewal is approaching and you want to know how many seats are actually being used

A free 90-minute Salesforce audit is a starting point — the output is a written findings list with the top 5 to 10 highest-priority items, not a sales pitch.

Quiet Drift Costs More Than Loud Problems

The reason Health Check findings catch CTOs off guard is that none of them are visible from the daily-use view. The team uses Salesforce. Reports run. Dashboards refresh. From the inside, everything looks fine. The drift happens slowly, in places nobody is monitoring. Permission sets accumulate one grant at a time. Custom objects appear one feature request at a time. Integrations slow down a few seconds per quarter. Each individual change is too small to flag. The cumulative effect over two or three years is the gap that an outside review surfaces in 90 minutes.

The orgs that quietly compound value over five years are not running fundamentally different Salesforce. They are running the same Salesforce, audited regularly, with drift caught early. The cost of catching drift early is a fraction of the cost of unwinding it after it has compounded.