Salesforce Org Slow? 7 Audits to Run Before You Call a Consultant

Your Salesforce org is acting weird. Reports take 30 seconds to load instead of 5. The CFO mentioned saving on Salesforce licenses next year. A new admin joined and asked “why do we have 47 custom objects?” Maybe an integration started failing for no obvious reason. Before you spend money calling a consultant, here’s what you should audit in a Salesforce org health check — the 7 audits every Salesforce admin should run annually that surface 80% of the technical debt issues silently breaking your org. Most of them take an hour each. All of them save money.

This guide walks through the full health-check audit framework Cloud Nexus uses on paid engagements. If you’d rather start by having us run the abbreviated version on your actual org, request a free 90-minute senior-led audit — same methodology, scoped to fit a single Zoom call, with a written summary delivered within 24 hours.

Why Every Salesforce Org Needs an Annual Health Check

Salesforce orgs accumulate technical debt the same way any complex system does — gradually, invisibly, until something breaks or someone notices the licensing bill. The pattern we see at Cloud Nexus across mid-market clients:

• Year 1: Clean implementation, well-organized, everyone knows what’s where
• Year 2-3: Quick wins added. Some custom fields. A few workflows. Still manageable.
• Year 4-5: Multiple admins have come and gone. Custom objects exist that nobody fully understands. Workflows fire alongside flows triggered by triggers, all on the same object.
• Year 6+: “We can’t make changes here, things break.” The org has become a fragile system that the team works around.

An annual 7-audit health check catches the drift before it becomes paralyzing. None of the seven audits below take more than a few hours. All of them surface issues that compound over time if left alone.

Audit 1: Technical Debt (the slow killer)

The single most common diagnostic complaint: “Salesforce is slow.” Usually it’s not Salesforce — it’s accumulated technical debt slowing specific operations.

What to audit:

• Slow-loading reports — anything taking >10 seconds to load. Usually fixed by indexing, filter optimization, or splitting into smaller reports.
• Unused custom fields — fields not modified or referenced in formulas in the last 12 months. Each one is metadata weight.
• Broken formulas — formula fields showing #ERROR. Often field references to deleted fields.
• Stale list views — views with filter logic referencing deprecated picklist values or deleted users.
• Excessive page layouts — multiple layouts per object that diverged over time, each one with slightly different fields visible.

Tools to use: Salesforce Optimizer report (built-in, free, generates a detailed PDF audit). Workbench for advanced metadata queries.

What to fix first: The slowest reports and the formula errors. Both have user-visible impact. Unused fields can be batched into a separate cleanup project.

Audit 2: Unused Permission Sets (security + license waste)

Permission Sets are the modern Salesforce way to grant access, but they accumulate over time and create both security drift AND license waste.

What to audit:

• Orphaned permission sets — sets with zero active users assigned. Just metadata clutter.
• Permission set duplicates — two sets granting the same access, created at different times by different admins.
• Inactive users with active permissions — users who left the company months ago still holding permission set assignments.
• Excessive admin-level access — users holding “View All Data” or “Modify All Data” who don’t need it for their actual job.
• License-tied permission sets — sets granting feature access that requires specific license types. Mismatches waste licenses.

Tools to use: SOQL queries against PermissionSetAssignment. Setup → Permission Sets → user count per set. Our Salesforce security work includes a full permission set audit as a standard scope item.

What to fix first: Inactive user permissions (security risk) and excessive admin access (compliance + security risk). Orphaned sets are cosmetic.

Audit 3: Duplicate Rules in Sales Cloud

Duplicate accounts and contacts proliferate when duplicate rules aren’t set up or aren’t enforced. The cleanup is expensive; the prevention is cheap.

What to audit:

• Current duplicate count — run a SOQL query for Accounts with matching names. Run for Contacts matching email. Run for Leads matching email + company.
• Active duplicate rules — what rules are configured? What matching logic do they use? Are they set to BLOCK or just ALERT?
• Recent duplicate creation — accounts/contacts/leads created in last 30 days. Compare to last 90 days. Is the duplicate creation rate accelerating?
• Source of duplicates — are duplicates coming from manual user creation, integration syncs, web-to-lead forms, or imports?

Tools to use: Duplicate Record Sets (built-in object). Salesforce’s standard Duplicate Management features. Third-party dedup tools (Cloudingo, DataGroomr) for larger cleanup projects.

What to fix first: Block-mode duplicate rules on Lead conversion (the entry point most likely to create duplicates). Then bulk merge existing duplicates working from highest-value accounts down.

Audit 4: Custom Object Proliferation

Every Salesforce admin inherits at least one custom object that nobody can explain. By year 5, orgs typically have 20-50+ custom objects, and most teams can’t remember why they all exist.

What to audit:

• All custom objects — list them. Setup → Object Manager → filter to Custom.
• Record count per object — objects with <10 records are suspect. Objects with 0 records have no reason to exist.
• Last activity per object — when was the last record created or modified? Objects with no activity in 6+ months are candidates for archival.
• Page layouts and visualizations — is the object referenced anywhere? In what reports? In what flows?
• Custom object dependencies — does anything depend on this object? Lookup fields from other objects, related lists, formulas referencing its fields?

What to fix first: Zero-record orphans (delete cleanly with no impact). Then low-activity objects that have no dependencies (archive their data, then delete). High-record objects need stakeholder consultation before action.

Audit 5: Workflow Rule & Process Builder Cleanup

Salesforce is deprecating both Workflow Rules and Process Builder in favor of Flow. Every Salesforce org has accumulated automation across all three technologies, and they often fire in unpredictable order.

Our Salesforce automation and flows work typically includes a complete workflow → flow migration as the cleanup project after this audit.

Audit 6: Reports & Dashboards That No One Uses

Every Salesforce org has 5x more reports than anyone uses. Cleaning them up makes the report list usable again.

What to audit:

• Reports run in last 90 days — Salesforce tracks this. Most reports haven’t been opened in years.
• Dashboards with broken components — components showing #N/A or errors. Either the source report broke or the filter logic deprecated.
• Folders with no owner — folders owned by deactivated users. Reports become orphaned.
• Duplicate reports — multiple reports answering the same question, each maintained by a different team.
• Reports referencing deleted custom fields — these break silently and return wrong numbers.

What to fix first: Delete reports unrun in 12+ months. Re-home orphaned folders. Fix broken dashboard components.

For the reporting platform itself, our reporting and dashboards work covers the broader strategy of which reports your business actually needs (often fewer than you have).

Audit 7: Integration & API Call Hygiene

API limits and integration failures are silent killers — they don’t surface until something breaks user-facing. Audit them before the break.

What to audit:

• API call consumption — Setup → API Usage Notification. Are you near the daily limit? What’s consuming most of the budget?
• Connected Apps — list all OAuth-authorized apps. Apps not used in 6+ months should be removed.
• Active integration users — service accounts with API access. Verify each one is actively used.
• Recent integration failures — login history for integration users. Failed logins indicate stale credentials or broken integrations.
• Webhook endpoints — endpoints firing to URLs that may no longer be valid. Often invisible until something breaks downstream.

Tools to use: Setup → System Overview (API usage). Setup → Login History. Setup → Connected Apps OAuth Usage.

For broader security context, Salesforce’s built-in Health Check tool provides additional security baseline checking that complements the integration audit. Run both alongside each other annually.

The 90-Minute Audit Tool That Surfaces All 7 In One Pass

Running each audit individually takes a few hours and produces 7 separate reports. The unified alternative we use at Cloud Nexus for client engagements is the Free 90-Minute Salesforce Org Review — a structured walkthrough that surfaces issues across all 7 audit categories in a single session, then leaves you with a prioritized punch list.

The benefit of the unified approach: issues across audits often cluster (a permission set problem often correlates with a security audit issue, which often correlates with a workflow firing in the wrong context). The unified review surfaces those patterns; individual audits miss them.

How Often to Run a Full Health Check

For most mid-market B2B orgs:

• Annually: Full 7-audit health check. Best timing is right before annual planning so findings inform the next year’s roadmap.
• Quarterly: Spot-check audits 1 (technical debt), 5 (automation), and 7 (integrations) — the ones most likely to drift fast.
• After major changes: New CRM integration, major user role change, system consolidation — run the relevant audits to catch new issues immediately.
• Before any major project: Pre-Agentforce, pre-Revenue Cloud, pre-migration — audit the org’s current health BEFORE adding more weight to it.

Most orgs that run annual audits discover the cleanup is much smaller than they feared. Most orgs that don’t audit are surprised by the size of the technical debt when they finally do.

FAQ

What should I audit in a Salesforce org health check?

Seven audits cover 80% of the technical debt issues silently breaking mid-market Salesforce orgs: (1) Technical Debt — slow reports, unused fields, broken formulas, stale list views; (2) Permission Sets — orphaned assignments, inactive user permissions, security drift, license waste; (3) Duplicate Rules — duplicate accounts and contacts proliferating from manual entry, integrations, or imports; (4) Custom Object Proliferation — orphaned custom objects with no active use; (5) Workflow and Flow Cleanup — deprecated workflows still firing, conflicting automation on the same object, Process Builder migration; (6) Reports and Dashboards — reports nobody uses, broken dashboards, orphaned folders; (7) Integration and API Call Hygiene — failing integrations, API limit consumption, stale Connected Apps. Most mid-market orgs fail at least 3 of the 7 on first audit. Each takes about an hour to run.

How do I audit technical debt in my Salesforce org?

Five primary check categories. (1) Slow-loading reports — anything taking more than 10 seconds to load, usually fixed by indexing, filter optimization, or splitting; (2) Unused custom fields — fields not modified or referenced in formulas in the last 12 months, each one adds metadata weight; (3) Broken formulas — formula fields showing #ERROR, usually field references to deleted fields; (4) Stale list views — views with filter logic referencing deprecated picklist values or deleted users; (5) Excessive page layouts — multiple layouts per object that diverged over time. Tools: Salesforce Optimizer report (built-in, free, generates detailed PDF audit) is the fastest single tool. Workbench for advanced metadata queries when you need them.

How do I clean up unused permission sets in Salesforce?

Five-step audit and cleanup: (1) Find orphaned permission sets — sets with zero active users assigned, just metadata clutter; (2) Find duplicates — two sets granting the same access, created at different times by different admins, consolidate; (3) Find inactive users still holding permissions — users who left the company months ago with active permission set assignments, remove for security; (4) Find excessive admin access — users with “View All Data” or “Modify All Data” who don’t need it for their job, audit and right-size; (5) Find license-tied permission set mismatches — sets granting access requiring specific license types you may not have, costs license waste. Tools: SOQL queries against PermissionSetAssignment, Setup → Permission Sets user count view. Inactive user permissions are the highest-priority cleanup (security risk).

How do I audit duplicate rules in Sales Cloud?

Four-question audit: (1) Current duplicate count — run SOQL queries for Accounts with matching names, Contacts matching email, Leads matching email + company; (2) Active duplicate rules — what rules are configured? What matching logic? Are they set to BLOCK or just ALERT?; (3) Recent duplicate creation rate — accounts/contacts/leads created in last 30 days vs last 90 days, is duplicate rate accelerating?; (4) Source of duplicates — are they coming from manual user creation, integration syncs, web-to-lead forms, or imports? The fix priority: enable BLOCK mode on Lead duplicate rules (catches duplicates at the entry point), then bulk merge existing duplicates working from highest-value accounts down. Third-party dedup tools (Cloudingo, DataGroomr) are worthwhile for large cleanup projects.

How do I stop custom object proliferation in Salesforce?

Prevent and clean up. To prevent: establish a custom object request process that requires use case justification, expected record count, and named owner before any new custom object is created. To clean up existing proliferation: (1) list all custom objects (Setup → Object Manager → filter to Custom); (2) check record count per object — objects with under 10 records are suspect, zero-record objects can be deleted cleanly; (3) check last activity per object — no activity in 6+ months means candidates for archival; (4) check dependencies — does anything (lookup fields, related lists, formulas, flows, reports) reference this object?; (5) consult stakeholders before deleting any object with meaningful record count. Start with zero-record orphans (low risk), then low-activity objects with no dependencies, then larger objects requiring stakeholder consultation.

Running a Salesforce org health check yourself takes 8-12 hours of focused effort and assumes you know what good looks like in each of the seven categories above. If you’d rather start with the abbreviated version, book a free 90-minute audit with a Cloud Nexus senior consultant and walk away with the three highest-leverage fixes prioritized for your specific org.