Free — no call, no pitch

The 12-domain Salesforce self-audit checklist

36 questions across the same twelve domains we audit professionally — permission model, security, sharing, automation, Apex, data, licenses, integrations, AI readiness, lead-to-cash, and governance. Answer them honestly in an afternoon and you'll know where your org stands before anyone else does.

What's inside

The twelve domains, three questions each

Every question is answerable from Setup by someone who knows the org — no tools, no export, no consultant required.

Permission model — tiers, profiles, permission-set governance
Security & access — admin sprawl, MFA, connected apps
Sharing & visibility — org-wide defaults, rule rationale
Automation architecture — flow patterns, execution order
Automation debt — Workflow Rules & Process Builder still live
Apex health — coverage, anti-patterns, trigger discipline
Data model — field sprawl, descriptions, picklist hygiene
License & users — inactive seats, orphaned admins
Integration & UI surface — legacy pages, event channels
AI & agent readiness — what an agent would inherit today
Lead-to-cash — quote, order, and contract integrity
Governance & drift — is the pipeline actually followed?

If more than a handful of answers are "no" or "not sure," that's exactly what the full audit quantifies — with evidence, severity ranking, and a free trial preview from a real run against your org.

Unlocked

The full checklist

Work through it honestly — "not sure" counts as a finding. A copy is also on its way to your inbox.

01 — PERMISSION MODEL

Does every business-critical object have deliberate permission-set tiers (read-only / edit / full), or does access mostly come from profiles built years ago?
Could you name what each permission set group is for — and does its name still match what it grants?
If you removed a random user's profile-level access tomorrow, would permission sets alone still describe their job?

02 — SECURITY & ACCESS

How many users or permission sets grant Modify All Data or View All Data — and can you justify each one this quarter?
Is MFA actually enforced for every user, including integration and API users?
Do you know which connected apps have full OAuth scope and relaxed IP restrictions — and who owns each?

03 — SHARING & VISIBILITY

Are any revenue or PII objects set to Public Read/Write org-wide default internally?
For each sharing rule, could someone new discover WHY it exists without asking a veteran?
Are there roles in the hierarchy no active user holds — and does anything still depend on them?

04 — AUTOMATION ARCHITECTURE

For each core object, can you say in one sentence which single flow or trigger owns its automation entry point?
Does business logic live in decision/processor flows, or is it embedded directly in entry-point flows where it can't be reused or tested?
If two automations fire on the same record change, do you control the order — or does Salesforce?

05 — AUTOMATION DEBT

How many active Workflow Rules are still running business logic in production?
How many active Process Builder processes remain — and is there a dated migration plan to Flow?
Is any deprecated automation stacked on an object that ALSO has a record-triggered flow or trigger?

06 — APEX HEALTH

Is org-wide test coverage above 75% — and would you know if it dropped below the deploy blocker tomorrow?
Are there classes at zero coverage, SOQL/DML inside loops, or hardcoded record IDs in production code?
Does any object have more than one active trigger?

07 — DATA MODEL & SCHEMA HYGIENE

Do any objects carry more than 150 custom fields — and could anyone say what the last 50 are for?
What share of your custom fields have a Description or help text? (An AI agent — or a new admin — grounds on exactly this.)
Are there picklists with near-duplicate values (e.g. "Won", "won", "Closed Won") feeding your reporting?

08 — LICENSE & USER MANAGEMENT

How many deactivated-in-practice users still hold paid licenses?
Are there System Administrator users with no role, no manager, or no obvious owner?
When did you last reconcile license utilization against what you're actually paying Salesforce?

09 — INTEGRATION & UI SURFACE

How many Visualforce pages are still live — and which are actually used?
Are outbound messages or CDC channels feeding systems nobody remembers?
Could you list every connected app with API access, with an owner for each?

10 — AI & AGENT READINESS

If you enabled Agentforce tomorrow, which user would it execute as — and what does that user inherit right now?
Could your permission model express "read-only, these five objects, nothing else" for an agent — without inventing a new architecture first?
Is your schema good enough to ground an AI on: described fields, clean picklists, unambiguous record types?

11 — LEAD-TO-CASH

Does quote and order data flow through governed automation, or through exports, spreadsheets, and manual re-entry?
Are discount approvals enforced by the system, or by convention?
If a deal closed right now, would Contract, Order, and finance systems agree on the numbers without a human reconciling them?

12 — GOVERNANCE & DRIFT

Is Git (or any VCS) the source of truth for your org's metadata — or is the org itself the only record?
Do changes actually go through your CI/CD pipeline, or do admins ship hotfixes directly in production alongside it?
Could you reconstruct WHO changed WHAT in Setup last month, and why?

More than a handful of "no" or "not sure"? That's exactly what the full audit quantifies — with evidence, severity ranking, and a free trial preview from a real run against your org.