MarTech Stack Audit: Checklist, Scoring Template, Decisions
By Joris van Huët
Enterprise Interim CMO & Marketing Leader · 15 years · 50+ orgs
Updated
2026-10-07
Published 2025-10-19
The short answer: a martech stack audit is a structured review of every marketing tool you pay for: what it costs, who uses it, what it overlaps with, how its data moves and whether it still supports the plan. Run it in four phases (inventory and cost, functionality and redundancy, data flow and compliance, future readiness), score each tool on seven weighted criteria, and end every tool with one decision: keep, consolidate or cut. The cost inputs, scoring template and decision table below turn the review into numbers you can defend at renewal.
Disclosure: I sell interim and fractional CMO work, so I am not a neutral party here.
A stack grows one purchase at a time. Each tool had a reason when it was bought, and a year later nobody checks whether the reason still holds. The audit makes that check. The licence is only one cost: add the hours spent keeping integrations working and the value of data that sits where nobody can use it.
The audit at a glance
| Phase | What to check | Red flags |
|---|---|---|
| 1. Inventory and cost | Every tool, its owner, annual cost, contract end date, notice period, seats paid versus seats used | Paid seats nobody logs into; renewals nobody owns; nobody knows the notice period |
| 2. Functionality and redundancy | Features mapped to needs, overlap between tools, how often each is used, what the team thinks | Two tools doing the same job; tools opened monthly or less |
| 3. Data flow and compliance | CRM integration, data silos, attribution support, GDPR, ePrivacy, CCPA as amended by CPRA, security | Customer data trapped in one tool; more than one source of truth; no data processing agreement; tracking that fires before consent |
| 4. Future readiness | Capacity for the planned volume, AI features and the rules that apply to them, automation through an API or n8n, Make or Zapier | No API; manual exports between systems; AI features nobody has tested |
Phase 1: Inventory and cost
List every marketing tool in use: CRM, CMS, email, SEO, social, analytics, advertising and automation. Include the ones paid for on a credit card or inside another team's budget. For each tool, collect these inputs:
| Input | What to record |
|---|---|
| Licence | The annual fee actually invoiced, plus paid add-ons, not the list price |
| Seats | Seats paid, and seats with activity in the last 90 days |
| Usage | The measure the vendor charges or limits on (contacts, sends, events, API calls), against the plan limit |
| Contract end date and notice period | When the term ends, how many days of notice cancellation needs, and whether it renews automatically |
| Integration hours | Hours a month spent keeping connections to other systems working, plus any one-off build cost |
| Maintenance hours | Hours a month on administration, support and training |
| Owner | One named person accountable for the tool |
| Data held | Which personal data it stores, where it is processed, and whether a data processing agreement is signed |
Total annual cost = licence + paid add-ons + (integration and maintenance hours per month x 12 x loaded hourly rate)
The loaded hourly rate is salary plus overhead for one working hour.
Cost per active seat = total annual cost / seats active in the last 90 days
Phase 2: Functionality and redundancy
- Feature mapping. Map each tool's core capabilities to the needs of the current plan.
- Overlap map. Put the jobs you need done in rows (send email, host landing pages, schedule social posts, report on pipeline) and the tools in columns. Mark which tool does each job. A job with two marks is an overlap, such as a standalone landing page tool next to a CMS that already builds landing pages.
- Usage and feedback. Take usage frequency from logins and activity, not opinion. Then ask the people who use each tool whether it makes their work easier or adds friction.
Phase 3: Data flow and compliance
- CRM integration and silos. Does the tool sync with your CRM natively and in both directions, or through exports? Name one system of record for each type of data. The CMO dashboard is only as accurate as these connections.
- Attribution. Does the tool support the attribution approach you use? The models and their limits are in marketing attribution in the enterprise. Disclosure: I founded Causality Engine, a causal attribution product, so weigh my view of attribution tools accordingly.
- Compliance and security. Check each tool against the rules below. This is a checklist for an audit, not legal advice.
| Rule | What to check for each tool |
|---|---|
| GDPR | A written processor contract with each vendor that handles personal data for you (Article 28). A valid transfer basis, such as an adequacy decision or the Commission's standard contractual clauses, for data leaving the EEA (Articles 44 to 46). A way to find, export and delete one person's data |
| ePrivacy Directive | Consent, or a valid exemption, before a tool stores or reads information on a visitor's device (Article 5(3)). The EDPB's Guidelines 2/2023 apply this to tracking pixels and tracking links as well as cookies. Article 13 requires prior consent for direct marketing by email to individuals, with a narrow exception for a company's own similar products offered to existing customers. Rules for company recipients are set nationally, so check each country you send to |
| CCPA as amended by CPRA | If you do business in California and meet the thresholds: rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive data (California Attorney General). Check tools that pass personal information to advertising partners. Regulations on risk assessments, cybersecurity audits and automated decision-making took effect on 1 January 2026, with the automated decision-making rules applying to significant decisions from 1 January 2027 (CPPA) |
| Internal security | Single sign-on, role-based access, an audit log, the vendor's current security attestation (for example SOC 2 or ISO 27001) and a documented way to get your data out |
| AI features | See the AI section below |
One EU change is pending: a Commission proposal of 19 November 2025 would amend both the GDPR and the ePrivacy Directive. The Parliament's procedure file still shows it awaiting a committee decision, so the rules above are the ones in force.
Phase 4: Future readiness
- Capacity for the planned volume. Take the growth plan, not a multiple. For each measure the tool charges or limits on, write down today's volume, the planned volume at the end of the contract term and the headroom you want above it, then check the vendor's documented limit and the price at that volume. Example, invented: 80,000 contacts and 25% growth a year over a three-year term is 80,000 x 1.25 x 1.25 x 1.25 = 156,250. With 20% headroom for forecast error, 187,500. If the plan stops at 150,000 contacts, or the next tier costs twice as much, that is a finding. The 20% is an assumption: pick a figure you can defend from past forecast accuracy.
- AI features. Does the platform offer AI your team will use, and does it connect to agentic marketing workflows? Test vendor claims on your own data, and ask which data the feature sends to which model provider.
- Automation potential. Does the tool have an API, webhooks or a connector for the automation tools you use, for example n8n, Make or Zapier?
AI tools and the EU AI Act: what applies to a marketing team (7 October 2026)
The AI Act, Regulation (EU) 2024/1689, became applicable on 2 August 2026, with some exceptions (European Commission). A team that uses AI tools at work is a deployer: anyone using an AI system under its authority, other than in a personal non-professional activity. A provider develops a system, or has one developed, and places it on the market or puts it into service under its own name (Article 3). The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved some dates.
| Provision | Applies from | What it means for a marketing team |
|---|---|---|
| AI literacy (Article 4) | 2 February 2025 | Take measures to support the AI literacy of staff who use AI tools. The Commission's Q&A gives a marketing case: employees using ChatGPT to write advertisement text should be told the specific risks, such as hallucination. No certificate is needed. National authorities supervise and enforce it from August 2026 (the Commission's timeline says 2 August, its Q&A says 3 August) |
| Prohibited practices (Article 5) | 2 February 2025 | AI using subliminal, manipulative or deceptive techniques that materially distort behaviour and cause significant harm, or exploiting vulnerabilities linked to age, disability or social or economic situation. Check personalisation and persuasion features |
| Deployer transparency (Article 50) | 2 August 2026 | Disclose AI-generated or manipulated image, audio or video that is a deep fake: content resembling real persons, objects, places or events that would falsely appear authentic. AI-generated text needs disclosure only when published to inform the public on matters of public interest, and not where it has had human review or editorial control and someone holds editorial responsibility for publishing it. By my reading, ordinary marketing copy is outside that text rule |
| Provider transparency (Article 50(1) and (2)) | 2 August 2026; 2 December 2026 for marking, on systems already on the market | The vendor's duty: chatbots must tell people they are dealing with an AI, and outputs must be marked in a machine-readable format. Ask each vendor how it complies. If you build a chatbot and put it into service under your own name, you are the provider |
| High-risk uses (Annex III) | 2 December 2027 (AI embedded in regulated products, Annex I: 2 August 2028) | Includes AI used to recruit or select people, in particular to place targeted job advertisements, and emotion recognition. If a tool claims to read emotion from faces or voices, take legal advice |
| General-purpose AI models | 2 August 2025 | The duty falls on the model providers, not on a team that uses their tools |
The Commission has published guidelines on Article 50 (20 July 2026) and a voluntary Code of Practice on transparency of AI-generated content (final, 10 June 2026). Use them to test your own case.
Score each tool
Score every tool from 1 to 5 on seven criteria. The weights add up to 100. The anchors say what a 1, a 3 and a 5 look like, so two reviewers reach the same score.
| Criterion | Weight | 1 | 3 | 5 |
|---|---|---|---|---|
| Fit with the current plan | 25 | No goal or process depends on it | Supports a goal, but a manual workaround exists | A named goal or revenue process breaks without it |
| Usage | 20 | Under 30% of paid seats active in 90 days | 50 to 69% active | 90% or more active |
| Cost for value | 15 | High cost, no output measured | Reasonable cost, output not measured | Output measured and clearly above cost |
| Integration and data flow | 15 | Manual exports, no API | Connector or middleware with manual steps | Native two-way sync with the system of record, documented API |
| Uniqueness | 10 | Another tool you keep does most of this job | Partial overlap | No other tool does this job |
| Compliance and security | 10 | A check fails or is unknown | Gaps documented, with fix dates | All checks pass, evidence on file |
| Future readiness | 5 | Cannot take the planned volume, no API | Adequate for the plan | Headroom beyond the plan, API and features fit the plan |
Scores of 2 and 4 sit between the anchors. For usage, 30 to 49% scores 2 and 70 to 89% scores 4. For a tool priced on usage rather than seats, use the share of the plan limit in use. The bands are mine: adjust them for your stack, and fix them before you score.
Weighted score = sum of (weight x score) / 100, a number from 1.0 to 5.0.
Worked example with three invented tools
Tool A is an email platform, Tool B a social scheduler and Tool C a landing page builder. The tools and figures are invented. The example assumes that the social module of your marketing suite and the landing page feature of your CMS cost nothing extra, and a loaded labour cost of $60 an hour.
| Tool A | Tool B | Tool C | |
|---|---|---|---|
| Licence and add-ons per year | $24,000 | $6,000 | $10,200 |
| Integration and maintenance hours per month | 8 | 2 | 4 |
| Total annual cost, labour included | $29,760 | $7,440 | $13,080 |
| Seats paid / active in 90 days | 12 / 10 | 8 / 3 | 5 / 1 |
| Cost per active seat | $2,976 | $2,480 | $13,080 |
| Contract ends, notice period, give notice by | 30 Sep, 30 days, 31 Aug | 30 Jun, 60 days, 1 May | 31 Mar, 30 days, 1 Mar |
| Criterion (weight) | Tool A | Tool B | Tool C |
|---|---|---|---|
| Fit with the current plan (25) | 5 | 3 | 2 |
| Usage (20) | 4 (83% of seats) | 2 (38%) | 1 (20%) |
| Cost for value (15) | 4 | 3 | 2 |
| Integration and data flow (15) | 4 | 3 | 2 |
| Uniqueness (10) | 5 | 2 | 1 |
| Compliance and security (10) | 4 | 4 | 3 |
| Future readiness (5) | 3 | 3 | 2 |
| Weighted score | 4.30 | 2.80 | 1.80 |
Tool A: (25 x 5 + 20 x 4 + 15 x 4 + 15 x 4 + 10 x 5 + 10 x 4 + 5 x 3) / 100 = 430 / 100 = 4.30.
Decide: keep, consolidate or cut
Check the conditions in this order. The thresholds are starting points I chose: adjust them after you have scored your first ten tools.
| Condition | Decision | What happens next |
|---|---|---|
| A compliance or security check fails, or the tool has no named owner | Fix by a date set in the audit, or cut | Record owner and date. Cut if the date passes |
| No seat active in 90 days, or weighted score below 2.5 | Cut | Export the data, list the workflows and reports that depend on it, give notice by the notice date, remove the integrations |
| Uniqueness of 2 or less, or weighted score from 2.5 to 3.4 | Consolidate | Move the features in use to the tool you keep, or reduce the plan or seats, and cancel the rest at contract end |
| Weighted score of 3.5 or more, and the checks pass | Keep | Confirm the owner, set the next review date, reconfirm the contract terms |
In the example, Tool A is kept at 4.30. Tool B is consolidated at 2.80: its scheduling can move into the suite you already license, so give notice by 1 May. Tool C is cut at 1.80: the CMS builds landing pages, so export the pages and give notice by 1 March. Savings are what you compute, not a percentage you assume. Cutting Tool C removes $13,080 a year, less an assumed 20 hours of migration at $60 ($1,200), so $11,880 in the first year. Consolidating Tool B removes $7,440, less an assumed 16 hours ($960), so $6,480. Together that is $18,360 in the first year under these assumptions.
Who should run the audit
The person who chose a tool has a stake in it, so the audit needs a reviewer with no stake in the result. There are three common options:
- Marketing operations with finance. Finance holds the contracts and invoices, and operations hold the admin consoles. It is the cheapest option and the one I would try first.
- An outside reviewer for a fixed scope, useful when the people who bought the tools also have to judge them.
- An interim or fractional marketing leader, who can run the audit as part of a wider mandate. I sell that option, so treat my view of it as interested. What an interim CMO is explains the role.
Whoever runs it needs access to finance data and the authority to stop a renewal.
When to audit
I recommend a full audit once a year, tied to the budget cycle, and a short version (cost, usage, owner) before each large renewal. Run one as well when a merger, a platform migration, a new marketing leader or a budget cut arrives. Start no later than the notice period plus the time you need to migrate: with 60 days' notice and 30 days to migrate, that is 90 days before the contract ends. An audit is overdue if you cannot trace campaign spend to revenue, the team spends more time maintaining software than using it, or there are several sources of truth for customer data.
Frequently Asked Questions
What is a martech stack audit?
A structured review of every marketing tool an organisation pays for: cost, ownership, usage, overlap with other tools, data flows and fit with the plan. It ends with a score and a keep, consolidate or cut decision for each tool.
How often should you audit your martech stack?
I recommend a full audit once a year, tied to the budget cycle, plus a short check of cost, usage and owner before each large renewal and before a merger, platform migration or change of marketing leadership. Start no later than the notice period plus the time needed to migrate.
What is the difference between a martech audit and a martech assessment?
People use the words interchangeably. In this post, an audit reviews the stack you have. An assessment, as I use the word, adds the target stack and the roadmap to reach it.
Who should run a martech audit?
Someone with access to finance data and the authority to stop a renewal, and with no stake in the tools under review. Marketing operations working with finance can do it, and an outside reviewer helps when the people who chose the tools must also judge them. An interim or fractional marketing leader is one option. I sell it, so weigh that accordingly.
How do you score a tool in a martech audit?
Score it from 1 to 5 on seven weighted criteria: fit, usage, cost for value, integration, uniqueness, compliance and future readiness. Multiply each score by its weight, add them up and divide by 100. Keep at 3.5 or above, consolidate from 2.5 to 3.4 and cut below 2.5, with compliance and ownership checks that override the score.
What does a martech audit deliver?
An inventory with owner, cost and usage for every tool; a score and a keep, consolidate or cut decision for each; a map of how customer data moves between systems; compliance gaps with owners and dates; and a calendar of contract notice dates.
Does the EU AI Act apply to a marketing team that uses AI tools?
If the Act covers your organisation, the team is a deployer. AI literacy (Article 4) and the prohibited practices (Article 5) have applied since 2 February 2025, and the transparency rules (Article 50), including disclosure of deep fakes, since 2 August 2026. The high-risk rules for Annex III uses, such as recruitment, apply from 2 December 2027 under the Digital Omnibus. This is not legal advice.
ABOUT THE AUTHOR
Joris van Huët is an enterprise interim CMO and marketing leader with 15+ years of experience across ING, P&G, Nestlé, BNP Paribas, WeTransfer, Vinted, and 50+ other organizations. He specializes in innovation projects (venture building, design sprints), agentic marketing (AI agent setup and orchestration), and hands-on multi-channel management. See the track record.
I wrote and published this with AI assistance, and I answer for it. Claims about my own experience are limited to the track record above, and a statistic links to its source or is labelled as an example. I sell interim and fractional CMO work, which is why this site exists. How this site is written.
A senior operator doing the work: campaigns, channels, CRM and AI agents, live from day one.